5 ms·

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop an

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. There's more here than is being written, and I can only imagine because the truth probably stinks. ¹except TFA mentions MFA … but the mention of it doesn't really make sense.

deebosong 4y ago
I understand what I'm asking for is "educated conjecture" more or less, but what would you surmise might be actual plausible situations rather than what LastPass is putting out as PR? Just asking as a laymen who is curious with no skin in the game.
schainks 4y ago
> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when they've been breached is a huge component of their ability to repel or minimize attacks.
- NoPicklez 4y ago
  Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if something happens to you completely behind the scenes during your normal business, it's not on the employee.
  - rightbyte 4y ago
    > Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
    - geoelectric 4y ago
      I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
      - ed_elliott_asc 4y ago
        My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!
        faeyanpiraat 4y ago
        If you start dragging a password from 1Password, the window disappears and you can release your mouse over a field elsewhere, and it will get typed in there (instead of pasting). This may or may not work for your case.
    - deleted 4y ago
      [deleted]
    - skissane 4y ago
      Almost 20 years ago, I worked with this (not particularly competent) sysadmin. Policy said the root password had to be rotated once a month. So, in July 2003, they set the root password to blah0307 (where blah was some random word, which I forget now but knew at the time.) I wasn’t actually supposed to know the root password, but one of my colleagues let me in on the secret, including the repetitive pattern. I think the security auditor ticked the box “root password changed every 30 days”, but never asked what the password actually was. I know some places have rules like “must have at least N characters different from previous passwords”. However, depending on the exact rule, people can come up with easy-to-remember workarounds: e.g. the “blah” bit is ”foo” in even months and “bar” in odd ones.
- blibble 4y ago
  > I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. this is mostly so they can pin it on you when it inevitably happens (rather than the management)
- davewritescode 4y ago
  Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization. In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the threat model can get kind of wild and difficult to engineer for while building what's ultimately a consumer facing product. However, in this particular case it's fairly obvious that bad IT policies lead to an issue and LastPass got burned. I would be more forging of LastPass but letting employees do BYOD means you have to trust everyone that ever uses that computer including spouses and children. It's just really dumb.
  - schainks 4y ago
    LastPass’ lackadaisical attitude internally for defense in depth is indeed embarrassing.
chromanoid 4y ago
> ¹except TFA mentions MFA … but the mention of it doesn't really make sense. I guess there was a loophole in their MFA integration. Maybe they accepted the same TOTP twice - in a multi-region setup I guess this might be a trade-off that somebody might risk. With a keylogger one can theoretically steal a TOTP anyway or do other more sophisticated shenanigans. > We enabled Microsoft’s conditional access PIN-matching multifactor authentication using an upgrade to the Microsoft Authenticator application which became generally available during the incident. Maybe switching to push notifications with number matching is their mitigation for that (e.g. without affecting multi-region replication / performance).
secondcoming 4y ago
If you BYOD then do your work stuff on a VM. It’ll help with security and has the benefit that you can just delete the VM when you change jobs.
antihero 4y ago
I expect the amount of companies that would get fucking owned by simply managing to execute cat ~/.aws/* | <some sort of curl to a pastebin> On a devops/senior dev machine is colossal.
- mhitza 4y ago
  What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process. Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env vars and runs a program (something like mozilla/sops), but I still find that too cumbersome, I'd like it transparent and integrated with my shell.
  - yunwal 4y ago
    aws-vault[0] does this, but only for aws creds 0 - https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault
    - antihero 4y ago
      Yeah this is a good tool, if annoying at times. A better way would be to not allow user accounts to deploy anything in any sort of prod accounts, instead only allowing this to happen through CI.
  - CoolCold 4y ago
    Combining direnv with sops can be partial solution here.
jabroni_salad 4y ago
We are looking at a highly sensitive asset, though. A vault that is only used by four employees (per the original press release, not in the 9to5mac article) and contains keys for the production backups. At this level of sensitivity you need to consider "should the employee's personal plex server be able to connect to this" and the answer might be a No. At this point you should be issuing them a PAW and a physical security key and auditing the shit out of it. It's not like lastpass can't afford it.

deebosong 4y ago

I understand what I'm asking for is "educated conjecture" more or less, but what would you surmise might be actual plausible situations rather than what LastPass is putting out as PR? Just asking as a laymen who is curious with no skin in the game.

schainks 4y ago

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when they've been breached is a huge component of their ability to repel or minimize attacks.

