3 ms·

I suspect that even non-random passwords here are fine, again practically speaking (edit: and given certain assumptions, to be clear, like no reuse), but haven'

I suspect that even non-random passwords here are fine, again practically speaking (edit: and given certain assumptions, to be clear, like no reuse), but haven't sat down and proved it. Obviously this isn't an endorsement of LastPass. Everything about their protocols is disappointing. Even if the encryption issues turn out to be of the well-that-was-a-dumb-choice-but-you-don't-need-to-panic variety, it's because they got lucky, not because they were good.

cmeacham98 4y ago
> and given certain assumptions, to be clear, like no reuse Maybe I wasn't obvious enough, but this is the problematic assumption. When I say "non-random password", that's what I mean: a reused password. Almost everyone I know reuses passwords (sometimes with a slight variation, but 90% of the password the same), and my day job is a software engineer. I'd be willing to be at least half of Lastpass's users have at least 1 reused password.
- bbbbb5 4y ago
  Given that any login form can be used to rapidly confirm password reuse it's hard to see how ECB introduces new issues here.
  - tptacek 4y ago
    Attackers don't generally control the login forms, but they do have the LastPass vaults, so this response doesn't make much sense.
    - bbbbb5 4y ago
      Attacker doesn't need to control the login form to use it as an oracle to confirm password reuse.
      - tptacek 4y ago
        Reuse of what? If you're assuming the attacker already has a valid password, the list of URLs they use it also irrelevant, as is the password vault. Just do what real attackers do and hit every single known login page on the Internet with it.
        bbbbb5 4y ago
        That's exactly what I'm saying :) If the attacker doesn't have the valid password, the knowledge that two different sites share the same password isn't exactly game-changing. And if the attacker does have the password, they'll figure out where it works regardless of access to LastPass db.
        tptacek 4y ago
        It's not nothing, and it's weird to be strident about it, but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about.
        bbbbb5 4y ago
        > It's not nothing, and it's weird to be strident about it To an outsider, hearing people talk about how LastPass used Very Bad ECB mode makes it sound like a fuckup with immediate and dramatic effect on the security of their passwords, that isn't exactly true. Nobody should have been using LastPass, but we can still be realistic about the threats facing those who did. > but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about. Of course not, but that's a completely separate issue from their choice of AES mode.
  - cmeacham98 4y ago
    Knowing you reused the same password between your Amazon and $CompromisedWebsite accounts (but nowhere else, maybe you set them up the same day) gives attackers a significant advantage over having to try every password they have on every website.
    - bbbbb5 4y ago
      I don't think this is a significant advantage, the cost of an incorrect password attempt is essentially zero. Trying "every password they have on every website" for an individual will still be a very small set of passwords to try.
      - Shaanie 4y ago
        I could see password reuse being used as a reason for trying brute force/dictionary attacks. E.g. You see that a user has used the same password on Coinbase as X, which could indicate that the user isn't using randomly generated passwords and therefore be potentially vulnerable to such attacks. Kind of a long shot though.
      - cmeacham98 4y ago
        Attackers generally aren't targeting a specific individual, they got a dump of X million passwords from some compromised website. Being able to connect those directly to working accounts rather than having to burn IPs and get them rate limited and/or banned trying duds _is_ valuable information. If you have some attacker after specifically you, yes this information is of less use to them, because they will have tried every password of yours they have on every website already hoping you reuse passwords.
- FreakLegion 4y ago
  That was a hasty edit on my way out the door this morning. Reusing a password doesn't make it easier to decrypt here, it just helps with some secondary tasks, like validating decryption output (since ECB isn't authenticated). This is rather indirect, though -- not a great example. A better example would've been the password fitting in a single block (<= 16 characters). The reason I suspect even non-random passwords might be mostly fine[1] is because there's no oracle and passwords are generally short. There's not much there for someone to hang their hat on. It's only a hunch, though; if tptacek for example says something different, I'd believe him. 1. Meaning: No need to cancel Christmas. You can deal with it later. Not meaning: ECB is as strong as CBC or whatever.

cmeacham98 4y ago

> and given certain assumptions, to be clear, like no reuse Maybe I wasn't obvious enough, but this is the problematic assumption. When I say "non-random password", that's what I mean: a reused password. Almost everyone I know reuses passwords (sometimes with a slight variation, but 90% of the password the same), and my day job is a software engineer. I'd be willing to be at least half of Lastpass's users have at least 1 reused password.

bbbbb5 4y ago
Given that any login form can be used to rapidly confirm password reuse it's hard to see how ECB introduces new issues here.
- tptacek 4y ago
  Attackers don't generally control the login forms, but they do have the LastPass vaults, so this response doesn't make much sense.
  - bbbbb5 4y ago
    Attacker doesn't need to control the login form to use it as an oracle to confirm password reuse.
    - tptacek 4y ago
      Reuse of what? If you're assuming the attacker already has a valid password, the list of URLs they use it also irrelevant, as is the password vault. Just do what real attackers do and hit every single known login page on the Internet with it.
      - bbbbb5 4y ago
        That's exactly what I'm saying :) If the attacker doesn't have the valid password, the knowledge that two different sites share the same password isn't exactly game-changing. And if the attacker does have the password, they'll figure out where it works regardless of access to LastPass db.
        tptacek 4y ago
        It's not nothing, and it's weird to be strident about it, but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about.
        bbbbb5 4y ago
        > It's not nothing, and it's weird to be strident about it To an outsider, hearing people talk about how LastPass used Very Bad ECB mode makes it sound like a fuckup with immediate and dramatic effect on the security of their passwords, that isn't exactly true. Nobody should have been using LastPass, but we can still be realistic about the threats facing those who did. > but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about. Of course not, but that's a completely separate issue from their choice of AES mode.
- cmeacham98 4y ago
  Knowing you reused the same password between your Amazon and $CompromisedWebsite accounts (but nowhere else, maybe you set them up the same day) gives attackers a significant advantage over having to try every password they have on every website.
  - bbbbb5 4y ago
    I don't think this is a significant advantage, the cost of an incorrect password attempt is essentially zero. Trying "every password they have on every website" for an individual will still be a very small set of passwords to try.
    - Shaanie 4y ago
      I could see password reuse being used as a reason for trying brute force/dictionary attacks. E.g. You see that a user has used the same password on Coinbase as X, which could indicate that the user isn't using randomly generated passwords and therefore be potentially vulnerable to such attacks. Kind of a long shot though.
    - cmeacham98 4y ago
      Attackers generally aren't targeting a specific individual, they got a dump of X million passwords from some compromised website. Being able to connect those directly to working accounts rather than having to burn IPs and get them rate limited and/or banned trying duds _is_ valuable information. If you have some attacker after specifically you, yes this information is of less use to them, because they will have tried every password of yours they have on every website already hoping you reuse passwords.
FreakLegion 4y ago
That was a hasty edit on my way out the door this morning. Reusing a password doesn't make it easier to decrypt here, it just helps with some secondary tasks, like validating decryption output (since ECB isn't authenticated). This is rather indirect, though -- not a great example. A better example would've been the password fitting in a single block (<= 16 characters). The reason I suspect even non-random passwords might be mostly fine[1] is because there's no oracle and passwords are generally short. There's not much there for someone to hang their hat on. It's only a hunch, though; if tptacek for example says something different, I'd believe him. 1. Meaning: No need to cancel Christmas. You can deal with it later. Not meaning: ECB is as strong as CBC or whatever.