7 ms·
> Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s You aren't wrong, if true that's certainly a mistake on their part. Pr
by FreakLegion 4y ago
> Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s
You aren't wrong, if true that's certainly a mistake on their part. Practically speaking though as long as the passwords are randomly generated it probably doesn't matter, i.e. if you think about what the IV and chaining are doing in CBC. ECB is just as good for encrypting a random stream of bits; CBC just makes sure the bits are random before passing them into the cipher. Of course the optics are still terrible.
- cmeacham98 4y agoWhile you're correct: 1. In real life, passwords aren't random. Password manager users are probably less likely than average to make this blunder, but I'd still be willing to bet _the majority_ of lastpass's customers do. 2. Even if you personally have all random passwords, would you really want to use a product made by people who made this level of a noob mistake? I used to pay for LastPass premium, now my account is deleted, my passwords are changed, and my money goes to Bitwarden instead - and every time I hear about Lastpass I don't regret this decision.
- FreakLegion 4y agoI suspect that even non-random passwords here are fine, again practically speaking (edit: and given certain assumptions, to be clear, like no reuse), but haven't sat down and proved it. Obviously this isn't an endorsement of LastPass. Everything about their protocols is disappointing. Even if the encryption issues turn out to be of the well-that-was-a-dumb-choice-but-you-don't-need-to-panic variety, it's because they got lucky, not because they were good.
- cmeacham98 4y ago> and given certain assumptions, to be clear, like no reuse Maybe I wasn't obvious enough, but this is the problematic assumption. When I say "non-random password", that's what I mean: a reused password. Almost everyone I know reuses passwords (sometimes with a slight variation, but 90% of the password the same), and my day job is a software engineer. I'd be willing to be at least half of Lastpass's users have at least 1 reused password.
- bbbbb5 4y agoGiven that any login form can be used to rapidly confirm password reuse it's hard to see how ECB introduces new issues here.
- tptacek 4y agoAttackers don't generally control the login forms, but they do have the LastPass vaults, so this response doesn't make much sense.
- bbbbb5 4y agoAttacker doesn't need to control the login form to use it as an oracle to confirm password reuse.
- tptacek 4y agoReuse of what? If you're assuming the attacker already has a valid password, the list of URLs they use it also irrelevant, as is the password vault. Just do what real attackers do and hit every single known login page on the Internet with it.
- bbbbb5 4y agoThat's exactly what I'm saying :) If the attacker doesn't have the valid password, the knowledge that two different sites share the same password isn't exactly game-changing. And if the attacker does have the password, they'll figure out where it works regardless of access to LastPass db.
- tptacek 4y agoIt's not nothing, and it's weird to be strident about it, but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about.
- DennisP 4y agoThe whole point of a password manager is so you don't have to remember passwords. Why wouldn't you use unique random passwords? It even generates them for you.
- minusf 4y agothis would bite me in the worst possible moment when i need to login to somewhere and i lost my phone/battery dead/company hacked/etc. i have been using keepass(xc) since it's been around and i dont use random passwords. every year i create a formula that creates all my passwords and i put these in the vault. it also enforces password rotation. losing the vault i can still come up with any of my psswords just by remembering the formula. for company server services it's a different story, i generate wholly random strong passwords and store them in the offline vault. edit: typos
- ilyt 4y agoThat looks like a lot of work. I just backup the password list separately from time to time
- wpietri 4y agoAt least in my case, the first time I used a password manager it learned my existing ones from my browser, and many of those were non-random. From that point forward I used generated passwords, but I'm sure I still have hundreds of legacy ones that I didn't bother to go and change because the sites didn't matter that much to me.
- thechao 4y agoIt’d be nice if, when I logged in to a site, my browser would casually mention if the pw is reused, or not. Now-a-days, I just habitually check my pw on login to make sure it’s random. For the SO & kiddos, I manually reset all the financial & identity defining pws (Google, Amazon, FB).
- taikahessu 4y agoIf you create some new account on mobile, the workflow is messy. If you are on schedule like ordering a ticket, you just quickly try to get the job done. You need to know the specific order how to create the password for a new site. Otherwise it was just easier to plow through with your favourite memorised combination. At least I found it hard to do with Lastpass on mobile. Now I’ve tested it with Bitwarden and 1Password 8, they seem to do a better job with it.
- deleted 4y ago[deleted]
- rzimmerman 4y agoAlso it’s not clear that the same AES key is used for all secrets. If it’s URL- or tag-derived using the master password then it’s only bad for long secrets (more than 32 bytes) that aren’t random data.
- bawolff 4y agoI think the main thing is there are no benefits to ecb here (other than laziness), it would be trivial to do it properly, and is suggestive of thei general practises.
- fulafel 4y agoBesides the obvious (that pw's generally aren't randomly generated), LastPass is used for other secrets besides passwords.