NoPicklez 4y ago
Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if something happens to you completely behind the scenes during your normal business, it's not on the employee.
- rightbyte 4y ago
  > Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
  - geoelectric 4y ago
    I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
    - ed_elliott_asc 4y ago
      My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!
      - faeyanpiraat 4y ago
        If you start dragging a password from 1Password, the window disappears and you can release your mouse over a field elsewhere, and it will get typed in there (instead of pasting). This may or may not work for your case.
  - deleted 4y ago
    [deleted]
  - skissane 4y ago
    Almost 20 years ago, I worked with this (not particularly competent) sysadmin. Policy said the root password had to be rotated once a month. So, in July 2003, they set the root password to blah0307 (where blah was some random word, which I forget now but knew at the time.) I wasn’t actually supposed to know the root password, but one of my colleagues let me in on the secret, including the repetitive pattern. I think the security auditor ticked the box “root password changed every 30 days”, but never asked what the password actually was. I know some places have rules like “must have at least N characters different from previous passwords”. However, depending on the exact rule, people can come up with easy-to-remember workarounds: e.g. the “blah” bit is ”foo” in even months and “bar” in odd ones.
blibble 4y ago
> I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. this is mostly so they can pin it on you when it inevitably happens (rather than the management)
davewritescode 4y ago
Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization. In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the threat model can get kind of wild and difficult to engineer for while building what's ultimately a consumer facing product. However, in this particular case it's fairly obvious that bad IT policies lead to an issue and LastPass got burned. I would be more forging of LastPass but letting employees do BYOD means you have to trust everyone that ever uses that computer including spouses and children. It's just really dumb.
- schainks 4y ago
  LastPass’ lackadaisical attitude internally for defense in depth is indeed embarrassing.

chromanoid 4y ago

> ¹except TFA mentions MFA … but the mention of it doesn't really make sense. I guess there was a loophole in their MFA integration. Maybe they accepted the same TOTP twice - in a multi-region setup I guess this might be a trade-off that somebody might risk. With a keylogger one can theoretically steal a TOTP anyway or do other more sophisticated shenanigans. > We enabled Microsoft’s conditional access PIN-matching multifactor authentication using an upgrade to the Microsoft Authenticator application which became generally available during the incident. Maybe switching to push notifications with number matching is their mitigation for that (e.g. without affecting multi-region replication / performance).

secondcoming 4y ago

If you BYOD then do your work stuff on a VM. It’ll help with security and has the benefit that you can just delete the VM when you change jobs.

antihero 4y ago

I expect the amount of companies that would get fucking owned by simply managing to execute cat ~/.aws/* | <some sort of curl to a pastebin> On a devops/senior dev machine is colossal.

mhitza 4y ago
What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process. Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env vars and runs a program (something like mozilla/sops), but I still find that too cumbersome, I'd like it transparent and integrated with my shell.
- yunwal 4y ago
  aws-vault[0] does this, but only for aws creds 0 - https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault
  - antihero 4y ago
    Yeah this is a good tool, if annoying at times. A better way would be to not allow user accounts to deploy anything in any sort of prod accounts, instead only allowing this to happen through CI.
- CoolCold 4y ago
  Combining direnv with sops can be partial solution here.

jabroni_salad 4y ago

We are looking at a highly sensitive asset, though. A vault that is only used by four employees (per the original press release, not in the 9to5mac article) and contains keys for the production backups. At this level of sensitivity you need to consider "should the employee's personal plex server be able to connect to this" and the answer might be a No. At this point you should be issuing them a PAW and a physical security key and auditing the shit out of it. It's not like lastpass can't afford it.