14 ms·

I worked at LastPass as an engineer

412 points by luu 4y ago

whatever1 4y ago
I spent all my day yesterday changing all my passwords and 2FA. Switched to Microsoft’s authenticator. Never ever again trust a small company with my passwords.
- okanat 4y ago
  Company size is not directly relevant. Lastpass had multiple and quite bad breaches in the last couple of years. They grew bigger but their tech didn't catch up with the modern standards. The origin of biggest leaked password databases are larger companies like Adobe and Linkedin.
husamia 4y ago
I feel there is needed work on non-encryption based security. i.e. Nillion
bawolff 4y ago
> If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key is derived. So older users likely still have a pretty low number of pbkdf2 rounds which makes them more vulnerable to brute forcing Kind of unclear but i think this implies that lastpass doesn't do some and reencrypt on login. Are they saying its just people who havent unlocked there vault in a decade, or are they saying all old users have this? If the latter this is really poor design. > Lots of vault entries may be encrypted with ECB mode AES-256. Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s
- SyzygistSix 4y ago
  Old(er) users. This is the kick in the ass I needed to switch to something else.
- Philip-J-Fry 4y ago
  I just checked my old account and it was configured to be 5000. I changed it and re-encrypts the data and uploads it, and then forces you to login again, presumably to do server side part. Seems weird that they would have the number of rounds fixed from the time of account creation though. Surely it would be possible to increase the number of rounds over time. Edit: I should add that I have logged into this account within the past year or two. So if they're supposed to increase over time, it ain't worked.
  - bawolff 4y ago
    It's also not really an obscure issue. For example, the owasp password cheatsheet talks about the need to increase the work factor over time - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor... . I would hope that password manager software would at least know the things that end up on "cheatsheets"
  - IgorPartola 4y ago
    Why is this even a setting exposed to users? Shouldn’t this be entirely up to them to manage the correct work factor?
    - crazygringo 4y ago
      100% agreed. Paying for a major brand password manager, you should assume that you are paying for them to always keep the security totally up-to-date with best practices. The idea that you are somehow responsible for finding an obscure setting not just in "Account settings" but in a separate "Advanced settings" that defaults to hidden, and knowing the appropriate number to set it to, boggles the mind.
      - SyzygistSix 4y ago
        [flagged]
      - brookst 4y ago
        “But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’”
- FreakLegion 4y ago
  > Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s You aren't wrong, if true that's certainly a mistake on their part. Practically speaking though as long as the passwords are randomly generated it probably doesn't matter, i.e. if you think about what the IV and chaining are doing in CBC. ECB is just as good for encrypting a random stream of bits; CBC just makes sure the bits are random before passing them into the cipher. Of course the optics are still terrible.
  - cmeacham98 4y ago
    While you're correct: 1. In real life, passwords aren't random. Password manager users are probably less likely than average to make this blunder, but I'd still be willing to bet _the majority_ of lastpass's customers do. 2. Even if you personally have all random passwords, would you really want to use a product made by people who made this level of a noob mistake? I used to pay for LastPass premium, now my account is deleted, my passwords are changed, and my money goes to Bitwarden instead - and every time I hear about Lastpass I don't regret this decision.
    - FreakLegion 4y ago
      I suspect that even non-random passwords here are fine, again practically speaking (edit: and given certain assumptions, to be clear, like no reuse), but haven't sat down and proved it. Obviously this isn't an endorsement of LastPass. Everything about their protocols is disappointing. Even if the encryption issues turn out to be of the well-that-was-a-dumb-choice-but-you-don't-need-to-panic variety, it's because they got lucky, not because they were good.
      - cmeacham98 4y ago
        > and given certain assumptions, to be clear, like no reuse Maybe I wasn't obvious enough, but this is the problematic assumption. When I say "non-random password", that's what I mean: a reused password. Almost everyone I know reuses passwords (sometimes with a slight variation, but 90% of the password the same), and my day job is a software engineer. I'd be willing to be at least half of Lastpass's users have at least 1 reused password.
- Leo_Verto 4y ago
  To add onto this, the reason ECB mode is so horribly bad, is that it produces the same cyphertext for blocks with the same plaintext. This allows an attacker to detect repeating plain text segments, e.g. reused passwords. The Wikipedia article on block cypher modes illustrates this problem rather well [1]. [1]: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_(ECB) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...
  - zinekeller 4y ago
    ECB Penguin! (https://words.filippo.io/the-ecb-penguin/ https://words.filippo.io/the-ecb-penguin/) Also, I've just learned that the quintessential file has been recently replaced. I understand the need for a higher resolution file, but I'm still a bit sad.
    - evandale 4y ago
      Hah, that first tweet is classic https://xkcd.com/1053/ https://xkcd.com/1053/ and I'm one of the 10000 today :) Today is the first time I've seen the penguin!
  - bbbbb5 4y ago
    >This allows an attacker to detect repeating plain text segments, e.g. reused passwords. This is hardly a problem, any login form will also allow an attacker to do this.
  - ilyt 4y ago
    ... actually that might be a "feature" for them, they do have duplicate password report, I had assumed that's just based off decrypted ones on client side but they might be just using ECB for that
    - insanitybit 4y ago
      That report requires you enter your master password, so I doubt it.
- t0mas88 4y ago
  ECB mode somehow still gets used, Zoom also did it. I think this is a result of many developers not knowing much about encryption and then selecting the simplest option from their language's standard library.
  - owenmarshall 4y ago
    Because I always want to identify the solution when we point to the problem: https://doc.libsodium.org/ https://doc.libsodium.org/ http://noiseprotocol.org/ http://noiseprotocol.org/
    - eternityforest 4y ago
      Also TLS and SSH for data in transport.
  - bawolff 4y ago
    Zoom at least has the excuse that its more convinent if you are possibly dropping frames and need random access decryption (still really not acceptable). LastPass does not even have that.
    - robryk 4y ago
      CTR with no authentication is strictly better than EBC with no authentication in that case. Similarly, CTR-then-MAC (with MACs being e.g. per packet) is strictly better than EBC-then-MAC.
      - upofadown 4y ago
        Missing (or duplicating) a block in the CTR (counter) block cipher mode messes up the alignment of the count. Then everything after that comes out as random garbage. CTR is not a very robust block cipher mode...
        tptacek 4y ago
        Missing or duplicating a block anywhere in a ciphertext should completely prevent decryption; that's how authenticated encryption works. The idea that some cipher modes are more or less resilient to corruption is, for the most part, a discredited 1990s idea.
- deleted 4y ago
  [deleted]
- eternityforest 4y ago
  How is AES ECB even possible? You would have to actively choose to do that. It's more effort than something like libsodium. Have they not heard of the first rule of crypto being "You probably aren't qualified to do it, use libsodium or TLS or SSH" yet? Why are they messing with cipher modes themselves?
  - tptacek 4y ago
    Their encryption code predates libsodium, and ECB was (on many platforms still is) the default mode --- also, the only mode that doesn't require confusing extra parameters.
    - eternityforest 4y ago
      It's an utterly useless mode though unless you add your own confusing extra stuff. It was probably a bad plan to make that the default.
  - insanitybit 4y ago
    People forget that: a) LastPass is extremely old b) Browser extensions used to be completely different. You needed to call out to native code to do tons of stuff because the JS apis were extremely limited and slow. So it was either "roll crypto in JS" or "make users install a binary", the latter stopped being possible over something like a decade ago.
- aaron695 4y ago
  [dead]
- kodah 4y ago
  That's correct. That means they didn't have a workflow for batch reencryption on login, must less a workflow for annually increasing rounds.
- bbbbb5 4y ago
  >Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s For this particular use-case? Hardly. Since an attacker can easily use any login form of their choice as an oracle for password reuse, ECB mode can't really introduce significant issues here.
  - nequo 4y ago
    What do you mean by “use any login form?” I don’t understand this phrase. If the attacker has an encrypted vault, what is the login form there for them to use and detect password reuse?
    - bbbbb5 4y ago
      These vaults conveniently come with unencrypted URLs of the login forms associated with each password. An attacker who discovers the plaintext of one password can trivially attempt to reuse that against all of the forms. Incorrect password attempts are essentially free, so ECB revealing reuse does not meaningfully help the attacker.
      - nequo 4y ago
        Oh I see. That makes sense. But for the attacker to try one of my passwords in a login form, they do need to have that password cracked already, which means that they already have my master password. But if they have that, they can decrypt all of my passwords, and the login forms are of no use. Am I misunderstanding something here?
        bbbbb5 4y ago
        >Am I misunderstanding something here? No, not at all. The point is that while ECB is a silly choice, it does not make it easier for the attacker to crack your vault. It does allow the attacker to see if you're reusing passwords, but does not reveal to the attacker what those passwords are. On the other hand, If the attacker were to discover one of your passwords from another source, they'd be able to confirm reuse anyway by simply attempting to use that password on other websites.
- ilyt 4y ago
  Yeah it also struck me as bizzare. When client-side app has master key entered it it could just opportunistically upgrade that
