Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

So, all three of the LastPass issues have been fixed, and within two weeks of being reported, to boot:

  * 2016-08-22 Vulnerability Discovered
  * 2016-08-24 Vulnerability Reported
  * 2016-09-06 Vulnerability Fixed

View on HN

The folks over there work really hard and care a lot. I'm sure that's the same with all the password managers too, but I know personally having worked at LastPass how much the founders care.

Hard-coding the symmetric encryption key used to store your master password isn't just a minor slip up. This is the kind of mistake that I for one wouldn't do and I'm no security expert.

At least for proprietary apps, security is about trust. Given their other slip ups in the past, along with present design choices like making certain administration tasks available only through the web interface, I wonder how people can trust LastPass.

Of course, it's better than not using a password manager at all. But one has to admit the bar for that is pretty low.

I get baffled at how such basic security mistakes are made. Either who did them doesn't care or doesn't know, of which neither is good for - at least - applications that store such sensitive information.

To be fair, unless I misunderstood, the symetric key is only used when you save your master password (so you don't have to re-type it) and use a PIN instead.

I believe LastPass app encourages you to NOT do this.

This obviously doesn't excuse the implementation (it shouldn't of gotten past CR). Just pointing out the attack vector is not as severe as it seems (at least from the issue's title).

Without a strong master password, encryption is useless. It's recommended to have a master password of at least 16 chars including digits and special characters. Otherwise a global enemy with the right resources, like the NSA, can brute force it from a distance.

My password is 24 chars in length, includes digits and special characters and isn't made of dictionary words. Typing such a password on my laptop with a normal keyboard is fine, because I touch type, but typing it on my phone every time I need it is simply not doable. Using a PIN on the other hand is easy and should be fairly secure if the app is designed to fallback to the master password after X failures, preferably with hardware support.

So in all fairness, not only did they screw up a basic feature, but this also encourages people to use weaker master passwords.

Really impressed ever since LogMeIn have bought Lastpass. Loads of much needed UI improvements have started to take place and it's slowly becoming less clunky.

I disagree with that. In my experience the apps and extensions have gotten much clunkier. The UI is inconsistent across iOS and Android, and on Firefox and Chrome. If I want to look up a password on my phone I will get logged out of the app two or three times before I finally get to the item I'm looking for.

I was a premium member up until my subscription expired last week. It used to be required in order to use the mobile app. Now it's not, apparently, and given the mobile app experience I've been having lately it's not worth it. I've been passively looking for a self-hosted alternative I can switch to.

I second your opinion and experience. I have been an Enterprise users for many years, but it has been getting in the way of getting work done. the Firefox plugin keeps losing passwords, takes forever to pop up and is a completely different UI from Chrome. Evaluating alternatives.

OwnCloud[0] has a password manager (Passman) that I've been thinking about.

[0] - https://owncloud.org/features/

I swapped to keepass, and I use sync to synchronise the file. It works reasonably well!

> It works reasonably well!

How does it not work? Confidentiality and data integrity are essential for password managers; they can't work most of the time in those regards.

It's file-based. If you have a copy open in one location, open a copy in a second, save the second, then make changes in the first and save the first, you can override the second copy's changes.

That said, KeePass 2.x (which came out in 2010/2011, but some people still use the old version) has synchronization built-in, and on top of that, there are plugins to make it keep backups or update a secondary database. It's the KeePass clones that have their own implementation of the internals where you can run into problems.

IT does what it says on the tin; it's a password manager. However synchronisation is extra (I use sync to sync the file, and because I'm on iOS I have to manually import the file into the app).

The recommended iOS app (MiniKeepass) doesn't support Touch ID to unlock the database (a PITA with a long master password, which I already have to unlock my device), so I'm using keepass touch, which is a MiniKeepass fork, but with ads, and they've been ignoring my requests for source code (MiniKeepass is GPL).

Browser integration is a pain; you haveto install an extension to Keepass, and then to your browser, and set them up correctly. Steps are at [0]

It works, but is a lot more hassle (which as a result means I'm more likely to skip it and use an insecure password) than Lastpass was.

[0] https://addons.mozilla.org/en-GB/firefox/addon/passifox/

That is great, however, it is still worrying since we have no chance to know if bad actors had already exploited the vulnerabilities. I am still very sceptical with regard to password managers as SaaS in the cloud – all eggs are in one basket and this basket is often not well enough protected.

The write-up indicates that both of the exploits to get to the Master Password would have required physical access to the device, and one required a root exploit.

Reply on news.ycombinator.com