Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security IT

Data of 2.4 Million Blur Password Manager Users Left Exposed Online (zdnet.com) 60

Posted by msmash from the security-woes dept.
Abine, the company behind the Blur password manager and the DeleteMe online privacy protection service, revealed on Monday a data breach impacting nearly 2.4 million Blur users, ZDNet reports. From the report: The breach came to light last year, on December 13, when a security researcher contacted the company about a server that exposed a file containing sensitive information about Blur users, an Abine spokesperson told ZDNet via email. The company said it followed this initial report with an internal security audit to determine the size of the breach. The audit concluded last week, and the company made the data leak public on Monday in a post on its blog. The data that was available on the web included each user's email addresses, some users' first and last names, some users' password hints but only from our old MaskMe product, and each user's encrypted Blur password.
This discussion has been archived. No new comments can be posted.

Data of 2.4 Million Blur Password Manager Users Left Exposed Online More

Data of 2.4 Million Blur Password Manager Users Left Exposed Online

Comments Filter:

  • Ouch (Score:5, Insightful)

    by b0bby ( 201198 ) on Thursday January 03, 2019 @11:22AM (#57898392)

    Every time I see a breach like this, it makes me glad I'm still using KeePass. The ease of use of LastPass is tempting, but these kinds of services are a very large target.

    • Re: (Score:1)

      by Anonymous Coward

      Every time I see a breach like this, it makes me glad

      ... that I don't use most forms of online service, because a) I refuse to give someone my information like that, and b) I assume the people who run these services are drooling idiots and greedy assholes who don't know or care about security.

      I've pretty much reached the point where if it's an on-line service and wants my information, I won't use it.

      The ad revenue of someone who isn't qualified to safeguard my data isn't my problem, and not using these thi

    • Re: (Score:2)

      by paulxb ( 784917 )
      https://bitwarden.com/ [bitwarden.com] is the same as LastPass but you can host it yourself.
    • Please recommend a password manager.

      I wish open-source programmers would be more careful about choosing names. Keepass sounds like "Keep Ass".

      Information about Keepass: KeePass Password Safe [keepass.info]

      Does Keepass synchronize across devices? [sourceforge.net]

      • Re: (Score:2, Informative)

        by Anonymous Coward

        I use Password Store, or just "pass" for short.

        Completely free, no cloud, no GUI. Passwords are stored locally and are encrypted with GnuPG, so you can choose your own cipher and strength instead of trusting someone else's defaults. Passwords can be copied to clipboard with the '-c' argument. It even can integrate with git so you can keep your passwords managed in a version control.

        https://www.passwordstore.org/

        Whenever I need to access my passwords remotely, I just use SSH. Easy enough.

        • Re: (Score:2)

          by higuita ( 129722 )

          + 1 for this one

          It works very well, it is simple, you can push it to git and even share with others (recommended different password stores for personal and shared passwords, of course, so you share only the correct one)

          • Re: (Score:3)

            by higuita ( 129722 )

            i also use password hasher plus [github.com] for sites, to generate random passwords/key based on a master password and site info ... you only need to backup the password/key to restore the passwords

        • Re: (Score:2)

          by Average ( 648 )

          +1 for 'pass' (also sometimes referred to as "zx2c4 pass").

          Version controlled password vault is great.

          I use 'passmenu' as an extension. Emulates a keyboard, so it doesn't wipe out my copy/paste buffer.

          It's all GnuPG and Bash underneath. And I use a YubiKey to hold my GnuPG private key (and also my SSH private key, which I use to pull from Git, where I have the password vault archived).

          Also works pretty well in a team mode, at least to a certain scale. My work team (4 people) has a 'pass' vault together.

      • What about KeepassX? [keepassx.org]

        Or KeePassXC Password Manager? [keepassxc.org] Question: keepassxc ... can we trust it ? [reddit.com]

        KeePassXC for Beginners [medium.com] says "Android users, consider KeePassDroid [google.com].
        iPhone users, consider MiniKeePass [apple.com]".

      • Well, I wouldn't trust anything that's in the cloud.

      • Re: (Score:2)

        by brunes69 ( 86786 )

        KeePass is simply a spec and standard for a password vault, with many many software implementations. A lot of those implementations support synching your wallet to either public or private clouds.

        The way I use KeePass is I keep my wallet synched to my Google Drive account, which is in turn of course protected by 2FA.

