11 ms·
Lastpass setting the delete account div to display: none
- iLoveOncall 4y agoI deleted my account just fine this morning.
- hintoftime 4y agoI'm attempting to call support and get them to give me this year's Premium subscription fee back. On the support page for deleting the account, there's a link to Contact Support. [1] edit: A rep called right away. They will not give me my money back. It's in their terms and conditions that they won't even if there is a security breach and it's been longer than 30 days since I paid. [1]: https://support.lastpass.com/help/iknow-my-masterpassword-how-doi-delete-my-lastpass-account https://support.lastpass.com/help/iknow-my-masterpassword-ho...
- erikrit 4y agoI thought this was a joke, but it's actually true; just verified on my account...
- Johnny555 4y agoThe title would make more sense with quotes around the CSS keywords: I'm sure LastPass setting the delete account to "display: none" was coincidental
- princevegeta89 4y agoTook me a while to understand. OP, you're encouraged to kindly make the CSS terminology stand out a little more obviously in the title.
- _the_inflator 4y agoI got it right the first time. Too much time spend with CSS. Nevertheless you are right. Clarity is needed here.
- codetrotter 4y ago> I got it right the first time. Same > Too much time spend with CSS. I don’t even use CSS that much anymore. > Clarity is needed here. I call for a vote :p the title is perfectly legible as-is to me
- labster 4y agoQuotes aren’t valid around CSS properties. How about brackets? I'm sure LastPass setting the delete account to {display: none} was coincidental
- bigmattystyles 4y agoI work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just waiting for a call from infosec asking me to log on and to rotate a bunch of creds. Happy Holidays.
- jiggawatts 4y agoOur new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent another letter to the CISO highlighting the concern. So far, I've had zero responses to any of my emails. Just radio silence. The cold shoulder treatment. Dogs barking in the distance. Etc... I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision. Has anyone else had any experience with LastPass offering outright bribes to senior staff to get sales? If I can point to a precedent, that would be helpful.
- jacksnipe 4y agoHe doesn’t need to be getting a kickback. He probably just wants to spin as hard as he can that his poor choice cost did not cost the company a bunch of money.
- jiggawatts 4y agoSenior LastPass manager: "Decrease customer churn!" Junior LastPass manager: "Okay!"
- danuker 4y agoChristmas retention miracle
- garganzol 4y agoIs LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a funny joke for anyone who understands even a little about cryptography.
- dividedbyzero 4y agoI see why it's a bad idea, but what does that have to do with cryptography?
- mikechalmers 4y agoI don't understand enough to know why it's a bad idea but Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behaviour, so this part seems clear to me.
- dividedbyzero 4y agoIt's a bad idea because URLs, email addresses and user names help with phishing, identity theft, social engineering, matching with other leaks, may lend themselves to blackmail (certain dating apps) or otherwise endanger people (gay dating apps in certain places), for very questionable benefit. No definite idea if they really do that, but if they did, that would strike me as irresponsible. Also, I think the failure here is to not use cryptographical methods in the first place which would seem to be a screw-up in a different security specialty.
- jacquesm 4y agoAt a minimum a bunch of non-encrypted data might give you some cribs to try. HN12345[*] is easier to find if you know that the website used is called Hacker News. [*] Not my actual password.
- driscoll42 4y agoThis is very frustrating... I operated with LastPass on the assumption that the other data was encrypted in there. So backup authentication codes stored. Alas, time to invalidate a bunch of crap.
- pram 4y agoI spent last night resetting dozens of passwords and migrating everything into Keychain. Some observations: Keychain integration with 2fa codes is really nice. Passkeys are awesome and I wish more sites implemented this. So far I only saw Google and eBay?
- judge2020 4y ago> Passkeys are awesome and I wish more sites implemented this. 99% of the time, websites that allow you to use a "Security Key" or "Fingerprint" are using WebAuthn, which is all that's needed for PassKeys to work, (besides a few sites that use a stricter webauthn config).
