Hacker News Reader

Comment by obituary_latte | Hacker News Reader

It states in the article that among other things, Autho and LastPass credentials were stolen. I’m a 1Password user so am not familiar with those password managers. Don’t they encrypt the credentials making theft of the data useless? Or am I missing something?

View on HN

If your pc is in any way compromised, and no 2fa is enabled (and the 2fa device is not compromised as well), you must assume everything is or has been available to the evil actor. Sometimes, its a drive-by download or a dropper malware that will install other virii. You will never really know what went in or out your pc...

Here is a potential solution to solve a problem of LastPass being a single point of failure http://lukasz-madon.github.io/Password-management/

Sounds complicated. I’m sure the world will still be much better off if people used password managers as-is, even with the drawbacks.

Not sure, but reading that I was assuming that the malware was able to intercept the master password for these services. So the attackers could log into those accounts.

Ah ok yeah that makes perfect sense - if it was keylogging then all bets were off.

SAASPASS is a password manager that unlocks on the desktop only with multi-factor authentication. There is no master password to be stolen.

Multi-factor means more than one factor.

Something you have + something you know are multiple factors.

There should still be a password. If there isn't, then it's single factor auth.

Also, SAASPASS looks really interesting. Thanks for sharing. Going to take a much deeper look into this now.

EDIT: Nope, change of plans. The account recovery flow depends on SMS, which isn't safe given how easy SIM-jacking is: https://saaspass.com/how-to-recover-saaspass-id-account/

Ideally when you have a less capable device-based solution to "Something you have" like a FIDO token you want the user to enter their password (a "Something you know" factor) into that device, not the general purpose computer.

So now the password isn't in the computer at all and can't be stolen from it.

For example to sign into the web site for my bank account I need to enter a PIN into a chiclet keypad device they gave me, it spits out a one-time code and I type that into the web site. You can't steal the PIN from my PC, even if you have some kind of super zero day exploit and co-operation from the OS vendor, because the PIN gets typed into a separate device that doesn't even have a USB connector. You might as well try to use the PC to steal cash out of my wallet.

Actually not. There is account recovery options that include a separate custom question and answer (password let’s say), and also the option of cloning it from another device as well. Those two different methods mitigate against SIM jacking.

See this link from today: https://news.ycombinator.com/item?id=22016212

The parent's whole point was that this service doesn't have a master password. Nope, instead it has a 4 digit PIN and SMS as it's base flow, with security as an optional extra.

A password manager shouldn't need to be caveated to be recommended. It's too important for that.

No password managers really help in this scenario, as the attackers have access to the machine the client runs on. Any malware will simply wait untill you unlock it, and then siphon out any credentials.

True in that case as that has nothing to do with the password manager. Any password that you would type in manually is also vulnerable.

So what you're saying is, they need 2FA for their 2FA

Auth0 isn't a password manager. It's an authorization platform. If they stole Auth0 API secret keys and/or saved logins to the Auth0 management portal, they'd have access to other users' accounts but not passwords.

You can also probably extract everything from memory if the password manager is unlocked, I'd guess.

1Password automatically locks after some predetermined amount of time - wonder if those other two do as well. I guess it doesn’t really matter, though, if the malware is smart enough to be reading mem it’s probably smart enough to just wait until the db is unlocked to copy.

> 1Password automatically locks after some predetermined amount of time

only if enabled. Just like any password manager out there.

for what it's worth, it's enabled by default to 10 minutes.

Reply on news.ycombinator.com