Hacker News Reader

Comment by bryan0 | Hacker News Reader

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed.

Must be a compromised browser extension at this point.

> To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after clicking the "Delete" button.

Is there anything more infuriating than this type of error message?

View on HN

>Must be a compromised browser extension at this point

Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit.

Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility.

Edit #2: Some of the larger js files do have a fair amount of the size as arrays of localized text, error messages, lists of numbers, etc. But it is still a lot of JS.

> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript.

For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs, etc.) and the compressed image that contains all of this easily fits in 16MB SPI NOR flash with a few megs to spare.

Does your product have any images or localized text that could balloon the size?

Nope.

So that explains why it’s so small then.

If you measured the proportion of localized text and images in the 25MB of javascript mentioned above, please post these numbers. Otherwise nothing's been explained.

There's 4.3 megabytes of plain text in the KJV bible. Is LastPass' localization longer than the bible?

https://www.gutenberg.org/cache/epub/10/pg10.txt

Wow, how can this amount of files be justified?

And how did this breached exactly happen?

> Wow, how can this amount of files be justified?

File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.

Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".

To be fair, orthogonal just means something that’s at a right angle to another line. I’ve heard people refer to something that is opposite, or an antonym to parallel (or in sync) as orthogonal.

Here it means "perpendicular". A high dependency count is perpendicular to the goal of reducing exposure as much as possible.

"total of 25MB of javascript" is a good metric of the complexity of the application's code, and correspondingly the difficulty of auditing it (I'd say 25 MB of JS code make it infeasible).

Seems like a pretty good metric of complexity to me, particularly when it comes to a security audit. Having a lot of packages packaged up in the extension corresponds to having a lot of source code you have to vet, lest it be an avenue of attack.

25MB of plaintext lines of javascript code is absolutely an indication of the complexity

File count and general "bloat" is an indicator of the quality of the engineering in the product. Especially for a security product _minimalism_ should be evident -- nobody with good security sense would want or allow anything not truly necessary to the product's functionality to be included.

There's a lot of room between "super trivial" and "needlessly complex" -- it shouldn't be either.

Trusting a cloud-based third party with my passwords is a non-starter for me.

I posted the GP, with the sizes, etc. I think they do have a somewhat hard problem to solve though. They probably also want to minimize remote calls so that the extension is functional offline, is more secure, etc. Which would drive the size up, especially with localized errors, etc.

> The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript.

i wonder if any of that is log4j ( :

How could it be log4j if it’s JavaScript and not Java?

> Must be a compromised browser extension at this point.

In their 2019 breach, JS on arbitrary pages was able to access the contents of LastPass' own extension to obtain the last used username/password combinations. [0]

As, today, the extension now contains 25Mb of JS, making it difficult to audit, I wouldn't say that it has to be someone else's fault until proven.

[0] https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

>Must be a compromised browser extension at this point.

The previous thread had password never typed, copied or used for years. Unless we are talking about multiple vector, otherwise browser extension doesn't fit most of the reported scenario.

Maybe hashes got snarfed somehow, possibly multiple times, and some passwords shook out of a rainbow table?

Impending company changes also raises the possibility of an insider attack.

Agreed. If it was a compromised extension it would steal all the passwords when you unlock and upload it somewhere like pastebin.

"Something went wrong"

> Is there anything more infuriating than this type of error message?

Well the other classic move by webshits is to have you stare at a spinner indefinitely.

Just tried deleting my account--got exactly that error. That's not reassuring

If you Google for the error message you'll find that this behavior has been there for several years. I guess they just don't care about the usability in his part of the process. I tried deleting an account with dev tools installed and the web server gave HTTP error 500 (internal server error). I think the JavaScript just bails out at that point.

From 2019: https://www.reddit.com/r/Lastpass/comments/afmfop/cant_delet...

From 2020: https://twitter.com/jowouters/status/1222438393981886464

There's a ton of those posts. Some in the official LastPass forum as well, and the response from LogMeIn was basically that the account was deleted.

(It's of course crappy, just saying that this behavior is nothing new and probably just something they don't care about enough to fix..)

Same here. It appears(?) that my account got deleted.

Confirmed. I deleted my account, received the error above. Then when attempting to login again, I was told my email was mistyped.

I stopped using LastPass a long time ago, but this has definitely put them on thin ice for me, I won't be recommending them going forward.

Ditto - I recently switched to BitWarden and kind of forgot that I was still giving it a self determined "trail period." This certainly kicked that trail period into my new current password manager.

I had the same when deleting my account 3 years ago. LastPass is hot garbage and LogMeIm are the perfect home for it being a dumpster fire of a company.

I did not get any email about login attempt, but deleted my old Lastpass account as a precaution anyways, and also received this error. No confirmation of deletion via email. However, I'm not able to log in anymore, and attempts to get master pwd hint via email don't work either, so I believe it's more or less deleted.

Ones which say "something went wrong" with a "funny" gif of someone scratching his head?

Add a recaptcha that barrely solves in the mix before being able to click on continue, or after logging in.

For me I was able to reset my account (which removes all data) but not delete it. It appears to be an issue with their WAF blocking requests to the account deletion endpoint.

Reply on news.ycombinator.com