- wernerb 4y ago
  This is such a non-issue. You build in flags in the clients that are server activated "needs-reencrypt". After login (local client) flag is read from server and logic begins. You notify the user their vault needs stronger encryption. They can choose to continue and enter password, skip for now or ignore for 1 month (or something more reasonable). The point is you explain why you do this. Start the message with "We care about your encryption" and go from there to explain that they need you to upgrade because the don't know your master key, they need your help to do it. Adding this kind of behavior should be their core business. Apparently it's not.
- deleted 4y ago
  [deleted]
- batter 4y ago
  You can, I was working on solution to have hashing 2 times - new, and later old algo. Salt can be either reused or you'll have to use 2 salts for each algo.
raverbashing 4y ago
Yeah I don't know how "old" it has to qualify for the iteration upgrade but I've heard of some people still having it as 5k iters even with an active account
- cshimmin 4y ago
  Can confirm :( Edit: because I was (until very recently) a daily active user and had niter=5k. Didn't even know about this setting until the hack.
  - blowski 4y ago
    Off on a tangent here, but I downvoted this comment because it doesn't really add anything. On what basis can you confirm it? Do you work there? Do you have deep expertise in the domain?
    - optionalsquid 4y ago
      A straightforward reading of their comment is that they can confirm because they have an active account with 5000 iterations. That would certainly explain the frown. It's not like you need to work at LastPass or have deep expertise in the domain to look at your own account.
    - cshimmin 4y ago
      "I've heard of some people still having it as 5k iters even with an active account" I can confirm because I am one such person. Honestly thought that would come across from context but I'll edit to clarify.
crisp 4y ago
https://threadreaderapp.com/thread/1606428769731878913.html https://threadreaderapp.com/thread/1606428769731878913.html
aborsy 4y ago
You shouldn’t use a weak password in your password manager, and rely on KDF. Even if the server is not hacked, the company could snapshot vaults and crack them offline. KDF is not a substitute for a good password.
- drexlspivey 4y ago
  Why would the company want to crack your vault..? If they want your logins they can just push an update on the client app that skips encryption altogether.
  - aborsy 4y ago
    Because a company is not a single entity, rather hundreds or thousands of peoples. Some of them may wish to get your passwords, for instance, a disgruntled employee who might want to publish large number of passwords online (or provide access to attackers). Yes, they might also use other techniques as well, for example, push a bad update if they have such privileged access. However, that’s relevant more in targeted attacks; you can’t really push a bad update to everyone before getting caught quickly. Also, often several people have to sign the code (in the case of non-JavaScript code), and there is log trail.
- filleokus 4y ago
  While I agree with you that users should have a strong master password, the vendor is in a really privileged position and could do much more than just attempting to crack vaults offline. Why bother with cracking the vault when you can just modify the javascript sent to report back the master password? Especially if you only do targeted attacks, and/or heavily obfuscate the phoning home, the chances of getting away with it is probably pretty high.
pydry 4y ago
I really thought this was the worst lastpass breach: https://hackaday.com/2016/08/01/lastpass-happily-forfeits-passwords-to-simple-javascript/ https://hackaday.com/2016/08/01/lastpass-happily-forfeits-pa... The worst part was the reward. $1000 is a sick joke.
- Sebb767 4y ago
  Technically this was a bug, not a breach.
- GrabbinD33ze69 4y ago
  I understand the connivence, but I still don't get why one would want to expose their pw manager to something like an internet browser.
  - Nextgrid 4y ago
    That's why I hang onto 1Password - at least on macOS and Safari, the browser extension just calls the native client - the actual UI (where you enter your master password and then select which credential to auto-fill) is managed by a separate process. The worst a compromised browser can do is prompt the UI to display and provide a suggested domain to pre-select. Unfortunately I believe that’s Safari-only and even then they seem to be aiming to move away from it - all non-Safari extensions are a “fat” client called 1Password X where the entire logic (and thus the sensitive data) is within the browser.
    - GrabbinD33ze69 4y ago
      Interesting. Something that is off putting regarding lastpass is the complete lack of a native client, it strikes me as pure laziness & complacency. Maybe lastpass does in fact run natively, outside of the broswer, but requiring a web browser is ridiculous. I'm aware there's a native app for windows, but it's horrific.
DisjointedHunt 4y ago
The hackers got access to their dev environment and source code back in August and used that information to hit them harder this time around: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... We may not be seeing the whole picture yet, but very concerning that the dev environment had access to Production database backups stored in a manner that was easily decrypt-able :/ The whole point of a Dev environment in a security focused company is that you reduce the surface area for access and failure.
- raffraffraff 4y ago
  Wooo. > dev environment had access to Production database backups stored in a manner that was easily decrypt-able Say what you like about old dinosaur companies like banks, but when I worked in the IT department for a bank back in the early 2000s developers absolutely couldn't touch production systems, data or backups. Ever. They always has to go through ops even during major incidents. Of course banks aren't immune to fuckups, but at least on paper they tend to have sound security policies. Startups are great at moving fast because there are no guardrails. Like lemmings, corps, banks and government entities externalize their risk to the third party because they recognize the name and logo. "Should we go with SecureCompany(tm)?". "Yeah, everybody uses them". It's great for startups. Without red tape and heavy policy your lean team can create products that the hamstrung bigcorp could only dream of (just don't look under the UI!). They slowly build their customer base, and when they're ready to IPO, they run through some security and process certification theatre, and the investors and a handful of executives can make billions. Overall, both sides seem to be happy with the situation. Bigcorp gets to cut tech staff and outsource, and they have a convenient finger to point when the regulator asks questions. The SaaS apologises and maybe loses a customer or two, but based on stock prices after major issues like this in the past, nothing bad really happens.
- cj 4y ago
  Re: dev environment containing database backups, here’s the full text on that point from the blog: > some source code and technical information were stolen from our development environment and used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service. It sounds like they didn’t literally have backups in the dev environment (which would be absolutely terrible if they did). I’m guessing they learned enough about the architecture from the dev environment to social engineer their way into getting someone to give them credentials to production.
Inhibit 4y ago
How many programmers work on last pass? From a solo coder with no specific interest in cryptography I wouldn't find this kind of flaw odd. From a large development team whose sole product centers around encryption? It seems strange to get it this wrong. What leads to that might make a good business case study.
- malepoon2 4y ago
  It's not a large development team. I moved away from them years ago because support for FIDO keys for example was always "coming soon" and still isn't there. They've been coasting for years and this breach doesn't surprise me at all.
  - weird-eye-issue 4y ago
    I've used a Yubikey with LastPass for several years
    - malepoon2 4y ago
      Yes but they don't support the WebAuthn/FIDO2 standard. The Yubikey option they have is less secure because I think it's OTP under the hood, so it doesn't protect against phishing.
  - Fire-Dragon-DoL 4y ago
    As a paying user, I totally agree. They have been coasting for years. There are some serious bugs they never addressed. I wish I could export my "password history" in some way
- tasuki 4y ago
  Interesting, my intuition is exactly the opposite of yours: I'd expect a solo coder to get it right more than a large organisation full of people with different incentives and priorities.
  - semicolon_storm 4y ago
byhemechi 4y ago
Not encrypting the URLs is just such a baffling choice, i honestly don't understand how that ever happened. Also, as far as i can tell with some very basic maths based on running hashcat on my 3070, if you have a big long password on your vault, even with very few rounds of pbkdf, your actual passwords should be safe. I think 1Password's use of an extra "secret key" would be a huge save in a situation like this, where every encryption key is automatically very long
- roflyear 4y ago
  Also you can migrate them to a longer round setting the next time they use that key - or require some users to relog in or something. This seems like business and product getting in the way of good decisions. Again.
- bpicolo 4y ago
  1Password has had a phenomenal security story. This is Lastpass breach what, like #4?
  - gioo 4y ago
    Look at lastpass' wikipedia page, they have been collecting a security incident after another since 2015.
    - ilyt 4y ago
      to be fair they are by far biggest, and for all we know other might had incidents that they just covered up
      - coder543 4y ago
        Citation needed on "biggest". 1Password appears to have comparable revenue to LastPass, but it is hard to pin down clear sources. Since you seem to have sources, it would be nice to see them. Number of users is even harder to pin down since you never know what a company counts as a "user". Someone who forgot to delete their account from years ago could easily be counted if the company is looking to inflate user counts. Even if they were 100x the size of the next competitor, they would not get a free pass for the obvious technical failures of their implementation, which have nothing to do with the number of users. The entire vault should be encrypted, end to end. The number of PBKDF2 "rounds" should automatically have increased, even for old users. These are huge oversights that fundamentally undermine their credibility. As far as coverups at other companies go, that would be some coverup to avoid any whistleblowers leaking things. Unless it was very recent, this is very unlikely. People take cybersecurity seriously, and counting on every employee to participate in a coverup of a serious breach is unlikely to go well.
