Hacker News Reader

Comment by CWuestefeld | Hacker News Reader

Actually, I think that LastPass overreacted. Seeing the possibility of a breach, and alerting customers is definitely the right thing. But they went so far as to lock customers out of their own data -- it was two full days before my wife was able to get into our bank account.

View on HN

Was that their failing or yours?

I'd tend to look at these types of services as a convenience, nothing more. If you allow yourself to become reliant on them for access to your personal data, like banking, etc., then I'd say that you put too much faith/trust in them. Shit happens, all the time, despite the best intentions of people working hard to make sure it doesn't.

That's the value proposition of LastPass though, that you use them for all of your passwords...

And they have an "offline" non-browser program everyone can/should use to both keep an exported backup and access passwords in an outage.

That's the marketing offer. I use lastpass for all my websites, but not for my master email, paypal and banks. I have over 120 accounts here and there for websites I test. Before I had three password one for paypal, one for email and one for everything else, then came the gawker debacle. I completly trust lastpass for my twitter account, facebook, affiliation programs, etc...

I do exactly the same. Lastpass has my social sites passwords, and other not-so-relevant sites. I commit to memory my hard-to-guess passwords for email, bank and Paypal accounts.

> I'd tend to look at these types of services as a convenience, nothing more.

How do you go about keeping all of your usernames and passwords secure, then?

I'm not the OP, but I use KeePass+DropBox.

The encrypted database is local and synced everywhere. If DropBox goes down I have to fall back to another transport, but I am never "locked out".

Call me crazy, but I use my memory. I also use RSA fobs for the important/big stuff.

Your memory must be much better than mine. Recommended procedure is to use a different and secure password for every site you care about, right? That's three bank accounts, several work-related accounts, a couple of social media sites, etc. I'd have to remember at least 20 difficult passwords on a daily basis.

Maybe it is... who knows.

It's a hell of a lot easier to do if you don't make it about straight random memorization though.

I have a little memory association I do with every site I need an account/pass for, based on various characters out of books I've read.

Every site has a character I've associated with it, to make it easier to remember, and I have a simple (to me) algorithm I use to generate the password that includes various capitalization and special characters.

Sure, it might take a bit of work early on to remember stuff, but if you learn how to memorize things effectively, it makes it much easier.

Mind you, I also know all my CC numbers, passport number, drivers license, etc., as well, so maybe I'm just weird.

Maybe not weird, but definitely better than me. I remember my driver's license, my phone number, my girlfriend's, and my parents'. That's about it.

The mnemonic is a good idea. I've thought about doing that - but then I fear that I'd forget the mnemonic :)

I have to look at my phone every time someone asks me for my phone number. I don't know if this means that my brain is dying or that I don't bother remembering information that I can easily look up...

That's some awesome memory you've got!

I use my memory for all my passwords (lots) and quite a few client / account numbers. I like to do it that way cos it's fast, but on the odd occasion, maybe once a year, I have a 'bad day' when I can't remember -any-.

it was two full days before my wife was able to get into our bank account

Most banks have phone numbers that you can call if you don't know your password. Some banks even let you reset your password if you know your account number and SSN.

Hah! In Poland we have a much more secure system. Any attacker needs to know my mother's family name as well.

EDIT: d'oh. It's maiden name, obviously.

Nitpick: It's usually mother's maiden name - is that what they need to know?

Recently I needed to get my password for my bank account in France (I live in China)... They gave it over the phone after I only gave them my bank account number, my birthday and my name... I then went on to my bank account and transferred money.

With banks this secure, I really don't worry about keeping the login information in something like lastpass

I'm can't if you're saying that banks are secure or insecure. BTW, your name is Guillame Maury, and your birthday is 03/07/1982.

Anyway, I also live in China, and have had problems with banks being so secure that it becomes inconvenient. A few months ago I tried to get into my ING account, for which I'd lost the password. Although I managed to authenticate my identity over the phone, they could only send me a new password to my address in the UK. However, this is a house my family no longer lives in... so the whole affair involved contacting the new occupants to forward the new password letter on to someone I knew. I've also had problems with Natwest's online payment system giving me an "unknown failure" message. After calling up, I found that the system had flagged my transaction as suspicious due to my location as revealed by my IP address. When dealing with such issues, I often feel like I'm trying to steal my own identity.