- navanchauhan 4y agoBest part is that it is really easy to export the passwords too! I exported the passwords and imported them onto my self hosted instance of Vaultwarden. After activating the Bitwarden extension for Safari, all of my passwords are now synced to two places.
- darkstar999 4y agoApparently they have never heard about the Streisand Effect.
- wyxuan 4y agoJust deleted my account - everything was fine. One thing to note, there's nowhere in the UI or account settings tab to delete my account. I had to go directly to the link.
- eganist 4y ago> Just deleted my account - everything was fine. One thing to note, there's nowhere in the UI or account settings tab to delete my account. I had to go directly to the link. That's the point OP is making - the button to do it from within the UI has been hidden with CSS attribute display: none it's there, but the fact that it was hidden with CSS suggests it was done deliberately to stem attrition.
- messutied 4y agoAfter migrating to another password manager, do you also need to rotate all your passwords? Or at least the most sensitive ones? Or is the LastPass hack so far unlikely to compromise the passwords? (since I understand only encrypted data is in hacker's hands)
- yadascript 4y agoRotate the most sensitive ones first. Then incrementally rotate the others.
- NotYourLawyer 4y agoExtremely normal typo, nothing to see here.
- rippercushions 4y agoSo I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?
- CraigJPerry 4y agoBitwarden migration was flawless for me. Impressive given how mangled the csv export i got from lastpass was! I really dig the 2FA auto-copy to clipboard feature in bitwarden.
- messutied 4y agoDoes Bitwarden support a keyword shortcut that brings up the password search? (outside of browser preferably), couldn't find one.
- mdaniel 4y agoIt appears not, since there's a feature request for it: https://community.bitwarden.com/t/global-keyboard-shortcut/33458 https://community.bitwarden.com/t/global-keyboard-shortcut/3... (and their keyboard shortcuts doc doesn't mention any such thing) Yet another fine reason to use 1Password, which puts a lot of time and attention into user experience stuff like this. I know Bitwarden is the Internet's darling, but holy hell the user experience is so aggressively bad
- messutied 4y agoThanks! Any idea of how 1password compares with bidwarden in terms of security?
- mdaniel 4y agoI would give 1Password the advantage if for no other reason than they've been at it longer, and thus have seen more crazy stuff. I believe Bitwarden claims to have multiple security audits, so I do believe they take it seriously, but (and this part is just my opinion) they execute so much other stuff so poorly that alone lowers my trust in them. For clarity, 1Password also has multiple security audits, and have done a very good job of publishing the specifications for their formats, which further contributes to my trust in their execution Bitwarden's previous(?) on-premises deployment script was a raging tire fire, which I openly admit is not exactly a _security_ issue, but it further lowers my lack of faith in them With all that said, I think both Bitwarden and 1Password are miles and miles ahead of LastPass, so one will for sure be better off just picking one and trying it out. It seems to be a reversible decision, if you wanted to switch again
- deleted 4y ago[deleted]
- thot_experiment 4y agoIn light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one of those infosec memes that gets oft repeated but doesn't make a lot of sense to me as being "more secure". To me it seems like your passwords existing outside of your head in any way is a risk, and to have them all in one place (even encrypted) seems way worse than having to go through the reset dance every once in a while because you forgot one. EDIT: I was being a bit snarky and I apologize. As some commenters have rightly pointed out for the average person this is better than the uneducated alternative of using the same PW everywhere, and as method for reducing a random person's risk exposure it is extremely transmissible vs the alternatives. That being said (as a commenter pointed out I should have included this in the post originally) I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. I don't think that these sorts of things are prohibitively complicated, and I think never storing passwords outside of your head has a lot of benefits. That's my personal approach and I think it's a better way to go. P.S. A lot of the fault lies with requiring accounts for things that don't actually require an account. Another problem that comes out of the SaaS model which can be completely avoided by just not making SaaS.
- Saris 4y agoWell, what's the alternative besides a local keepass DB or something?