anshumankmr 4y ago
People are joking about obvious bad choices like Excel, but I am really not sure what is really safe anymore. For example, I am using Dashlane, should I change it? If so, how?
- Saris 4y ago
  The safest choice is KeePass since it's designed well for security, and stores your database locally.
  - anshumankmr 4y ago
    I have two OSes on my laptops and both iOS and Android, so I can probably manage except maybe on my office laptop. My parents are a part of my family plan and I don't see them being able to use it.
    - otachack 4y ago
      Separate your work and personal data, including passwords. That way if you ever leave the job it's and simple as leaving the password manager entity and not having to clean out your personal bank of passwords.
    - luma 4y ago
      Keepass is FOSS and there are compatible clients for basically every OS you might think of, including IOS, Android, OSX, Windows, and Linux. It does not include multi-device sync, but it works nicely with other solutions that provide that function. So drop in your preferred file sync solution (ideally, cloud-free) and you're all set.
  - deleted 4y ago
    [deleted]
- jb3689 4y ago
  A notebook under my bed seems to have fewer attack vectors than anything on a networked device
shmittywerben 4y ago
Is 1password more secure?
- jeffrallen 4y ago
  I left LastPass when it was bought and migrated to 1Password. I have not had a breach notification since. Just sayin'.
  - entelechy0 4y ago
    [dead]
- malepoon2 4y ago
  1Password does encrypt URLs. It also requires an extra Secret Key [0] in addition to your password. This makes it much, much harder to use the data even if encrypted vaults were stolen. They also have a development team that's very active. Lastpass had been coasting for years. [0] https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
  - ilyt 4y ago
    They've been coasting pretty much since buyout
    - mdaniel 4y ago
      Look, I hate the "new" 1Password as much or more than most, but to say they're coasting is disingenuous; just last week they published their "op" plugin system allowing running "gh" and "glab" and a bunch of other common commands as subprocess of their "op" binary to inject the api tokens. I think the SSH Agent behavior is also post-money They've also listen to our bitching about requiring the master password every 2 weeks even with biometrics turned on, and rolled that back to a configurable setting
      - the_lucifer 4y ago
jeffrallen 4y ago
Let's pour one out for the devs who still work there and are working over Christmas to deal with this. May they say "F this, I quit" and we hire them.
jfoster 4y ago
I understand that the security of customer data is the focus, but is it yet known how access was gained? I ask because I presume LastPass put a heavy emphasis on security, yet this still happened. Is there a 0-day still out there in the hands of very malicious actors and not yet patched?
- catalypso 4y ago
  It seems that it was a social engineering attack. From their notice: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... > some source code and technical information were stolen from our development environment and used to target another employee
  - jfoster 4y ago
    That's still very vague, though. How was the initial (src + docs) breach performed? How do they escalate that into a successful social engineering attack, particularly since the breach was known of? Did the targeted employee have unfettered access to all this customer data? Will be interesting to know the fuller story. I'm guessing that's only a matter of time.
Semaphor 4y ago
7000… Just exported my vault, and will see if there's anything relevant in there (I haven't used LP in 7 years, but I probably have some unimportant-ish passwords in there from back then) Until now, I had forgotten that they still had my data :/
ReptileMan 4y ago
KeepassXC with a keyfile and syncthing ...
gonehome 4y ago
Hasn’t tptacek said to avoid lastpass on here (in favor of 1Password) for the last ten years? I don’t know if he ever got into the details of why (maybe he couldn’t for contract reasons or something), but his judgement on it looks accurate. I’d be curious what his thoughts are, or if the risks he was talking about back then we’re unrelated.
- tptacek 4y ago
  It's literally a bot autoresponse on our Slack, and I didn't put it there. Don't give me too much credit; it was a widely-held opinion.
  - nequo 4y ago
    Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?
    - mdaniel 4y ago
      I'll copy my reply to a similar "but how do outsiders know they're not cheating us?" comment: They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pdf https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...
      - tptacek 4y ago
        It would be weird for a security assessment not to include source code access.
    - dfdz 4y ago
      One key feature of 1Password is the use of a secret key in addition to a master password. See page 10 [1] which explains how the secret key provides extra entropy (which makes it much harder to brute force a user who choses a weak password). Also see Story 1 on page 11 [1]. [1] https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...
api 4y ago
Why do people use AES-ECB? I keep seeing this when even the Wikipedia entries explain very well what’s wrong with it. It’s not like AES-CTR or even a decent block chained mode like CBC is hard to use. Cryptographic libraries shouldn’t even expose it except in a subpackage or namespace called “hazmat.”
- tptacek 4y ago
  It is (or was) the default mode, and, unlike CTR, you don't need anything more than a key to use it; no nonces, no IVs, no parameters. Put yourself in the shoes of someone who doesn't know much about cryptography, and it's a natural choice.
  - api 4y ago
    Hmm... so poor defaults strike again. Makes sense if you know nothing that simple AES-ECB seems to work and has the simplest API of any of the modes. But then I'd have to say... why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography? :)
    - Strom 4y ago
      > why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography? Because that isn't important for success. Perception is reality. Very few people can tell the difference between good and bad crypto work. So instead of wasting money on that, invest it into something that is understood by more of your customers. It's a sad reality.
leftcenterright 4y ago
Perhaps using a pepper should be a key principle for such use cases? - https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords https://dropbox.tech/security/how-dropbox-securely-stores-yo... - https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography) Their payouts for reported bugs under bug bounty program have been very low, for a service used at the scale of Lastpass I believe this is just not ideal. > Points – $5,000 per vulnerability - https://bugcrowd.com/lastpass https://bugcrowd.com/lastpass
- KMnO4 4y ago
  $5000? I think it should be in at least the same order of magnitude what the black market would pay for a leak. Most people wouldn’t sell data for $40,000 if the bug bounty was $35,000. But that lastpass leak is worth many tens of thousands more than the $5000 (average payout of $450) offered.
i7c 4y ago
Since it was backups that got leaked, does it affect ex-users?
- gigglesupstairs 4y ago
  I am curious about this too. I deleted my account last year.
- antiframe 4y ago
  I deleted my account over 12 months ago. I never assume that my data was deleted and changed my important (not all) passwords when I did so. I'm now going to go through every password in my current password manager that's older than the LastPass deletion date and scrutinize them again.
  - ttul 4y ago
    Yes, it would be good for LastPass to let us know the answer to this very simple question. Not to mention, why haven’t they already notified everyone whose data was taken in the breach?
argella 4y ago
I had a last pass account three years ago but shut it down. I used the remove account options on their website if I recall. I wonder if they kept my vault sitting around on their servers or if it was truly removed.
- waboremo 4y ago
  Judging by how sloppily they handled everything else, maybe it's best to submit a GDPR delete account email.
EVa5I7bHFq9mnYK 4y ago
I had a lastpass account years ago, but cleaned my database and changed passwords to all my accounts after the first breach. Is there a chance Lastpass keeps old copies of my database archived somewhere?
avsteele 4y ago
Can someone knowledgeable explain how the number of iterations affects account security for this breach? OK higher is better sure, but is moving from 5K iterations to 100K per the recommendation a similar precaution to adding 1,2,3 digits to the master password?
- pornel 4y ago
  Number of iterations is directly proportional to the time and cost of cracking the master password. For the old vaults it's 20 times faster/cheaper to crack the master password by brute force. The best precaution is to never use LastPass. If you used LastPass, the safe course of action is to change all your passwords that were in LastPass, and use a better password manager this time.
  - avsteele 4y ago
    If linearly proportional then it is approximately equal to one extra character. OK, thanks. I'm not sure to whom the rest of your response is addressed, this was a technical question.
  - GrabbinD33ze69 4y ago
    Define "old" in this context. Is old considered 7 years ago, around when this guy was an employee at logmein?
- bawolff 4y ago
  PBKDF isn't really considered best practise at all, really. Current best practice is to use a memory hard function like argon2, which makes GPUs ineffective at bruteforcing. Adding a digit to a password can depend. Adding a 1 to the end of a password is such a well known thing that its basically useless because that's the first thing people try as its so common. Ultimately though, you are basically correct in a bruteforce scenario. However most password attacks involve a bit of knowledge about what the person likely choose, so the effect depends on what that knowledge is. Keep in mind if you have a strong password (say 16 character randomly generated, never reused elsewhere) its not going to matter how many iterations as it will never be bruteforced even if the worst possible hash was used. This sort of thing protects people who use weak or maybe mid-tier passwords.
Swiffy0 4y ago