        I can then load said wallet on Android, IOS, in my browser, and via local apps in OSX and Windows, because all of these platforms have KeePass apps that support Google Drive sync. Don't like Goo

    • Re:Ouch (Score:4, Interesting)

      by ctilsie242 ( 4841247 ) on Thursday January 03, 2019 @12:46PM (#57898886)

      I like using multiple PW managers:

      1: For the average website, I use LastPass. It is good enough, and actually has been hacked before, with the attacks mitigated by the fact that the data is never available unencrypted on their site. It has MFA, so an attacker would have to compromise a smartphone, and know my PW to get in. I always have MFA on, so even if LastPass is compromised, the attacks will

      2: For my 2FA seeds, I use a program like enPass, or Codebook. mSecure, and 1Password are others, but mSecure and 1Password require a subscription and/or accounts with the respective companies, while enPass and Codebook, you pay for once, and you don't have to give them any personal details. These get synced with Dropbox or Google Drive, so an attacker would have to compromise that account (which is 2FA protected), then figure out the 64+ character password used for the data. Not impossible, but good enough. I use multiple programs, as enPass and Codebook allow exporting the seeds to plaintext as well as syncing.

      I will also mention SafeInCloud as well, where it costs just one fee, and that's it.

      3: For stuff that actually has to be secure and doesn't go to the cloud, I use KeePass with a passphrase and a keyfile. The keyfile is stored on an encrypted USB drive, and never leaves that. For an attacker to obtain the KeePass data, they would have to have physical access, find the dongle, guess the 16 digit PIN in less than ten tries (as the USB drive erases itself after the tenth attempt), and guess the password. Again, it can be done, but it is a good defense against most things.

      • 1Password doesn't require a subscription or an account. While the company is definitely pushing customers that direction, they haven't stopped selling one-off licenses for the latest versions of their apps. About the only major features that non-subscribers are missing are the ability to sync via 1Password's cloud service and the ability to manage vaults for teams/families. They still have locally-stored vaults with the option to manually sync via Wi-Fi or automatically sync via Dropbox/iCloud.

        • That is good. When AgileBits came out with a version forcing people to their cloud, I dropped them like a hot rock. I used to swear by them before they did that one.

    • RoboForm > Keepass.....
  • It's one thing when some hotel reservation site does an oopsie with your passwords. This is another level.
  • in action.
  • Anyone who uses a "clown" based product to store sensitive passwords must have a blurred mind. Password managers should be local only. If they need to "stink" with other devices, they can do so locally via WiFi, not "stink" via some random corepiration's "clown."

    • The ironic thing is that password managers can be made secure:

      1: Use a DB format that stores a master encryption key... which is then has multiple entries that are public key encrypted, so any device with its private key can unlock the master key and decode things.
      2: Each endpoint generates and uses its own public/private keypair. When one adds another machine (computer, phone, tablet), it is "introduced" to it by another device adding the new device to the list.
      3: Recovery can be done by adding a recov

    • Re: (Score:2)

      by Ksevio ( 865461 )
      Did you have a stroke or something? Seems you're forgotten how to spell common words.

      Anyways, your idea sounds great for someone that never uses devices outside of their home!

  • The company stressed that no passwords stored inside users' Blur accounts were exposed.

    "We do not have access to your most critical unencrypted data, including the usernames and passwords for your stored accounts, your autofill credit cards, and so on. As frustrated as we are right now, we are glad that we have taken that approach," said Abine.

    So they may be big screwups, but they're not colossal screwups.

  • And nothing much will happen (Score:5, Insightful)

    by OneHundredAndTen ( 1523865 ) on Thursday January 03, 2019 @12:16PM (#57898690)
    We keep hearing about similar breaches, over and over again, and nothing much ever happens. It seems to be the case that it is actually cheaper for companies to do damage control than to take the necessary security measures to prevent such breaches in the first place. I am sure that a few heads rolled in Equifax after their breach a few years ago - but Equifax is still there, doing what it has always done. They sure took a hit - but they probably calculated that dealing with such hits is cheaper and simpler than implement an effective security policy. No wonder most companies pay lip service to security: they all claim it is very important, but they do less than as little as possible. Until such breaches have a significant impact on their bottom line, things will not change.
  • Ok so only your email name and password hints were lost. All the bad guys need to send out a barrage of very convincing targeted phishing emails asking users to update their master passwords. As soon as they fall for this all their accounts are toast.

    • Ok so only your email name and password hints were lost. All the bad guys need to send out a barrage of very convincing targeted phishing emails asking users to update their master passwords. As soon as they fall for this all their accounts are toast.

      honestly having a password hint compromised is a fairly big deal. a) people suck a hints "Password is my name backwards with a 3" and b) yeah you can use those hints to create more realistic phishing sites.

Slashdot Top Deals

E = MC ** 2 +- 3db

Close