6 ms·
So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on H
by heywoodlh 4y ago
So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on HN? Is there any supporting evidence aside from an anecdote, does this Twitter account have a strong reputation of being credible, etc.?
Without context, I just don't understand why this anecdotal thread should be considered credible.
Disclaimer: I use FOSS password managers for everything possible but have to use LastPass for some non-personal stuff and I very much dislike it
- chx 4y agoQuite obviously there isn't anything and the handle indicating a crypto hack it's as non-credible as anything can be but some folks on HN still fall for the crypto hype. This is your regular reminder that all crypto is scam , this is a simple mathematical fact.
- wombatmoose 4y ago[flagged]
- raydiatian 4y ago> why is this tweet on HN Is a meme
- jupp0r 4y agoVerified account, blue checkmark, must be legit!
- darawk 4y agoIt seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if he's right are potentially serious for a lot of HN users who might use LastPass. The consequences if he's wrong are a little extra reputational damage for LastPass, but that seems like a worthwhile tradeoff here. Not everything posted on HN has to be verified true. The decision calculus here seems strongly in favor of signal boosting it, so that people who need to can take defensive action, even if it turns out to be wrong.
- _cenw 4y ago> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence
- darawk 4y agoWhy not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.
- _cenw 4y agoIt's quite unlikely someone would risk burning a viable 0day without either going wide (and then we would've heard from a few more people) or going after a well outlined target that would be guaranteed to be worth more than the 0day itself.
- darawk 4y agoI guess my prior based on the way this guy was talking was that he probably had at least 6-7 figures in crypto stolen, which is worth it for a mid tier 0day. Especially if you think it's unlikely to actually get burnt.
- saikatsg 4y agoIf you prefer an article: https://www.engadget.com/the-lastpass-hack-was-worse-than-the-company-first-reported-000501559.html https://www.engadget.com/the-lastpass-hack-was-worse-than-th...
- ytygg775 4y agoThis. Why would we be critical of LastPass being secretive and/or wrong and then take a tweet at face value? From one of the tweets: > I did not download anything. My machines are clean, and I have physical 2fa on everything. None of the links or contracts I interacted with were malicious. Nobody else had physical access to my PC. Yeah sure. Sounds like my aunt when she messed up her PC and loudly claims "but I didn't do anything!" Surefire sign that she did. Turns out it's true, every time.
- akira2501 4y ago> Why would we be critical of LastPass being secretive and/or wrong and then take a tweet at face value? One entity has something to lose, the other doesn't?
- themitigating 4y agoThat exactly what flat earthers claim. 1. You don't know if this person has nothing to lose 2. Even if they have nothing to lose that doesn't mean they are being honest.
- rvnx 4y agoThey are just being secretive about their business the same way you ask them to be secretive about your passwords.
- themitigating 4y agoYes, so?
- akira2501 4y ago> That exactly what flat earthers claim. I have no idea what this has to do with this discussion, and this just comes off as an ad hominem attack. Flat earthers claim that there's an economic interest in lying to them? And you think that claim is particularly genuine or even similar to this argument? > You don't know if this person has nothing to lose It is possible that they have some competing business and are trying to damage LastPass, but there's absolutely no evidence of that, nor any suggestion other than to double-check your credentials and your expected security if you are a LastPass customer. So, if they do have an interest, they're doing a particularly bad job of acting within it. > Even if they have nothing to lose that doesn't mean they are being honest. And we're not going to reach 100% certainty of any fact through discussion on a message board. It is interesting that some people spend a lot of effort trying to ensure this obscurity gets injected into the conversation, and it suggests that their own motivations should be questioned. All in all, on the balance of apparent probabilities, there's more reason to trust this person than not. You can attempt to assail that logic if you like, but I would appreciate it if you stuck to the facts of the argument instead of kicking up dirt.
- xurukefi 4y agoI would wait until more stories like this pop up before jumping to conclusions.
- MonkeyClub 4y agoThis is one of those “more stories like this” - this isn’t the first LastPass breach by any measure. So feel free to go ahead and jump to conclusions :)
- xurukefi 4y agoI personally don't use LastPass due do their history of failures. My point is that the tweet in question and people around here are insinuating that attackers have gained access to unencrypted passwords in the infrastructure of LastPass. This would a new low for LastPass and I would advice to not jump to conclusins gegarding this aspect unless other stories like this pop up, i.e., passwords getting hacked despite being resilient against brute force attacks.
- tyingq 4y agoIt was useful for me to know that website URLs and other metadata are not encrypted.