Makes me think if survivorship bias (or similar) applies here. While it's not fun to see LP having a lot of incidents in its history, maybe those could be viewed as something that has made LP stronger over the years? I'd be more worried about a password manager that has never seen any security incidents - is it because there really aren't any, or that they haven't been caugh? Surely a security incident on a password manager serves as a major motivation to harden shit up?
- dgacmu 4y ago
  They didn't fix known weaknesses (unencrypted urls, no auto upgrade of the key cipher) after those previous incidents. At some point one has to come to the opposite conclusion...
- pornel 4y ago
  No, it always had worse track record than all competitors. It's owned by a Private Equity firm, which means cutting all costs and selling hard until there's no money left to squeeze out of the corpse.
krimpenrik 4y ago
I hope LastPass wil burn. What a shitty software, besides these Security notifications, which Geels like is the 3th or 4th this year. Their software sucks to use. We work in Salesforce so lots of logins with login.sf.com. i have to always. 1 search credentials in plugin 2. Search credentials again to copy OTP. Most my colleagues miss setting the seed of OTP correctly cause it feels like you are done when entering but you still have to save it at the bottom. Lots of times it asks to overwrite (update) client X credentials with client Y In our admin cobsole, half of the usernames are not visible, just white space, so when i Need changes i need to click around and find that setting page, which is poor UI but then gamle on every whitespace to give the right permissions to user X. Moving to BW is high on my list for 6 months plus. But too busy, will make time to my now. Bye. Don't comment a lot but truly LP is one of the only pieces of software I really hate.
- vxNsr 4y ago
  Ya their OTP story kinda sucks
- deleted 4y ago
  [deleted]
EMM_386 4y ago
I somehow sadly signed up for LastPass only about a month ago, after (briefly) reviewing options. I have a rather long pass phrase. That should theoretically mean that even with my vault, brute-forcing this is out of the question and everything is still business as usual? If that's the case I'll sleep easier at night than the thought of trying to move everything yet again to another password manager and handle (what are strong) password resets at places like Google .... shudder.
- spmurrayzzz 4y ago
  If you signed up only a month ago, that means your pbkdf2 iterations were set to a non-trivial value (presumably the default 100100, but you can verify this in advanced settings). This insulates you very well against brute forcing.
- talkin 4y ago
  Urls and some other fields are stored plaintext. So yes, you’re safe from bruteforcing passwords. But still lost privacy / doxxing / spear fishing info.
  - deleted 4y ago
    [deleted]
eddsh1994 4y ago
I’m pretty sure any info this person has from 7+ years ago can be anecdotal at best; who knows what’s changed, what he’s forgotten, what he’s misunderstood, etc…
AdmiralAsshat 4y ago
I'm pretty pissed that when LP upped the iteration count for new accounts, they didn't tell legacy users that they should consider changing it themselves. I had an old account which was almost certainly 500 or 5000, and I'm fairly certain that I changed it myself at some point to a larger, different value. But at the time I figured a value like 100,000 would slow the process to the point of being unusable.
GrabbinD33ze69 4y ago
The red flags were fairly evident 2 years ago, even to someone like me who's not very observant; if I recall correctly, their android app was found to have tracking mechanism purely used for marketing purposes etc. Really? Trackers in a password manager, something that should be quite private. Combined with a few data breaches they had over around 2 years ago, I couldn't recommend them to anyone in good conscience.
- aix1 4y ago
  > their android app was found to have tracking mechanism purely used for marketing purposes I'd be curious to read up on this. Would you happen to have a link to some coverage of this?
  - GrabbinD33ze69 4y ago
    It's been a minute but here's the first thing that pops up, I'm pretty sure this is what I'm thinking of. https://www.pcmag.com/news/lastpass-android-app-contains-7-trackers https://www.pcmag.com/news/lastpass-android-app-contains-7-t... Again, imo trackers in a pw manager is unacceptable.
  - jmholla 4y ago
    Here's an article I found on it [0] and a direct link to the report [1] which shows 7 trackers. The latest report [2] shows that is down to 5. For comparison, BitWarden's report shows 2 [3] and 1Password's shows none [4]. [0]: https://www.tomsguide.com/news/lastpass-android-app-tracking https://www.tomsguide.com/news/lastpass-android-app-tracking [1]: https://reports.exodus-privacy.eu.org/en/reports/165465/ https://reports.exodus-privacy.eu.org/en/reports/165465/ [2]: https://reports.exodus-privacy.eu.org/en/reports/com.lastpass.lpandroid/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.lastpas... [3] https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.b... [4] https://reports.exodus-privacy.eu.org/en/reports/com.agilebits.onepassword/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.agilebi...
nirvgorilla 4y ago
That's why you never use last pass and instead use something local on YOUR drives like Keepass.info. This is what you get for using services and not doing things yourself. Local, local, local.
froggertoaster 4y ago
This comment is a plug for Bitwarden.
tomhallett 4y ago
An increasing number of data saas companies store your database/warehouse credentials so they can connect directly, Ie: Postgres/snowflake host, port, user, password, etc. That information is long lived (unlike tokens which expire) and you need to use the real value (unlike the hash of a password). Are there resources/books which cover the (many) best practices to keep that information safe? Things like: separate database/microservice, separate vpc?, encrypt the database, filter those fields from logs, etc etc etc. Is a service like aws lambda actually more secure then using a paas (heroku/fly/render) vs ECS (where there might be slower turn around times to actually bump/patch CVEs than the aws lambda team would take?).
- wernerb 4y ago
  I'm not sure what you are asking. For any reasonable service/Saad this is by far not te norm for end user credentials. They are always hashed, hopefully salted and with a strong algorithm. Administrator credentials are harder yes. Something like hashicorp vault can be made to fit any company (custom backend plugins). For most stuff it already has backend plugins available (ssh, any rdbms). The open source version I have seen can fit a large fintech startup no problem.
  - tomhallett 4y ago
    Sorry, I'm not referring to "end user credentials" which can be salted and hashed. I'm referring to user data which has to be stored in the database. For example, let's talk about the BI tool, mode.com. As a customer, I login to mode.com and click the "New Database Connection" button, where I get a screen to input the connection information for my postgres database: host, username, password, port, etc. If you are a developer at mode.com, what are the best practices to keeping `user_database_connections.password` secure? I can't hash the `password` column because I need to use the raw `password` when my code connects to the user's postgres database. I'm assuming I should encrypt the information, so an attacker who does a databse dump can't read the `user_database_connections` table, but what else should I do? Keep that information in a seperate database? seperate microservice? etc, etc. Other examples of tools which connect directly to the database(s) of the customer, so they store db creds of their customers in the saas database: - hightouch.com - fivetran.com - explo.com
bogomipz 4y ago
The poster states: >"If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key is derived. So older users likely still have a pretty low number of pbkdf2 rounds which makes them more vulnerable to brute forcing" Can someone say about how long would it take for an attacker to brute force a pbkdf2 master key with 5000 or 10000 rounds? Looking at their blog post from a few days ago they state: >"The threat actor may attempt to use brute force to guess your master password and decrypt the copies of vault data they took. Because of the hashing and encryption methods we use to protect our customers, it would be extremely difficult to attempt to brute force guess master passwords for those customers who follow our password best practices. We routinely test the latest password cracking technologies against our algorithms to keep pace with and improve upon our cryptographic controls."[1] Can someone say did they notify customers who had legacy accounts that used 5000 or 10000 iteration pbkdf2 master keys? They sure don't seem to mention anything remotely like that in their incident report.[1] In the above paragraph "best practices" is a link to the URL that fails to mention anything about selecting or periodically increasing the number of pbkdf2 iterations.[2]. If this weren't bad enough you are interrupted from reading their important incident report by a pop up asking you to sign up for their mailing list. Is an incident report really an appropriate place to use for marketing purposes? Are they really this shit of a company? [1] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... [2] https://support.lastpass.com/help/what-is-the-lastpass-master-password-lp070014 https://support.lastpass.com/help/what-is-the-lastpass-maste...
barbazoo 4y ago
Aaaaaand the fraudulent charges on my cc started. Coincidence, maybe but unlikely. I sincerely hope LastPass burns to the ground and never recovers.
- barbazoo 4y ago
  Turns out this was actually a coincidence and didn't have anything to do with the LP breach.
briHass 4y ago
I know the for-profit password management companies want you to think you have to store everything in one vault (with names like LastPass, 1Password, etc.), but why does it seem like everyone falls for it? Personally, I store plenty of passwords in the browser, but they're all the passwords I care very little about. Things like e-commerce (where the CC isn't stored), forums, etc., where the password falling into the wrong hands would be annoying, but hardly life changing. For the accounts I really care about, they go in KeePass (backed up to cloud), but with a strong master password and keyfile protected by admin-only access in Windows. Yes, it's way more of a pain to 'sudo' KeePass and copy-paste passwords than use auto-fill, but I'm only logging into my bank accounts and stuff occasionally. If I managed large crypto wallets, those secrets would probably see their KeePass DB get another layer of security: air gap or similar. No way would I comingle those with my Grubhub password that I couldn't care less about.

