6 ms·

It's like a novice programmer blaming the compiler for a bug in their application. It's very unlikely to be true. What would you have the people who are using L

by tinco 4y ago

It's like a novice programmer blaming the compiler for a bug in their application. It's very unlikely to be true. What would you have the people who are using LastPass do, stop using it? Because some crypto dude stored their highly valuable keys in a system that literally copies their keys to any system they log into, to systems that are notorious for having very leaky abstractions and vast vulnerability surfaces?

TomSwirly 4y ago
> It's like a novice programmer blaming the compiler for a bug in their application. The big difference between the two examples is this: LastPass is known to have bugs. Huge amounts of data were stolen from them and we just found out that it was a lot more than we thought. For all we know, they were storing passwords in the clear somewhere. Trivia note: the first compiled language I used was PL/I, and the compiler was notoriously buggy and would crash on well-formed programs. Our teacher told us to put do-nothing statements in when this happened (`PUT SKIP(0);` if I recall correctly), and with some trial and error, those would fix it.
shkkmo 4y ago
> What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.
- tinco 4y ago
  I eh.. was not up to date, I blame our office Christmas party. I guess I'm moving our organization over next year..
  - shkkmo 4y ago
    I meant the major breach before this one, I believe that was the one that gave attackers access to their dev environment, which they used to steal the developer credentials they used to make this attack.
    - tinco 4y ago
      I don't agree that was enough of a reason to drop them. An attacker getting access to your dev environment, even if you're one of the largest security focus endeavours, is pretty much an inevitability. Someone's gonna get access to one of your engineers macbooks, no matter what. The thing that's bad, is that apparently their developers have access to (backups off) production data. That implies that their security infrastructure is not different from regular startups at all so all of their marketing is just bullshit. They didn't sacrifice developer productivity for security on this point, so they can't be trusted to have sacrificed anything for security at any point.
- pqs 4y ago
  But you don't know if they deleted all the backups. You'll never be sure you are safe.
  - shkkmo 4y ago
    It's a solid point, you really need to rotate all the credentials to be safe. I did that for the important accounts and don't share passwords between accounts. I'm sure there are still a few accounts here amd there that might be at risk.l, especially since it was specifically the backups that were compromised.
catchnear4321 4y ago
> It's like a novice programmer blaming the compiler for a bug in their application. No it isn’t. > What would you have the people who are using LastPass do, stop using it? Yes. > Because some crypto dude… No? https://www.cnet.com/tech/services-and-software/lastpass-says-november-breach-exposed-basic-personal-data/ https://www.cnet.com/tech/services-and-software/lastpass-say... https://www.forbes.com/sites/daveywinder/2019/09/16/google-warns-lastpass-users-were-exposed-to-last-password-credential-leak/ https://www.forbes.com/sites/daveywinder/2019/09/16/google-w... https://www.cpomagazine.com/cyber-security/lastpass-2019-password-security-report-shows-continuing-issues-with-reused-and-stolen-passwords/ https://www.cpomagazine.com/cyber-security/lastpass-2019-pas...

by tinco 4y ago

TomSwirly 4y ago

> It's like a novice programmer blaming the compiler for a bug in their application. The big difference between the two examples is this: LastPass is known to have bugs. Huge amounts of data were stolen from them and we just found out that it was a lot more than we thought. For all we know, they were storing passwords in the clear somewhere. Trivia note: the first compiled language I used was PL/I, and the compiler was notoriously buggy and would crash on well-formed programs. Our teacher told us to put do-nothing statements in when this happened (`PUT SKIP(0);` if I recall correctly), and with some trial and error, those would fix it.

shkkmo 4y ago

> What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.

tinco 4y ago
I eh.. was not up to date, I blame our office Christmas party. I guess I'm moving our organization over next year..
- shkkmo 4y ago
  I meant the major breach before this one, I believe that was the one that gave attackers access to their dev environment, which they used to steal the developer credentials they used to make this attack.
  - tinco 4y ago
    I don't agree that was enough of a reason to drop them. An attacker getting access to your dev environment, even if you're one of the largest security focus endeavours, is pretty much an inevitability. Someone's gonna get access to one of your engineers macbooks, no matter what. The thing that's bad, is that apparently their developers have access to (backups off) production data. That implies that their security infrastructure is not different from regular startups at all so all of their marketing is just bullshit. They didn't sacrifice developer productivity for security on this point, so they can't be trusted to have sacrificed anything for security at any point.
pqs 4y ago
But you don't know if they deleted all the backups. You'll never be sure you are safe.
- shkkmo 4y ago
  It's a solid point, you really need to rotate all the credentials to be safe. I did that for the important accounts and don't share passwords between accounts. I'm sure there are still a few accounts here amd there that might be at risk.l, especially since it was specifically the backups that were compromised.

catchnear4321 4y ago

> It's like a novice programmer blaming the compiler for a bug in their application. No it isn’t. > What would you have the people who are using LastPass do, stop using it? Yes. > Because some crypto dude… No? https://www.cnet.com/tech/services-and-software/lastpass-says-november-breach-exposed-basic-personal-data/ https://www.cnet.com/tech/services-and-software/lastpass-say... https://www.forbes.com/sites/daveywinder/2019/09/16/google-warns-lastpass-users-were-exposed-to-last-password-credential-leak/ https://www.forbes.com/sites/daveywinder/2019/09/16/google-w... https://www.cpomagazine.com/cyber-security/lastpass-2019-password-security-report-shows-continuing-issues-with-reused-and-stolen-passwords/ https://www.cpomagazine.com/cyber-security/lastpass-2019-pas...