- thot_experiment 4y agoI use a mental algorithm that generates a unique password for each site. It's easy to remember the algorithm and I get a complex unique password for every site. I don't think a password existing outside of your head makes sense. (though some sites force unique passwords/and password changes, which can be annoying as I have to remember to bump a value mentally for how many times i've been forced to do it, luckily for the most part it's not an issue)
- Waterluvian 4y agoI wonder if they disabled all the integration tests this fails, or if they didn’t have any to begin with.
- cirrus3 4y agoA lot of people here seem to be confused about what a breach of LastPass would actually mean. They should look into how LastPass actually works. Spoiler alert - they don't actually have your passwords, and anyone who hacked them and took all their data would not have your passwords either.
- flandish 4y agoExcept with unencrypted urls, combined with a dataset of previously leaked pws and someone who uses a pw at another leaked place as their master password … means that encrypted lastpass acct is now open. The bottom line is: hacks are bad.
- m-p-3 4y agohttps://www.lastpass.com/delete https://www.lastpass.com/delete
- csunbird 4y agoThis link now redirects to a 404 page for me. I presume that they are reading this thread. Whoever is implementing these changes, shame on you. edit: this one works: https://lastpass.com/delete_account.php https://lastpass.com/delete_account.php Let's see whether they remove it or not.
- agluszak 4y agohttp://old.reddit.com/r/assholedesign http://old.reddit.com/r/assholedesign
- deleted 4y ago[deleted]
- halukakin 4y agoBefore deleting your account it would be good measure to update passwords to passwords you don't really use. You never know if deleted data is deleted from db as well.
- flandish 4y agoFor sure but we also don’t know how much “effective dated” data they store. If a backup from 3 months ago is leaked… what the pw on the acct was the day you deleted it won’t matter.
- burpee 4y agoA while back I had an issue with Lastpass settings not being properly enabled on my account. I discovered that all settings were rendered, and in order to disable them they used 'display: none' rather than not rendering them on the dashboard at all. The fix was for me to disable Display: none and it gave me access to the feature in a limited way. After reaching out to support with screenshots, they fixed the issue and I gained full access, but it is clear to me that Lastpass uses 'display: none' as feature gating and that their software is absolute garbage. This was 100% intentional on Lastpass' side
- matheusmoreira 4y ago> it is clear to me that Lastpass uses 'display: none' as feature gating and that their software is absolute garbage I love it when web sites do stuff like this. Makes it so easy to reverse engineer and circumvent their little controls just like you did.
- SQueeeeeL 4y agoYeah, it's probably some homie in engineering maliciously compiling with the directions of some wannabe MBA who hates their customers and couldn't keep a business running if it was handed to them on a silver platter. Be the programmer homie
- neilv 4y agoIf this is what it looks like, poor integrity is a bad look for a company that asks to be trusted as a critical part of customers' infosec.
- deleted 4y ago[deleted]
- teaearlgraycold 4y agoDoes it happen in other modals?
- irrational 4y agoI am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working right now to move off of LastPass. Unfortunately I have nearly 2,000 passwords on there, so it is taking forever.
- 6ak74rfy 4y agoHow are you trying to move off such that it’s “taking forever”? Did you consider exporting your data from LastPass and importing the file into something like Bitwarden or KeePassXC?
- selfmodruntime 4y agoMetadata fields were unencrypted in last pass, sorry.
- irrational 4y agohttps://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md https://github.com/cfbao/lastpass-vault-parser/blob/master/l... This says notes (encrypted). Do you have a different source?
- daveoc64 4y agoAll notes fields are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md https://github.com/cfbao/lastpass-vault-parser/blob/master/l...
- irrational 4y agoDo you mean secure notes or notes attached to passwords?
- india_usa 4y agoany password manager can be hacked, i had my master password for 20 characters with numbers, characters and special characters. It will take years to brute force and can i assume i have couple of months to change all of my 200 passwords? am i missing something
- foreverCarlos 4y agoEven though this is correct, it doesn’t address all possible consequences. It looks like not all fields were encrypted: at a minimum URLs but also very likely fields like “notes” and more. If you had any sensitive info outside of username/password it’s recommended to start mitigating that. Note: secure notes is not the same as the “notes” field. Secure notes are encrypted. Edit: Also it is unclear whether records like Bank Accounts, Social Security Numbers, etc have been fully encrypted.
