16 ms·

If you're a LastPass user, you need to be alarmed (and maybe even a little intimidated) by the recent security breach update revealing that threat actor was abl

If you're a LastPass user, you need to be alarmed (and maybe even a little intimidated) by the recent security breach update revealing that threat actor was able to access and copy a BACKUP OF CUSTOMER VAULT DATA, including fully-encrypted sensitive fields like website usernames and passwords, secure notes, and form-filled data.

Fire-Dragon-DoL 4y ago
I wish it was just that. Apparently URLs are not encrypted, and they also have non encrypted fields about "password breached" and "password poor quality"
SV_BubbleTime 4y ago
Didn’t everyone anticipate this? It’s still not a problem if you used a good passphrase, and haven’t reused it anywhere else. It’s not ideal, but losing the encrypted blob isn’t that big of a deal if all the other parts were working correctly. Lastpass claims user local decryption so they never had your key. This isn’t that much different than logging in on a foreign computer, or storing your keepass on Dropbox, or losing a USB with the encrypted blob on it. I’m not defending them, just being practical that this still won’t effect most users.
- nixgeek 4y ago
  “all the other parts are working correctly”, is IMHO the issue here, because LastPass doesn’t consider the URL to be sensitive material. What I think that means is in this breach the bad actor has your account information like emails and IP addresses used to access the vault, but can WITHOUT any brute force also determine every site the vault has an entry to access. The consequences of that could be severe for some. Did you tell your wife about that account on Hinge or Grindr? Perhaps you live somewhere where being out isn’t an option and could get you killed? Do you have an account on some site or other which primarily exists to leak to journalists?
- FatActor 4y ago
  If you read any topic on password managers on HN, there is very little technical discussion, its emotional and grandstanding. A majority of the comments tell people why their password manager sucks and your scheme is the best. It's any tech religious war basically, with more sides. But yes, that's the point: the devs start with the presumption that the blob will eventually be stolen and how to protect that. That's the initial value proposition. (Storing URLs in plaintext was dumb, but any browser extension knows every URL you visit, same with your ISP, so there's that.)
  - thefurdrake 4y ago
    Choice of password storage and deployment seems to be an intensely-personal one that seems less attached to absolute security; it's based on how much one is really willing to trust others, how much one wants to hear about security, how exhausted one is hearing about security... and a lot of confusion because, technical-minded or not, there are a more variables than I think any one human can account for. It's stressful. I gave up on making recommendations long ago. Because of stuff like this (the latest lastpass breach), I can't in good-faith recommend cloud-based password storage, but because I know most people aren't as willing to invest a ton of time, I also can't in good-faith recommend "keepass database on cloud storage using an innocuous .png keyfile stored elsewhere that you have to wget on every new device".
- blakesterz 4y ago
  I did anticipate this... BUT and this is a big BUT... I didn't expect ANY of my stuff to be unencrypted! They keep saying that THEY CAN NOT read ANYTHING in my vault. Now the update says some of my stuff wasn't encrypted. This is way beyond acceptable. I know URLs aren't the worst thing in the world to expose. But the fact that ANY part of my vault is open is wrong.
  - nixgeek 4y ago
    If you can find the LastPass equivalent to 1Password’s detail on the vaults and their security white paper [1] then I would love to take a look! [1] https://support.1password.com/cs/opvault-design/ https://support.1password.com/cs/opvault-design/
    - wlonkly 4y ago
      I found a third-party description[1], which someone in another forum linked to as evidence that notes inside items are encrypted. None of the other unencrypted fields feel as high-value as the URL field, although some of them are clearly valuable, such as whether the password was autogenerated, whether or not there are attachments, and last password change timestamp, which is convenient for comparing against known breaches. That said, I have no information as to the veracity of that description, except that others seem to be using the library it belongs to. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md#structures-of-some-types-of-composite-data-blocks https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

Fire-Dragon-DoL 4y ago

I wish it was just that. Apparently URLs are not encrypted, and they also have non encrypted fields about "password breached" and "password poor quality"

SV_BubbleTime 4y ago

Didn’t everyone anticipate this? It’s still not a problem if you used a good passphrase, and haven’t reused it anywhere else. It’s not ideal, but losing the encrypted blob isn’t that big of a deal if all the other parts were working correctly. Lastpass claims user local decryption so they never had your key. This isn’t that much different than logging in on a foreign computer, or storing your keepass on Dropbox, or losing a USB with the encrypted blob on it. I’m not defending them, just being practical that this still won’t effect most users.

nixgeek 4y ago
“all the other parts are working correctly”, is IMHO the issue here, because LastPass doesn’t consider the URL to be sensitive material. What I think that means is in this breach the bad actor has your account information like emails and IP addresses used to access the vault, but can WITHOUT any brute force also determine every site the vault has an entry to access. The consequences of that could be severe for some. Did you tell your wife about that account on Hinge or Grindr? Perhaps you live somewhere where being out isn’t an option and could get you killed? Do you have an account on some site or other which primarily exists to leak to journalists?
FatActor 4y ago
If you read any topic on password managers on HN, there is very little technical discussion, its emotional and grandstanding. A majority of the comments tell people why their password manager sucks and your scheme is the best. It's any tech religious war basically, with more sides. But yes, that's the point: the devs start with the presumption that the blob will eventually be stolen and how to protect that. That's the initial value proposition. (Storing URLs in plaintext was dumb, but any browser extension knows every URL you visit, same with your ISP, so there's that.)
- thefurdrake 4y ago
  Choice of password storage and deployment seems to be an intensely-personal one that seems less attached to absolute security; it's based on how much one is really willing to trust others, how much one wants to hear about security, how exhausted one is hearing about security... and a lot of confusion because, technical-minded or not, there are a more variables than I think any one human can account for. It's stressful. I gave up on making recommendations long ago. Because of stuff like this (the latest lastpass breach), I can't in good-faith recommend cloud-based password storage, but because I know most people aren't as willing to invest a ton of time, I also can't in good-faith recommend "keepass database on cloud storage using an innocuous .png keyfile stored elsewhere that you have to wget on every new device".
blakesterz 4y ago
I did anticipate this... BUT and this is a big BUT... I didn't expect ANY of my stuff to be unencrypted! They keep saying that THEY CAN NOT read ANYTHING in my vault. Now the update says some of my stuff wasn't encrypted. This is way beyond acceptable. I know URLs aren't the worst thing in the world to expose. But the fact that ANY part of my vault is open is wrong.
- nixgeek 4y ago
  If you can find the LastPass equivalent to 1Password’s detail on the vaults and their security white paper [1] then I would love to take a look! [1] https://support.1password.com/cs/opvault-design/ https://support.1password.com/cs/opvault-design/
  - wlonkly 4y ago
    I found a third-party description[1], which someone in another forum linked to as evidence that notes inside items are encrypted. None of the other unencrypted fields feel as high-value as the URL field, although some of them are clearly valuable, such as whether the password was autogenerated, whether or not there are attachments, and last password change timestamp, which is convenient for comparing against known breaches. That said, I have no information as to the veracity of that description, except that others seem to be using the library it belongs to. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md#structures-of-some-types-of-composite-data-blocks https://github.com/cfbao/lastpass-vault-parser/blob/master/l...