4 ms·

LastPass puts vulnerable in scare quotes. But to my understanding, with this bug session information to the website could have leaked, and they don't seem to a

by mjhoy 13y ago

LastPass puts vulnerable in scare quotes. But to my understanding, with this bug session information to the website could have leaked, and they don't seem to address this. Could an attacker have hijacked logins?

pgrote 13y ago
No. Here is the explanation: "However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."
- jbinto 13y ago
  This means "your passwords are safe, because they're encrypted with a key that only you have". It still means people could have hijacked your session, which is what GP was referring to. I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
  - pgrote 13y ago
    I thought that too, until they mentioned logins at the end. Perhaps you are right. It would appear the session info would be compromised, but the login credentials would be protected.
  - Xylanthia 13y ago
    hijacking your session with lastpass wouldn't do someone any good, as they still wouldn't have access to anything. All they could attempt to get back is encrypted data. Your encryption key is never available.
- deleted 13y ago
  [deleted]
  - deleted 13y ago
    [deleted]
  - pixl97 13y ago
    Lastpass appears to use TLS 1.2 with Forward Secrecy. They would have to hijack individual sessions (or somehow get the current session kays and capture the data at the same time).
jbinto 13y ago
It seems some servers had some combination of nginx+openssl that caused the memory location being dumped to always be a recent HTTP request/response. Keep hitting that enough times and you'll get all sorts of goodies (session cookies, cleartext passwords). This tweet shows someone getting credentials from Yahoo Mail: https://twitter.com/markloman/status/453502888447586304 https://twitter.com/markloman/status/453502888447586304 I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?

by mjhoy 13y ago

pgrote 13y ago

No. Here is the explanation: "However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."

jbinto 13y ago
This means "your passwords are safe, because they're encrypted with a key that only you have". It still means people could have hijacked your session, which is what GP was referring to. I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
- pgrote 13y ago
  I thought that too, until they mentioned logins at the end. Perhaps you are right. It would appear the session info would be compromised, but the login credentials would be protected.
- Xylanthia 13y ago
  hijacking your session with lastpass wouldn't do someone any good, as they still wouldn't have access to anything. All they could attempt to get back is encrypted data. Your encryption key is never available.
deleted 13y ago
[deleted]
- deleted 13y ago
  [deleted]
- pixl97 13y ago
  Lastpass appears to use TLS 1.2 with Forward Secrecy. They would have to hijack individual sessions (or somehow get the current session kays and capture the data at the same time).

jbinto 13y ago

It seems some servers had some combination of nginx+openssl that caused the memory location being dumped to always be a recent HTTP request/response. Keep hitting that enough times and you'll get all sorts of goodies (session cookies, cleartext passwords). This tweet shows someone getting credentials from Yahoo Mail: https://twitter.com/markloman/status/453502888447586304 https://twitter.com/markloman/status/453502888447586304 I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?