412 points by luu 4y ago

I spent all my day yesterday changing all my passwords and 2FA. Switched to Microsoft’s authenticator. Never ever again trust a small company with my passwords.

okanat 4y ago
Company size is not directly relevant. Lastpass had multiple and quite bad breaches in the last couple of years. They grew bigger but their tech didn't catch up with the modern standards. The origin of biggest leaked password databases are larger companies like Adobe and Linkedin.

husamia 4y ago

I feel there is needed work on non-encryption based security. i.e. Nillion

bawolff 4y ago

> If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key is derived. So older users likely still have a pretty low number of pbkdf2 rounds which makes them more vulnerable to brute forcing Kind of unclear but i think this implies that lastpass doesn't do some and reencrypt on login. Are they saying its just people who havent unlocked there vault in a decade, or are they saying all old users have this? If the latter this is really poor design. > Lots of vault entries may be encrypted with ECB mode AES-256. Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s

SyzygistSix 4y ago
Old(er) users. This is the kick in the ass I needed to switch to something else.
Philip-J-Fry 4y ago
I just checked my old account and it was configured to be 5000. I changed it and re-encrypts the data and uploads it, and then forces you to login again, presumably to do server side part. Seems weird that they would have the number of rounds fixed from the time of account creation though. Surely it would be possible to increase the number of rounds over time. Edit: I should add that I have logged into this account within the past year or two. So if they're supposed to increase over time, it ain't worked.
- bawolff 4y ago
  It's also not really an obscure issue. For example, the owasp password cheatsheet talks about the need to increase the work factor over time - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor... . I would hope that password manager software would at least know the things that end up on "cheatsheets"
- IgorPartola 4y ago
  Why is this even a setting exposed to users? Shouldn’t this be entirely up to them to manage the correct work factor?
  - crazygringo 4y ago
    100% agreed. Paying for a major brand password manager, you should assume that you are paying for them to always keep the security totally up-to-date with best practices. The idea that you are somehow responsible for finding an obscure setting not just in "Account settings" but in a separate "Advanced settings" that defaults to hidden, and knowing the appropriate number to set it to, boggles the mind.
    - SyzygistSix 4y ago
      [flagged]
    - brookst 4y ago
      “But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’”
FreakLegion 4y ago
> Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s You aren't wrong, if true that's certainly a mistake on their part. Practically speaking though as long as the passwords are randomly generated it probably doesn't matter, i.e. if you think about what the IV and chaining are doing in CBC. ECB is just as good for encrypting a random stream of bits; CBC just makes sure the bits are random before passing them into the cipher. Of course the optics are still terrible.
- cmeacham98 4y ago
  While you're correct: 1. In real life, passwords aren't random. Password manager users are probably less likely than average to make this blunder, but I'd still be willing to bet _the majority_ of lastpass's customers do. 2. Even if you personally have all random passwords, would you really want to use a product made by people who made this level of a noob mistake? I used to pay for LastPass premium, now my account is deleted, my passwords are changed, and my money goes to Bitwarden instead - and every time I hear about Lastpass I don't regret this decision.
  - FreakLegion 4y ago
    I suspect that even non-random passwords here are fine, again practically speaking (edit: and given certain assumptions, to be clear, like no reuse), but haven't sat down and proved it. Obviously this isn't an endorsement of LastPass. Everything about their protocols is disappointing. Even if the encryption issues turn out to be of the well-that-was-a-dumb-choice-but-you-don't-need-to-panic variety, it's because they got lucky, not because they were good.
    - cmeacham98 4y ago
      > and given certain assumptions, to be clear, like no reuse Maybe I wasn't obvious enough, but this is the problematic assumption. When I say "non-random password", that's what I mean: a reused password. Almost everyone I know reuses passwords (sometimes with a slight variation, but 90% of the password the same), and my day job is a software engineer. I'd be willing to be at least half of Lastpass's users have at least 1 reused password.
Leo_Verto 4y ago
To add onto this, the reason ECB mode is so horribly bad, is that it produces the same cyphertext for blocks with the same plaintext. This allows an attacker to detect repeating plain text segments, e.g. reused passwords. The Wikipedia article on block cypher modes illustrates this problem rather well [1]. [1]: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_(ECB) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...
- zinekeller 4y ago
  ECB Penguin! (https://words.filippo.io/the-ecb-penguin/ https://words.filippo.io/the-ecb-penguin/) Also, I've just learned that the quintessential file has been recently replaced. I understand the need for a higher resolution file, but I'm still a bit sad.
  - evandale 4y ago
    Hah, that first tweet is classic https://xkcd.com/1053/ https://xkcd.com/1053/ and I'm one of the 10000 today :) Today is the first time I've seen the penguin!
- bbbbb5 4y ago
  >This allows an attacker to detect repeating plain text segments, e.g. reused passwords. This is hardly a problem, any login form will also allow an attacker to do this.
- ilyt 4y ago
  ... actually that might be a "feature" for them, they do have duplicate password report, I had assumed that's just based off decrypted ones on client side but they might be just using ECB for that
  - insanitybit 4y ago
    That report requires you enter your master password, so I doubt it.
t0mas88 4y ago
ECB mode somehow still gets used, Zoom also did it. I think this is a result of many developers not knowing much about encryption and then selecting the simplest option from their language's standard library.
- owenmarshall 4y ago
  Because I always want to identify the solution when we point to the problem: https://doc.libsodium.org/ https://doc.libsodium.org/ http://noiseprotocol.org/ http://noiseprotocol.org/
  - eternityforest 4y ago
    Also TLS and SSH for data in transport.
- bawolff 4y ago
  Zoom at least has the excuse that its more convinent if you are possibly dropping frames and need random access decryption (still really not acceptable). LastPass does not even have that.
  - robryk 4y ago
    CTR with no authentication is strictly better than EBC with no authentication in that case. Similarly, CTR-then-MAC (with MACs being e.g. per packet) is strictly better than EBC-then-MAC.
    - upofadown 4y ago
      Missing (or duplicating) a block in the CTR (counter) block cipher mode messes up the alignment of the count. Then everything after that comes out as random garbage. CTR is not a very robust block cipher mode...
      - tptacek 4y ago
        Missing or duplicating a block anywhere in a ciphertext should completely prevent decryption; that's how authenticated encryption works. The idea that some cipher modes are more or less resilient to corruption is, for the most part, a discredited 1990s idea.
deleted 4y ago
[deleted]
eternityforest 4y ago
How is AES ECB even possible? You would have to actively choose to do that. It's more effort than something like libsodium. Have they not heard of the first rule of crypto being "You probably aren't qualified to do it, use libsodium or TLS or SSH" yet? Why are they messing with cipher modes themselves?
- tptacek 4y ago
  Their encryption code predates libsodium, and ECB was (on many platforms still is) the default mode --- also, the only mode that doesn't require confusing extra parameters.
  - eternityforest 4y ago
    It's an utterly useless mode though unless you add your own confusing extra stuff. It was probably a bad plan to make that the default.
- insanitybit 4y ago
  People forget that: a) LastPass is extremely old b) Browser extensions used to be completely different. You needed to call out to native code to do tons of stuff because the JS apis were extremely limited and slow. So it was either "roll crypto in JS" or "make users install a binary", the latter stopped being possible over something like a decade ago.
aaron695 4y ago
[dead]
kodah 4y ago
That's correct. That means they didn't have a workflow for batch reencryption on login, must less a workflow for annually increasing rounds.
bbbbb5 4y ago
>Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s For this particular use-case? Hardly. Since an attacker can easily use any login form of their choice as an oracle for password reuse, ECB mode can't really introduce significant issues here.
- nequo 4y ago
  What do you mean by “use any login form?” I don’t understand this phrase. If the attacker has an encrypted vault, what is the login form there for them to use and detect password reuse?
  - bbbbb5 4y ago
    These vaults conveniently come with unencrypted URLs of the login forms associated with each password. An attacker who discovers the plaintext of one password can trivially attempt to reuse that against all of the forms. Incorrect password attempts are essentially free, so ECB revealing reuse does not meaningfully help the attacker.
    - nequo 4y ago
      Oh I see. That makes sense. But for the attacker to try one of my passwords in a login form, they do need to have that password cracked already, which means that they already have my master password. But if they have that, they can decrypt all of my passwords, and the login forms are of no use. Am I misunderstanding something here?
      - bbbbb5 4y ago
        >Am I misunderstanding something here? No, not at all. The point is that while ECB is a silly choice, it does not make it easier for the attacker to crack your vault. It does allow the attacker to see if you're reusing passwords, but does not reveal to the attacker what those passwords are. On the other hand, If the attacker were to discover one of your passwords from another source, they'd be able to confirm reuse anyway by simply attempting to use that password on other websites.
ilyt 4y ago
Yeah it also struck me as bizzare. When client-side app has master key entered it it could just opportunistically upgrade that
wernerb 4y ago
This is such a non-issue. You build in flags in the clients that are server activated "needs-reencrypt". After login (local client) flag is read from server and logic begins. You notify the user their vault needs stronger encryption. They can choose to continue and enter password, skip for now or ignore for 1 month (or something more reasonable). The point is you explain why you do this. Start the message with "We care about your encryption" and go from there to explain that they need you to upgrade because the don't know your master key, they need your help to do it. Adding this kind of behavior should be their core business. Apparently it's not.
deleted 4y ago
[deleted]
batter 4y ago
You can, I was working on solution to have hashing 2 times - new, and later old algo. Salt can be either reused or you'll have to use 2 salts for each algo.

