LastPass: design flaw in communication to privileged components | Hacker News Reader

LastPass: design flaw in communication to privileged components

bugs.chromium.org

156 pointspedro8441 comments

Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with ad network code or targeted attacks controlling path to internet. That's all setting aside how trivial it would be for nation states.

They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.

That's unfair. LastPass has always been transparent about their problems, much more so than other companies like Dropbox.

And there's nothing in their response that tries shifting the blame: https://blog.lastpass.com/2016/07/lastpass-security-updates....

> Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies.

This was not necessary for this attack to be successful on the default configuration of the tool. That's what I take issue with.

>They have a history of trying to explain away their security problems as not really their fault.

I feel like I'm reading some person's pet Wikipedia page. If they do then at least give some examples. You can't just say damning things and expect everyone to take it at face value.

Seriously? Unfounded to say the least. LastPass has always been super transparent and forthcoming regarding ANY security issue.

I don't.

The phrasing was "both exploits do require tricking a user via a phishing attack into going to a malicious website".

This suggests that the blogger believes that the only attack vector involves tricking the user to go to a malicious website; I can reasonably see calling such attacks phishing attacks.

The problem (which is, in my opinion, more serious) is that, as you identify, the blogger seems to horribly misunderstand the potential attack vectors.

I have not used LP in a long time but does not not prompt for the master password before filling?

I believe it depends on the settings for that entry - from "auto log in", "auto fill", "fill in when selected from menu" to "require master password before filling in"

So this post says

> We have verified that intercepting messages via the method you suggested is possible and is a problem. We have also verified it only affects firefox (chrome, ie, safari, opera, etc do not use the window for message passing in the same manner) and doesn't affect our primary addons.mozilla.org firefox download (which is still 3.0 version).

It seems latest version for windows is 4.1.20a? As I'm both linux and firefox user and there have been 2 password stealing exploits revealed I would very much like to know if this affects me (my version seems to be 3.3.1). Is there any version history that I could check or does anyone know what versions are affected by these 2 exploits?

They say version 3.0 is not affected by this:

> If you are running LastPass 3.0, you are not impacted and do not need to update.

As far as I know, 3.0 refers to their old interface. You can download the new version directly from their website, but not through the Firefox add-on site. The version history is available here [1].

[1] https://lastpass.com/upgrade.php

So, I've been using Lastpass for a few years now and I probably rely on it too much. Every single login has a unique and strong password so it would be a pain to have to move away.

I use a Yubikey that's required when I log into a new PC (my home pc is set to only ask every 30 days for my 2FA key), I use an email that is only connected to Lastpass and I have a strong passphrase. Any other device I use Lastpass on is set to require a password and 2FA key at each start.

Is that enough to make me reasonably secure?

It should be safe enough, with a few exceptions, one of those being this exploit: https://news.ycombinator.com/item?id=12171547

This guy says that if the webpage "asks" for another's page credentials, lastpass plugin will give it. Every character/keystroke in specific fields could be catched/logged , here you have an example from ... eBay : https://news.ycombinator.com/item?id=12000820

Anyway, this was already fixed and pushed to the users, as the guy mentions in his post.

LastPass does allow you to export all of your saved sites and passwords as an csv file. So moving away is simply exporting the vault and uninstalling the software.

The LastPass exploits presented exist after you have unlocked your vault, so 2fa on the LastPass vault won't stop them.

Personally, I'm not moving away from LastPass over these.

Has LastPass ever subjected their code to a proper, outside security audit in a form tptacek would endorse?

This is not the same as https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... is it?

No, the two disclosures just happened to come at the same time.

Wow, a bad day for them. Two different awful bugs on the front page.

Up until now I wasn't aware there were two issues, I saw two very similar titles on the front page and assumed it was about the same issue.

Might work out better for them than having one issue appear a week later.

I wonder how the Citrix acquisition/merger will affect LastPass, especially some of the security aspects.

Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.

I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.

I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password.

In fact, I'd go further and say that you can do this with your login name. So for example:

myemail+by@gmail.com for eBaY

This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your info and even stealing your account:

https://medium.com/@espringe/amazon-s-customer-service-backd...

If you are hosting with AWS you should really consider doing that http://www.techinsider.io/hacker-social-engineer-2016-2

This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

Do you realize that your AWS account can be compromised without something like this?

Using different usernames/emails for different services is not a bad idea (particularly as a defense against untargeted attacks). But using a simple algorithm for generating passwords (ie pretty much any algorithm a human can remember) is playing with fire -- if an attacker can recover your generated passwords from just a few different services (via lucky crack from a db dump, or some site stored or transmitted or logged it in plaintext, or you were phished, or you created an account to try out someone's random mvp on a slapdash server that was already pwnd, etc), a human attacker will be able to figure out your username/password for all of your services. (And if we're not there already, it won't be too long before automated password crackers can do the same.)