- chewyshine 4y agoSo what's the best alternative?
- atq2119 4y agoUse your browser's built-in password storage. You already trust your browser with your passwords, and it's always better to keep your attack surface small. Offline-only is an additional attack surface reducing move. Sure, you may have to copy passwords manually between devices sometimes, but in practice it happens rarely enough not to matter.
- wilg 4y agoI'm not seeing a lot of clarity on what I should do as a LastPass user? Nothing? Move to 1Password? I can't use iCloud keychain because I use Chrome on Mac.
- volongoto 4y agoI'm a happy Bitwarden user. I use the free tier and it works well for me. But people have different needs/requirements, so your mileage may vary
- CharlesW 4y agoFWIW, I did this exact migration a few years ago (to 1Password Family), and am generally very happy with 1Password. https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/
- wilg 4y agoYeah, I've been thinking it probably has a nicer UX and is the best option. It's not exactly clear to me if LastPass actually has bungled the security here or if its just FUD. Is 1Password better from a security perspective in any concrete way?
- atq2119 4y agoDoesn't Chrome have a built-in password storage? Firefox does, which is what I use and recommend.
- wilg 4y agoI just really don't want it to be tied to my browser or platform.
- owlbynight 4y agoI pay close attention to the UX and UI of the tools that I use that are security critical. I switched off of LastPass 2 years ago and convinced my brother to do the same because some things in LastPass apps started to feel very old, especially their 2FA implementation, which signals to me that either their stack is inflexible or there's a lot of churn in their dev teams. When those things are true, that means they're probably just maintaining old code instead of evolving it. Or even more terrifying: they don't know what needs to evolve. Not regretting it so far.
- ziml77 4y agoTheir interface has always felt clunky and outdated. I used to use them many years ago but ended up switching to Bitwarden and then to 1Password. I checked Lastpass out again a year or two ago, when evaluating if I wanted to stick with 1Password, and I was shocked to see that absolutely nothing had changed about their interface. Their password import-export mechanism was still a mess too. I had to manually fix-up many entries in the output CSV.
- ATsch 4y agoI wonder if they checked this with the compliance department regarding their obligations to delete data under GDPR. I hope their Data Protection Officers have the time to respond to all of the thousands of relevant manual email requests and delete all of the data in a timely manner, if people are made aware they are legally required to honor those.
- gavinhoward 4y agoThis reminds me of something I want: a centralized password manager where * The entire file is encrypted, * Using OPAQUE, * On a FOSS local native client * That integrates with a FOSS browser extension that pulls the information only from the local copy. * And the only thing the server does is store the file and user account information. How hard could it be? (Well, outside of getting the cryptography right.) Looking at this incident and the behavior of LastPass, it seems it's impossible. Or it's too inconvenient for users.
- c0balt 4y agoWell, the stopgap solution for this scenario is quite simple: Keepassxc + Keepassxc Browser Extension + Cloud Storage of your choice. OPAQUE is not covered but I'd argue that that would puttoo much of a restraint on the storage layer. Both Keepassxc[0] and the browser extension are FOSS and the cloud storage may be FOSS, like Nextcloud or "just" whatever works for you rn (Google Drive, Seafile, ...). On android Keepassdx[2] (with autofill) can help too. The only major pitfalls of this model is cross-device sync, i.e., you edit the file on device A while saving a change on B etc. Though this isn't really a problem if you (a) are using it alone or (b) make sure you keep backups. In case they do conflict it can merge multiple versions. [1]: https://keepassxc.org/ https://keepassxc.org/ [2]: https://www.keepassdx.com/ https://www.keepassdx.com/
- gavinhoward 4y agoYes. I use KeePassXC in exactly this way.
- butz 4y agoSome time ago Lastpass was hiding restricted passwords using input type="password" fields. They could be easily changed to type="text" using devtools.