raverbashing 4y ago

Yeah I don't know how "old" it has to qualify for the iteration upgrade but I've heard of some people still having it as 5k iters even with an active account

cshimmin 4y ago
Can confirm :( Edit: because I was (until very recently) a daily active user and had niter=5k. Didn't even know about this setting until the hack.
- blowski 4y ago
  Off on a tangent here, but I downvoted this comment because it doesn't really add anything. On what basis can you confirm it? Do you work there? Do you have deep expertise in the domain?
  - optionalsquid 4y ago
    A straightforward reading of their comment is that they can confirm because they have an active account with 5000 iterations. That would certainly explain the frown. It's not like you need to work at LastPass or have deep expertise in the domain to look at your own account.
  - cshimmin 4y ago
    "I've heard of some people still having it as 5k iters even with an active account" I can confirm because I am one such person. Honestly thought that would come across from context but I'll edit to clarify.

crisp 4y ago

https://threadreaderapp.com/thread/1606428769731878913.html https://threadreaderapp.com/thread/1606428769731878913.html

aborsy 4y ago

You shouldn’t use a weak password in your password manager, and rely on KDF. Even if the server is not hacked, the company could snapshot vaults and crack them offline. KDF is not a substitute for a good password.

drexlspivey 4y ago
Why would the company want to crack your vault..? If they want your logins they can just push an update on the client app that skips encryption altogether.
- aborsy 4y ago
  Because a company is not a single entity, rather hundreds or thousands of peoples. Some of them may wish to get your passwords, for instance, a disgruntled employee who might want to publish large number of passwords online (or provide access to attackers). Yes, they might also use other techniques as well, for example, push a bad update if they have such privileged access. However, that’s relevant more in targeted attacks; you can’t really push a bad update to everyone before getting caught quickly. Also, often several people have to sign the code (in the case of non-JavaScript code), and there is log trail.
filleokus 4y ago
While I agree with you that users should have a strong master password, the vendor is in a really privileged position and could do much more than just attempting to crack vaults offline. Why bother with cracking the vault when you can just modify the javascript sent to report back the master password? Especially if you only do targeted attacks, and/or heavily obfuscate the phoning home, the chances of getting away with it is probably pretty high.

pydry 4y ago

I really thought this was the worst lastpass breach: https://hackaday.com/2016/08/01/lastpass-happily-forfeits-passwords-to-simple-javascript/ https://hackaday.com/2016/08/01/lastpass-happily-forfeits-pa... The worst part was the reward. $1000 is a sick joke.

Sebb767 4y ago
Technically this was a bug, not a breach.
GrabbinD33ze69 4y ago
I understand the connivence, but I still don't get why one would want to expose their pw manager to something like an internet browser.
- Nextgrid 4y ago
  That's why I hang onto 1Password - at least on macOS and Safari, the browser extension just calls the native client - the actual UI (where you enter your master password and then select which credential to auto-fill) is managed by a separate process. The worst a compromised browser can do is prompt the UI to display and provide a suggested domain to pre-select. Unfortunately I believe that’s Safari-only and even then they seem to be aiming to move away from it - all non-Safari extensions are a “fat” client called 1Password X where the entire logic (and thus the sensitive data) is within the browser.
  - GrabbinD33ze69 4y ago
    Interesting. Something that is off putting regarding lastpass is the complete lack of a native client, it strikes me as pure laziness & complacency. Maybe lastpass does in fact run natively, outside of the broswer, but requiring a web browser is ridiculous. I'm aware there's a native app for windows, but it's horrific.

DisjointedHunt 4y ago

The hackers got access to their dev environment and source code back in August and used that information to hit them harder this time around: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... We may not be seeing the whole picture yet, but very concerning that the dev environment had access to Production database backups stored in a manner that was easily decrypt-able :/ The whole point of a Dev environment in a security focused company is that you reduce the surface area for access and failure.

raffraffraff 4y ago
Wooo. > dev environment had access to Production database backups stored in a manner that was easily decrypt-able Say what you like about old dinosaur companies like banks, but when I worked in the IT department for a bank back in the early 2000s developers absolutely couldn't touch production systems, data or backups. Ever. They always has to go through ops even during major incidents. Of course banks aren't immune to fuckups, but at least on paper they tend to have sound security policies. Startups are great at moving fast because there are no guardrails. Like lemmings, corps, banks and government entities externalize their risk to the third party because they recognize the name and logo. "Should we go with SecureCompany(tm)?". "Yeah, everybody uses them". It's great for startups. Without red tape and heavy policy your lean team can create products that the hamstrung bigcorp could only dream of (just don't look under the UI!). They slowly build their customer base, and when they're ready to IPO, they run through some security and process certification theatre, and the investors and a handful of executives can make billions. Overall, both sides seem to be happy with the situation. Bigcorp gets to cut tech staff and outsource, and they have a convenient finger to point when the regulator asks questions. The SaaS apologises and maybe loses a customer or two, but based on stock prices after major issues like this in the past, nothing bad really happens.
cj 4y ago
Re: dev environment containing database backups, here’s the full text on that point from the blog: > some source code and technical information were stolen from our development environment and used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service. It sounds like they didn’t literally have backups in the dev environment (which would be absolutely terrible if they did). I’m guessing they learned enough about the architecture from the dev environment to social engineer their way into getting someone to give them credentials to production.

Inhibit 4y ago

How many programmers work on last pass? From a solo coder with no specific interest in cryptography I wouldn't find this kind of flaw odd. From a large development team whose sole product centers around encryption? It seems strange to get it this wrong. What leads to that might make a good business case study.

malepoon2 4y ago
It's not a large development team. I moved away from them years ago because support for FIDO keys for example was always "coming soon" and still isn't there. They've been coasting for years and this breach doesn't surprise me at all.
- weird-eye-issue 4y ago
  I've used a Yubikey with LastPass for several years
  - malepoon2 4y ago
    Yes but they don't support the WebAuthn/FIDO2 standard. The Yubikey option they have is less secure because I think it's OTP under the hood, so it doesn't protect against phishing.
- Fire-Dragon-DoL 4y ago
  As a paying user, I totally agree. They have been coasting for years. There are some serious bugs they never addressed. I wish I could export my "password history" in some way
tasuki 4y ago
Interesting, my intuition is exactly the opposite of yours: I'd expect a solo coder to get it right more than a large organisation full of people with different incentives and priorities.
- semicolon_storm 4y ago

byhemechi 4y ago

Not encrypting the URLs is just such a baffling choice, i honestly don't understand how that ever happened. Also, as far as i can tell with some very basic maths based on running hashcat on my 3070, if you have a big long password on your vault, even with very few rounds of pbkdf, your actual passwords should be safe. I think 1Password's use of an extra "secret key" would be a huge save in a situation like this, where every encryption key is automatically very long

roflyear 4y ago
Also you can migrate them to a longer round setting the next time they use that key - or require some users to relog in or something. This seems like business and product getting in the way of good decisions. Again.
bpicolo 4y ago
1Password has had a phenomenal security story. This is Lastpass breach what, like #4?
- gioo 4y ago
  Look at lastpass' wikipedia page, they have been collecting a security incident after another since 2015.
  - ilyt 4y ago
    to be fair they are by far biggest, and for all we know other might had incidents that they just covered up
    - coder543 4y ago
      Citation needed on "biggest". 1Password appears to have comparable revenue to LastPass, but it is hard to pin down clear sources. Since you seem to have sources, it would be nice to see them. Number of users is even harder to pin down since you never know what a company counts as a "user". Someone who forgot to delete their account from years ago could easily be counted if the company is looking to inflate user counts. Even if they were 100x the size of the next competitor, they would not get a free pass for the obvious technical failures of their implementation, which have nothing to do with the number of users. The entire vault should be encrypted, end to end. The number of PBKDF2 "rounds" should automatically have increased, even for old users. These are huge oversights that fundamentally undermine their credibility. As far as coverups at other companies go, that would be some coverup to avoid any whistleblowers leaking things. Unless it was very recent, this is very unlikely. People take cybersecurity seriously, and counting on every employee to participate in a coverup of a serious breach is unlikely to go well.

anshumankmr 4y ago

People are joking about obvious bad choices like Excel, but I am really not sure what is really safe anymore. For example, I am using Dashlane, should I change it? If so, how?