Anyway, after looking at the options I decided to use PasswordCard to manage my passwords, which is a physical solution (www.passwordcard.org). It's a card of random numbers, symbols and letters that you can print out. You then take a sequence of such symbols to form each new password that you need. I decided not to use a standard password manager since it's not very portable between machines (I travel quite a bit, and also with the current rate of technology change it's likely that in a few years I'll be using a device and OS that doesn't exist yet).

I was being sarcastic when I said that it was secure....

It's true that sometimes having very secure banks can be a pain... But, I would much rather have a bank that is very secure and a bit of a pain to sometimes access compared to a bank like mine where it's trivially easy to get access to someone's bank account...

I currently use 1password because it's not hosted, it's portable and I find it quite convenient...

BTW: You got my name but haven't got my correct birthday date. I've avoided having it in clear on internet because of identity thefts :-)

If you ever drop by Shanghai, feel free to hit me up for a drink

Personally, my bank account is one part of my online identity I wouldn't trust in the hands of any password manager.

This. For me, Lastpass gets everything except email and banking. That means I have to remember 3 logins, which I am okay with.

Just 3 ... problem is between banks, CC and brokerage accounts I have at least a dozen accounts which are 'financial' in nature.

I wish there was a way of securing all of them with the same secondary authentication token.

Something like this? https://www.pwdhash.com/ You can use the same password but the local browser plugin will use the site's URL to hash the password you type into something unique to that URL. I haven't used it personally and haven't researched it in detail but I like the concept.

Sounds like supergenpass which was implemented in Javascript as a bookmarklet, which is pretty good idea, except that any website with malicious code could grab your master pass from the DOM, and then they could use that for your account on any other website.

It looks like pwdhash works around this by functioning as a browser plugin (making your master password in accessible from the DOM) but I'd still be slightly worried about browser exploits allowing malicious sites to get at your master password.

Maybe you use trust-level master passwords. E.g.

Financial institutions you type in: 'myfinancialpassword' Other sites you type: 'myrelativelysecurepassword'

It's remarkably hard to get this right. pwdhash notes[1] that being a browser plugin stops JavaScript grabbing the password, but it's still possible with Flash. Third-party ports to other browsers don't even have the JS protection.

pwdhash still leaks the length of the password since it aims to give users visual feedback of characters being typed.

Then you've also got the issue of automatic update of plugins being compromised. The question is really: is it more secure than the alternatives?

1: http://crypto.stanford.edu/PwdHash/pwdhash.pdf

But why? What are you worried about? The anti-fraud systems being employed by your bank are damned good. Moreover, All banks (U.S.) provide fraud protection... Looking at my Bank's website for a moment reveals that a potential attacker could, I assume, change my ATM PIN (If they already knew it) do some bill pay, and possibly create an ACH transfer... Which I could reveal as fraudulent to my bank...

Why should I be worried about this? I'm not trolling... I just don't understand what we are all supposed to be afraid of.

It took your wife two days to verify her account by email, or login from a previous location?

Would you rather have a slight inconvenience and have a company act in your best interests (security and safety), or would you prefer your data run the risk of compromise?

I'd like to be able to decide for myself how much risk to expose myself to. In this case, all signs were for minimal risk, so I think that they went overboard.

You can do that by not using LastPass. Offering "yeah, I want a little security, but not too much" would be kinda silly; they want their data to be safe.

I'm curious why she was locked out. I'm a LastPass user and the only thing I noticed is that my Chrome browser plugin had logged me out. I was able to log in with no problems, though, and the plugin continued to autofill websites as usual.

I couldn't log in for about 20 minutes at some point - which was bad, because I was at work, and stored work credentials via LastPass.

"Sorry, boss, can't work on that bug because I don't have my Redmine password. I also don't have the password for our build machine, so I can't sudo anything."

Wait, you rely on a password instead of a public key for your build machine?

To log in I use keys, but from there I still need to type in a password for root access.

We also have a client who gave us remote access via a Java applet to SSH in with - can't use keys on those.

Reply on news.ycombinator.com