Comment by pydry | Hacker News Reader

Comment by pydry | Hacker News Reader

I remember when lastpass had a security hole that could expose any password in your vault by visiting a web page. They thanked the security researcher who found it with a paltry sum of $1,000.

https://www.theverge.com/2019/9/16/20868111/lastpass-bug-exp...

>In a statement posted on its blog, LastPass downplayed the severity of the bug. The company’s Security Engineering Manager, Ferenc Kun, said that the exploit relied on a user visiting a malicious site and then being tricked into clicking on the page “several times.”

This was what led me to dump them and delete my account.

I thought at the time that A) they're sloppy and B) the next exploit will 100% be sold on the black market for minimum an order of magnitude higher price.

If there were a common exploit among the people on the HN thread like a compromised chrome extension I think they would have discovered it. There were a lot of people on that thread, a bunch of invalidated hypotheses and no clear commonalities.

Edit : i made a mistake - it only exposed the last used password in the vault. Pretty bad but not quite as awful as I first thought.

> I remember when lastpass had a security hole that could expose every password in your vault by visiting a web page.

I remember when KeePass browser plugin had the same issue. The security researchers were not paid.

I'd avoid using that too then.

Would you avoid using any password storage where either the system itself or the underlying foundation has had serious vulnerabilities at some point?

Or only bad vulnerabilities triggered using JavaScript? Or would you only accept a history with vulnerabilities if security researchers were paid properly for the work they invested into finding the issues?

I tend to prefer open source but slightly obscure open source with a few unpaid maintainers and a very high attack surface? Yeah, I'd avoid that too.

I have much more confidence in open source password storage that doesnt try to autofill. Theres much less that can go wrong. This is how I store banking passwords.

A serious vulnerability puts me off but not as much as a tepid ass response that tries to downplay the severity of a really bad problem.

That makes me consider the software radioactive.

KeePass (and the forks like KeePassXC) doesn't try to autofill passwords. There's a separate browser plugin (different download, not installed or recommended by default) for KeePass that did, and that's where the vulnerability was.

I was alluding to this when I said "slightly obscure". I still use KeePass, but not that plugin.

What about 1password?

I've used 1Password for years. I recommend it to orgs I work with.

KeePass is a free software, not a service that generates revenue. Why would you expect a free software developer that is entirely funded by donations (which most likely won't even cover development costs) to pay 10,000$ to a security researcher finding a bug in their software or you will stop using their software? This is completely unrealistic. Bugs happen, free software exists. You cannot stop using all free software that had a security bug in the past that wasn't awarded with 10,000$.

I didnt say I did expect bounties from them. I just said I'd avoid using this software.

The fact remains that autofilling passwords in-browser has a gargantuan attack surface and hence the potential to go very wrong. You have to really trust whichever software you use for this.

I expected better from lastpass because I used to give them actual money. I'm not upset that some random keepass extension did this but I also wouldnt use it either.

KeePass doesn't come with the browser plugin, BTW. It's a separate, optional download.

I know.

Important to note that KeePass itself does not have an official browser plug in, all plug-ins are 3rd party and none have large commercial backing.

Several browser plug-ins are available as well as simpler solutions like a browser extension to insert the URL in the title bar and sending keystrokes to the browser to populate it.

That is a very good point. I am not sure that lack of official browser extension is a good thing though. I typically enjoy when software has a large community creating plug-ins, but maybe not when it comes to password managers.

Password manager browser extensions provide a large attack surface. They also break the browser sandbox. I wish there were a good solution

https://lock.cmpxchg8b.com/passmgrs.html

> I wish there were a good solution

The answer is right there in the article: Use the browser's password manager.

I find Firefox's password manager + Sync a good solution, and I don't understand why people don't advocate it more. It's free and open source. Mozilla is a reputable software house with a good security team. Their revenue stream does not depend on you paying for the password manager. It doesn't even depends on monetizing your personal information.

Yesterday I found it even works as a password store for all of iOS.

How do you manage passwords for things outside of the browser?

On iOS, opening up saved passwords just uses firefox's password manager. On the desktop, I just open up firefox's password page. It's always running anyway.

It works just like another password app.

Sorry for being obtuse, but FF only allows me to put in a website to save passwords. How would I use this for an extra-browser application (steam for example)?

just put "steam" in the url?

KeePass is open source. Who would pay?

Reply on news.ycombinator.com