Saris 4y ago
The safest choice is KeePass since it's designed well for security, and stores your database locally.
- anshumankmr 4y ago
  I have two OSes on my laptops and both iOS and Android, so I can probably manage except maybe on my office laptop. My parents are a part of my family plan and I don't see them being able to use it.
  - otachack 4y ago
    Separate your work and personal data, including passwords. That way if you ever leave the job it's and simple as leaving the password manager entity and not having to clean out your personal bank of passwords.
  - luma 4y ago
    Keepass is FOSS and there are compatible clients for basically every OS you might think of, including IOS, Android, OSX, Windows, and Linux. It does not include multi-device sync, but it works nicely with other solutions that provide that function. So drop in your preferred file sync solution (ideally, cloud-free) and you're all set.
- deleted 4y ago
  [deleted]
jb3689 4y ago
A notebook under my bed seems to have fewer attack vectors than anything on a networked device

shmittywerben 4y ago

Is 1password more secure?

jeffrallen 4y ago
I left LastPass when it was bought and migrated to 1Password. I have not had a breach notification since. Just sayin'.
- entelechy0 4y ago
  [dead]
malepoon2 4y ago
1Password does encrypt URLs. It also requires an extra Secret Key [0] in addition to your password. This makes it much, much harder to use the data even if encrypted vaults were stolen. They also have a development team that's very active. Lastpass had been coasting for years. [0] https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- ilyt 4y ago
  They've been coasting pretty much since buyout
  - mdaniel 4y ago
    Look, I hate the "new" 1Password as much or more than most, but to say they're coasting is disingenuous; just last week they published their "op" plugin system allowing running "gh" and "glab" and a bunch of other common commands as subprocess of their "op" binary to inject the api tokens. I think the SSH Agent behavior is also post-money They've also listen to our bitching about requiring the master password every 2 weeks even with biometrics turned on, and rolled that back to a configurable setting
    - the_lucifer 4y ago

jeffrallen 4y ago

Let's pour one out for the devs who still work there and are working over Christmas to deal with this. May they say "F this, I quit" and we hire them.

jfoster 4y ago

I understand that the security of customer data is the focus, but is it yet known how access was gained? I ask because I presume LastPass put a heavy emphasis on security, yet this still happened. Is there a 0-day still out there in the hands of very malicious actors and not yet patched?

catalypso 4y ago
It seems that it was a social engineering attack. From their notice: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... > some source code and technical information were stolen from our development environment and used to target another employee
- jfoster 4y ago
  That's still very vague, though. How was the initial (src + docs) breach performed? How do they escalate that into a successful social engineering attack, particularly since the breach was known of? Did the targeted employee have unfettered access to all this customer data? Will be interesting to know the fuller story. I'm guessing that's only a matter of time.

Semaphor 4y ago

7000… Just exported my vault, and will see if there's anything relevant in there (I haven't used LP in 7 years, but I probably have some unimportant-ish passwords in there from back then) Until now, I had forgotten that they still had my data :/

ReptileMan 4y ago

KeepassXC with a keyfile and syncthing ...

gonehome 4y ago

Hasn’t tptacek said to avoid lastpass on here (in favor of 1Password) for the last ten years? I don’t know if he ever got into the details of why (maybe he couldn’t for contract reasons or something), but his judgement on it looks accurate. I’d be curious what his thoughts are, or if the risks he was talking about back then we’re unrelated.

tptacek 4y ago
It's literally a bot autoresponse on our Slack, and I didn't put it there. Don't give me too much credit; it was a widely-held opinion.
- nequo 4y ago
  Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?
  - mdaniel 4y ago
    I'll copy my reply to a similar "but how do outsiders know they're not cheating us?" comment: They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pdf https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...
    - tptacek 4y ago
      It would be weird for a security assessment not to include source code access.
  - dfdz 4y ago
    One key feature of 1Password is the use of a secret key in addition to a master password. See page 10 [1] which explains how the secret key provides extra entropy (which makes it much harder to brute force a user who choses a weak password). Also see Story 1 on page 11 [1]. [1] https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...

api 4y ago

Why do people use AES-ECB? I keep seeing this when even the Wikipedia entries explain very well what’s wrong with it. It’s not like AES-CTR or even a decent block chained mode like CBC is hard to use. Cryptographic libraries shouldn’t even expose it except in a subpackage or namespace called “hazmat.”

tptacek 4y ago
It is (or was) the default mode, and, unlike CTR, you don't need anything more than a key to use it; no nonces, no IVs, no parameters. Put yourself in the shoes of someone who doesn't know much about cryptography, and it's a natural choice.
- api 4y ago
  Hmm... so poor defaults strike again. Makes sense if you know nothing that simple AES-ECB seems to work and has the simplest API of any of the modes. But then I'd have to say... why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography? :)
  - Strom 4y ago
    > why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography? Because that isn't important for success. Perception is reality. Very few people can tell the difference between good and bad crypto work. So instead of wasting money on that, invest it into something that is understood by more of your customers. It's a sad reality.

leftcenterright 4y ago

Perhaps using a pepper should be a key principle for such use cases? - https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords https://dropbox.tech/security/how-dropbox-securely-stores-yo... - https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography) Their payouts for reported bugs under bug bounty program have been very low, for a service used at the scale of Lastpass I believe this is just not ideal. > Points – $5,000 per vulnerability - https://bugcrowd.com/lastpass https://bugcrowd.com/lastpass

KMnO4 4y ago
$5000? I think it should be in at least the same order of magnitude what the black market would pay for a leak. Most people wouldn’t sell data for $40,000 if the bug bounty was $35,000. But that lastpass leak is worth many tens of thousands more than the $5000 (average payout of $450) offered.

i7c 4y ago

Since it was backups that got leaked, does it affect ex-users?

gigglesupstairs 4y ago
I am curious about this too. I deleted my account last year.
antiframe 4y ago
I deleted my account over 12 months ago. I never assume that my data was deleted and changed my important (not all) passwords when I did so. I'm now going to go through every password in my current password manager that's older than the LastPass deletion date and scrutinize them again.
- ttul 4y ago
  Yes, it would be good for LastPass to let us know the answer to this very simple question. Not to mention, why haven’t they already notified everyone whose data was taken in the breach?

argella 4y ago

I had a last pass account three years ago but shut it down. I used the remove account options on their website if I recall. I wonder if they kept my vault sitting around on their servers or if it was truly removed.

waboremo 4y ago
Judging by how sloppily they handled everything else, maybe it's best to submit a GDPR delete account email.

EVa5I7bHFq9mnYK 4y ago

I had a lastpass account years ago, but cleaned my database and changed passwords to all my accounts after the first breach. Is there a chance Lastpass keeps old copies of my database archived somewhere?

avsteele 4y ago

Can someone knowledgeable explain how the number of iterations affects account security for this breach? OK higher is better sure, but is moving from 5K iterations to 100K per the recommendation a similar precaution to adding 1,2,3 digits to the master password?

pornel 4y ago
Number of iterations is directly proportional to the time and cost of cracking the master password. For the old vaults it's 20 times faster/cheaper to crack the master password by brute force. The best precaution is to never use LastPass. If you used LastPass, the safe course of action is to change all your passwords that were in LastPass, and use a better password manager this time.
- avsteele 4y ago
  If linearly proportional then it is approximately equal to one extra character. OK, thanks. I'm not sure to whom the rest of your response is addressed, this was a technical question.
- GrabbinD33ze69 4y ago
  Define "old" in this context. Is old considered 7 years ago, around when this guy was an employee at logmein?
bawolff 4y ago
PBKDF isn't really considered best practise at all, really. Current best practice is to use a memory hard function like argon2, which makes GPUs ineffective at bruteforcing. Adding a digit to a password can depend. Adding a 1 to the end of a password is such a well known thing that its basically useless because that's the first thing people try as its so common. Ultimately though, you are basically correct in a bruteforce scenario. However most password attacks involve a bit of knowledge about what the person likely choose, so the effect depends on what that knowledge is. Keep in mind if you have a strong password (say 16 character randomly generated, never reused elsewhere) its not going to matter how many iterations as it will never be bruteforced even if the worst possible hash was used. This sort of thing protects people who use weak or maybe mid-tier passwords.