Plus, from a practical standpoint, what do you do when a site forces you to change your password because they fear their password db has been compromised (or has asinine rules about your password being too long, or make you rotate your password every 90 days, or they change their domain name 5 times in 3 years)?

I imagine password cracking apps are also smart enough to try letters from the site domain combined with other known base passwords (dictionary words, common substrings from other password leaks, etc.).

99.999% of users will never experience a "well-planned targeted attack." Making us jump through the same security hoops that can protect high-value targets is annoying.

Anyone could become a target anytime. An attacker would just have to attack one person at a time.

This assumes that your password is never leaked, changed, or reset. What happens if Ebay's password database were exfiltrated? You now have the following problems:

1) If your password is cracked, a hacker seeing it might deduce your algorithm and then deduce that your Amazon password would be 'myemail+mo', etc. Now your scheme is out the window.

2) Even assuming your password is salted and hashed securely such that it can't be decrypted, Ebay would probably reset it as a precaution. So now you've got to change this password. Maybe you decide to do the 3rd and 5th letters of the domain name instead. So now your scheme is 2nd-and-5th for all but Ebay, and you've got to remember that the Ebay one is unique. For now. As more leaks or resets occur down the line, however, you'll have more exceptions, to the point that you'll be forced to maintain a list of what KIND of passwords each site uses. In which case, why not just use a password manager?

Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what you have after you entered something you know, since the whole point of a password manager is to have one strong password that you need to remember, instead of tens or hundreds probably-not-so-strong individual passwords), would also be a game-over scenario if you keep all your passwords in your head, since the attacker could just run a keylogger and take the passwords as you type them during regular use instead of getting your unencrypted password database after you unlock it.

Yes, exactly. I have never understood the prevalence of threat models of the form "if an attacker gets full, unrestricted access to my running session, they still won't be able to ..." or "if an attacker gets me to run code, they won't figure out ...". They make no sense, unless the attacker is stupid.

To be fair, there are a lot of script kiddies in the world.

What are "reasonable security practices" for maintaining strong, unique passwords over several hundred sites?

For me I have a few standard passwords depending on type of security e.g forums which dont matter so much if people access vs email vs banking. On each I have change I make depending on the name of the business e.g. you could use the part of their business name to decide part of that password type thing. For someone like me who is less likely to be specifically targeted for hacking and more likely to lose account security to mass breaches like LinkedIn (twice now guys!), this seems a good way to limit chances of a broad account breaches while maintaining fairly easy to remember 100's of passwords. That said I completely acknowledge a sophisticated hacker would have no issues beating my method.

Randomly generate a password for every site. Store said passwords in a password manager protected with one master password which you remember (taking the number of passwords you would have to remember from hundreds (impossible) to one (very possible)). Even using the built-in password saving feature of your browser is fine for this if you can't be bothered to use anything else. Chrome even has an option to generate random passwords for you.

That's what I thought, but it's also exactly what LastPass and other password managers do, so I'm still unclear why kevin_thibedeau thinks password managers aren't " reasonable security practices."

But the point of failure is not likely to be your database of unencrypted passwords. Also if an attacker can get their hands on a password database which is stored locally you probably have more problems than just that.

Simply using the browsers built-in password saving capability with random passwords is still better than nothing (Chrome can even generate random passwords for you). Changing the password for one compromised site is better than having to change it for every site because of password reuse.

Password managers exchange too many strong secrets to remember, for one strong secret you can remember.

You just have to turn off any automatic / integration features. I do. Unlock with master password for every use. Really, how often is that, since most sites keep you logged in? Just a couple times a day for me.

Ugh, seriously? I think the vast majority of people wouldn't use a password manager if it were that difficult to use, especially on mobile where typing a truly secure password with different casing and special chars is a PITA. Getting a phone with a fingerprint scanner to unlock my password manager has been the mobile feature that has had the most valuable impact on me in the past couple years.

Even though I use 1Password, I used to use weak passwords on some accounts I frequently had to sign in to because I couldn't stand typing my master password in to my iPhone every time I wanted to open it. Finger print unlocking means I can use significantly stronger passwords for almost everything with little trouble now. That feature has been invaluable to me. Probably one of the most important mobile features ever, for me.

I sign in even less often, maybe once a month, on my phone. GMail, other google services, Instagram, Snapchat, HackerNews in Firefox, everything I can think of stays signed in forever.

(Though I don't use much more than those, on my phone. I do have a laptop ...)

Reply on news.ycombinator.com