palant

9 ms·

61.
by palant 4y ago
Disclaimer : I’m the author of this article. I’m not missing anything. It’s LastPass who finally need to retract this article. I proved back in 2018 that server-side iterations are misimplemented and have no security effect. That’s why the
62.
by palant 4y ago
Disclaimer : I’m the author of this article. I don’t think so. 346,000 guesses four years ago was for the old default: 5,000 iterations. 88,000 guesses is on more powerful hardware but with the new default: 100,100 iterations.
63.
by palant 4y ago
Disclaimer : I’m the author of this article. No, the iteration count is no secret. It’s even exposed via a public API, anyone can query it if they know the email address.
64.
by palant 4y ago
Thank you for this confirmation. I already suspected that LastPass failed upgrading people’s security settings for each change of defaults they made. But so far I’ve only seen one person who found an account with one iteration (that was the
65.
by palant 4y ago
It isn’t. You certainly used MD5, SHA1, SHA256 or SHA512 as hash, with SHA256 being the most likely one. All of these are very easy to bruteforce – if someone has one of your passwords, bruteforcing your master password won’t take all too l
66.
by palant 4y ago
You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters. Originally (before I started writing my own password manager) I also thought that this is a safe method o
67.
by palant 4y ago
Thing is: this is the third article on the topic I wrote in the past few days. Covering your options wasn’t the goal here, it’s in the first article: https://palant.info/2022/12/23/lastpass-has-been-breached-w
68.
by palant 4y ago
Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all cover
69.
by palant 4y ago
Disclaimer : I am the author of this article. What kind of pragmatism would you prefer? LastPass messed up way more than they are willing to admit. And it’s not like nobody warned them before, quite a few of the issues which turn out to be
70.
CVE-2022-41343: Remote Code Execuion in Dompdf library via Phar deserialization(tantosec.com)
1 points by palant 4y ago|0 comments
71.
by palant 5y ago
The client-side hashing is actually the part that keeps your master password a secret, from everyone including LastPass yourself. This makes sure that LastPass cannot decrypt your passwords despite them being stored there. The server-side p
72.
by palant 5y ago
I’ve given this some thought, but I think that this scenario still requires someone to attempt a login with correct credentials. It cannot be the legitimate owner however if the account hasn’t been touched for a year.
73.
by palant 5y ago
It’s rarely actual security concerns, mostly how they deal with security issues when they are reported to them. I’ve never had to deal with 1Password in this way, the code I’ve seen was pretty solid. This researcher made some rather bad exp
74.
by palant 5y ago
No, modern PAKE protocols work without the server actually knowing the password. The server has a “verifier” that lets them tell whether the client’s response to a given challenge is correct. I’m no expert on this topic but https:/&#x
75.
by palant 5y ago
The difference is the word “likely” which means as much as “we have no idea.”
76.
by palant 5y ago
I haven’t seen it when I wrote the article. However, the formulation is vague enough that it could mean anything. Maybe the alerts were sent out by mistake which would be good news. But they don’t quite say that. Their statement might also
77.
by palant 5y ago
I’ve written about their security story a while ago here, not much has changed since AFAIK: https://security.stackexchange.com/questions/45170/how-safe-... The trouble is that the majority of their competitors isn
78.
by palant 5y ago
Yes, the sample is rather small to draw conclusions from. The biggest concern however are the people who got the notification again after changing their master password. It just doesn’t make sense if credential stuffing is what we are talki
79.
by palant 5y ago
First of all: I don’t think that all accounts are affected. For example, my own account didn’t receive this message. Assuming that indeed a logging server was compromised, we don’t know under which conditions the password hash is logged. Ma
80.
by palant 5y ago
No, there is nothing. The complication with challenge/response schemes is that the server doesn’t know the master password – it only has that one hash, so it’s always comparing against it. There are PAKE protocols which work around thi
81.
by palant 5y ago
It’s vacation time, they simply don’t have the people on site to investigate the issue quickly. So far not surprising, and certainly intended by the timing of this attack. That their first reaction is to downplay rather than to admit that t
82.
by palant 5y ago
The formulation is vague enough that it could mean anything. Maybe the alerts were sent out by mistake which would be good news. But they don’t quite say that. Their statement might also mean that they rather disabled legitimate alerts so t
83.
by palant 5y ago
I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
84.
by palant 5y ago
Yes, I’ve already seen this. I’ve written https://palant.info/2021/12/29/how-did-lastpass-master-passw... discussing the possibilities here. So far the most likely suspicion is that LastPass infrastructure is
85.
by palant 5y ago
It’s unlikely to be due to a browser extension. A browser extension that can steal your master password can steal all the other passwords as well, it doesn’t need LastPass for that. More importantly, an extension can only steal your master
86.
by palant 5y ago
It definitely is a hard problem. Clearly, if anybody at Avast bothered to look at the data they would have spotted the issues. But even with real effort, it’s hard to anonymize data reliably while keeping it useful.
87.
by palant 5y ago
I am the author of this (slightly older) article. If there are questions, feel free to ask here and I’ll do my best to answer.
88.
by palant 5y ago
“Data collection outlined here” refers to both mechanisms covered by the article. The first one collects information about the products you look at which clearly is personal information. The automated scraping in the background is less prob
89.
by palant 5y ago
Unfortunately, it isn’t that easy. You cannot use other extensions to block requests happening on the extension’s background page. Whatever tracking and scraping is going on, you can probably disable part of it via extension’s settings but
90.
by palant 5y ago
Note : I am the author of this article. I’m really unsure how you would come to this conclusion. Even if you only read the summary at the beginning or only the conclusions section at the end, you should notice that Keepa is doing both. It

More ›