Swiffy0 4y ago

Makes me think if survivorship bias (or similar) applies here. While it's not fun to see LP having a lot of incidents in its history, maybe those could be viewed as something that has made LP stronger over the years? I'd be more worried about a password manager that has never seen any security incidents - is it because there really aren't any, or that they haven't been caugh? Surely a security incident on a password manager serves as a major motivation to harden shit up?

dgacmu 4y ago
They didn't fix known weaknesses (unencrypted urls, no auto upgrade of the key cipher) after those previous incidents. At some point one has to come to the opposite conclusion...
pornel 4y ago
No, it always had worse track record than all competitors. It's owned by a Private Equity firm, which means cutting all costs and selling hard until there's no money left to squeeze out of the corpse.

krimpenrik 4y ago

I hope LastPass wil burn. What a shitty software, besides these Security notifications, which Geels like is the 3th or 4th this year. Their software sucks to use. We work in Salesforce so lots of logins with login.sf.com. i have to always. 1 search credentials in plugin 2. Search credentials again to copy OTP. Most my colleagues miss setting the seed of OTP correctly cause it feels like you are done when entering but you still have to save it at the bottom. Lots of times it asks to overwrite (update) client X credentials with client Y In our admin cobsole, half of the usernames are not visible, just white space, so when i Need changes i need to click around and find that setting page, which is poor UI but then gamle on every whitespace to give the right permissions to user X. Moving to BW is high on my list for 6 months plus. But too busy, will make time to my now. Bye. Don't comment a lot but truly LP is one of the only pieces of software I really hate.

vxNsr 4y ago
Ya their OTP story kinda sucks
deleted 4y ago
[deleted]

EMM_386 4y ago

I somehow sadly signed up for LastPass only about a month ago, after (briefly) reviewing options. I have a rather long pass phrase. That should theoretically mean that even with my vault, brute-forcing this is out of the question and everything is still business as usual? If that's the case I'll sleep easier at night than the thought of trying to move everything yet again to another password manager and handle (what are strong) password resets at places like Google .... shudder.

spmurrayzzz 4y ago
If you signed up only a month ago, that means your pbkdf2 iterations were set to a non-trivial value (presumably the default 100100, but you can verify this in advanced settings). This insulates you very well against brute forcing.
talkin 4y ago
Urls and some other fields are stored plaintext. So yes, you’re safe from bruteforcing passwords. But still lost privacy / doxxing / spear fishing info.
- deleted 4y ago
  [deleted]

eddsh1994 4y ago

I’m pretty sure any info this person has from 7+ years ago can be anecdotal at best; who knows what’s changed, what he’s forgotten, what he’s misunderstood, etc…

AdmiralAsshat 4y ago

I'm pretty pissed that when LP upped the iteration count for new accounts, they didn't tell legacy users that they should consider changing it themselves. I had an old account which was almost certainly 500 or 5000, and I'm fairly certain that I changed it myself at some point to a larger, different value. But at the time I figured a value like 100,000 would slow the process to the point of being unusable.

GrabbinD33ze69 4y ago

The red flags were fairly evident 2 years ago, even to someone like me who's not very observant; if I recall correctly, their android app was found to have tracking mechanism purely used for marketing purposes etc. Really? Trackers in a password manager, something that should be quite private. Combined with a few data breaches they had over around 2 years ago, I couldn't recommend them to anyone in good conscience.

aix1 4y ago
> their android app was found to have tracking mechanism purely used for marketing purposes I'd be curious to read up on this. Would you happen to have a link to some coverage of this?
- GrabbinD33ze69 4y ago
  It's been a minute but here's the first thing that pops up, I'm pretty sure this is what I'm thinking of. https://www.pcmag.com/news/lastpass-android-app-contains-7-trackers https://www.pcmag.com/news/lastpass-android-app-contains-7-t... Again, imo trackers in a pw manager is unacceptable.
- jmholla 4y ago
  Here's an article I found on it [0] and a direct link to the report [1] which shows 7 trackers. The latest report [2] shows that is down to 5. For comparison, BitWarden's report shows 2 [3] and 1Password's shows none [4]. [0]: https://www.tomsguide.com/news/lastpass-android-app-tracking https://www.tomsguide.com/news/lastpass-android-app-tracking [1]: https://reports.exodus-privacy.eu.org/en/reports/165465/ https://reports.exodus-privacy.eu.org/en/reports/165465/ [2]: https://reports.exodus-privacy.eu.org/en/reports/com.lastpass.lpandroid/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.lastpas... [3] https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.b... [4] https://reports.exodus-privacy.eu.org/en/reports/com.agilebits.onepassword/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.agilebi...

nirvgorilla 4y ago

That's why you never use last pass and instead use something local on YOUR drives like Keepass.info. This is what you get for using services and not doing things yourself. Local, local, local.

froggertoaster 4y ago

This comment is a plug for Bitwarden.

tomhallett 4y ago

An increasing number of data saas companies store your database/warehouse credentials so they can connect directly, Ie: Postgres/snowflake host, port, user, password, etc. That information is long lived (unlike tokens which expire) and you need to use the real value (unlike the hash of a password). Are there resources/books which cover the (many) best practices to keep that information safe? Things like: separate database/microservice, separate vpc?, encrypt the database, filter those fields from logs, etc etc etc. Is a service like aws lambda actually more secure then using a paas (heroku/fly/render) vs ECS (where there might be slower turn around times to actually bump/patch CVEs than the aws lambda team would take?).

wernerb 4y ago
I'm not sure what you are asking. For any reasonable service/Saad this is by far not te norm for end user credentials. They are always hashed, hopefully salted and with a strong algorithm. Administrator credentials are harder yes. Something like hashicorp vault can be made to fit any company (custom backend plugins). For most stuff it already has backend plugins available (ssh, any rdbms). The open source version I have seen can fit a large fintech startup no problem.
- tomhallett 4y ago
  Sorry, I'm not referring to "end user credentials" which can be salted and hashed. I'm referring to user data which has to be stored in the database. For example, let's talk about the BI tool, mode.com. As a customer, I login to mode.com and click the "New Database Connection" button, where I get a screen to input the connection information for my postgres database: host, username, password, port, etc. If you are a developer at mode.com, what are the best practices to keeping `user_database_connections.password` secure? I can't hash the `password` column because I need to use the raw `password` when my code connects to the user's postgres database. I'm assuming I should encrypt the information, so an attacker who does a databse dump can't read the `user_database_connections` table, but what else should I do? Keep that information in a seperate database? seperate microservice? etc, etc. Other examples of tools which connect directly to the database(s) of the customer, so they store db creds of their customers in the saas database: - hightouch.com - fivetran.com - explo.com

bogomipz 4y ago

The poster states: >"If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key is derived. So older users likely still have a pretty low number of pbkdf2 rounds which makes them more vulnerable to brute forcing" Can someone say about how long would it take for an attacker to brute force a pbkdf2 master key with 5000 or 10000 rounds? Looking at their blog post from a few days ago they state: >"The threat actor may attempt to use brute force to guess your master password and decrypt the copies of vault data they took. Because of the hashing and encryption methods we use to protect our customers, it would be extremely difficult to attempt to brute force guess master passwords for those customers who follow our password best practices. We routinely test the latest password cracking technologies against our algorithms to keep pace with and improve upon our cryptographic controls."[1] Can someone say did they notify customers who had legacy accounts that used 5000 or 10000 iteration pbkdf2 master keys? They sure don't seem to mention anything remotely like that in their incident report.[1] In the above paragraph "best practices" is a link to the URL that fails to mention anything about selecting or periodically increasing the number of pbkdf2 iterations.[2]. If this weren't bad enough you are interrupted from reading their important incident report by a pop up asking you to sign up for their mailing list. Is an incident report really an appropriate place to use for marketing purposes? Are they really this shit of a company? [1] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... [2] https://support.lastpass.com/help/what-is-the-lastpass-master-password-lp070014 https://support.lastpass.com/help/what-is-the-lastpass-maste...

barbazoo 4y ago

Aaaaaand the fraudulent charges on my cc started. Coincidence, maybe but unlikely. I sincerely hope LastPass burns to the ground and never recovers.

barbazoo 4y ago
Turns out this was actually a coincidence and didn't have anything to do with the LP breach.

briHass 4y ago

I know the for-profit password management companies want you to think you have to store everything in one vault (with names like LastPass, 1Password, etc.), but why does it seem like everyone falls for it? Personally, I store plenty of passwords in the browser, but they're all the passwords I care very little about. Things like e-commerce (where the CC isn't stored), forums, etc., where the password falling into the wrong hands would be annoying, but hardly life changing. For the accounts I really care about, they go in KeePass (backed up to cloud), but with a strong master password and keyfile protected by admin-only access in Windows. Yes, it's way more of a pain to 'sudo' KeePass and copy-paste passwords than use auto-fill, but I'm only logging into my bank accounts and stuff occasionally. If I managed large crypto wallets, those secrets would probably see their KeePass DB get another layer of security: air gap or similar. No way would I comingle those with my Grubhub password that I couldn't care less about.