The LastPass Disclosure of Leaked Password Vaults Is Being Torn Apart By Security Experts (theverge.com) 78
Last week, LastPass announced that attackers stole customer vault data after breaching its cloud storage earlier this year using information stolen during an August 2022 incident. "While the company insists that your login information is still secure, some cybersecurity experts are heavily criticizing its post, saying that it could make people feel more secure than they actually are and pointing out that this is just the latest in a series of incidents that make it hard to trust the password manager," reports The Verge. Here's an excerpt from the report: LastPass' December 22nd statement was "full of omissions, half-truths and outright lies," reads a blog post from Wladimir Palant, a security researcher known for helping originally develop AdBlock Pro, among other things. Some of his criticisms deal with how the company has framed the incident and how transparent it's being; he accuses the company of trying to portray the August incident where LastPass says "some source code and technical information were stolen" as a separate breach when he says that in reality the company "failed to contain" the breach. He also highlights LastPass' admission that the leaked data included "the IP addresses from which customers were accessing the LastPass service," saying that could let the threat actor "create a complete movement profile" of customers if LastPass was logging every IP address you used with its service.
Another security researcher, Jeremi Gosney, wrote a long post on Mastodon explaining his recommendation to move to another password manager. "LastPass's claim of 'zero knowledge' is a bald-faced lie," he says, alleging that the company has "about as much knowledge as a password manager can possibly get away with." LastPass claims its "zero knowledge" architecture keeps users safe because the company never has access to your master password, which is the thing that hackers would need to unlock the stolen vaults. While Gosney doesn't dispute that particular point, he does say that the phrase is misleading. "I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted."
Palant also notes that the encryption only does you any good if the hackers can't crack your master password, which is LastPass' main defense in its post: if you use its defaults for password length and strengthening and haven't reused it on another site, "it would take millions of years to guess your master password using generally-available password-cracking technology" wrote Karim Toubba, the company's CEO. "This prepares the ground for blaming the customers," writes Palant, saying that "LastPass should be aware that passwords will be decrypted for at least some of their customers. And they have a convenient explanation already: these customers clearly didn't follow their best practices." However, he also points out that LastPass hasn't necessarily enforced those standards. Despite the fact that it made 12-character passwords the default in 2018, Palant says, "I can log in with my eight-character password without any warnings or prompts to change it."
Another security researcher, Jeremi Gosney, wrote a long post on Mastodon explaining his recommendation to move to another password manager. "LastPass's claim of 'zero knowledge' is a bald-faced lie," he says, alleging that the company has "about as much knowledge as a password manager can possibly get away with." LastPass claims its "zero knowledge" architecture keeps users safe because the company never has access to your master password, which is the thing that hackers would need to unlock the stolen vaults. While Gosney doesn't dispute that particular point, he does say that the phrase is misleading. "I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted."
Palant also notes that the encryption only does you any good if the hackers can't crack your master password, which is LastPass' main defense in its post: if you use its defaults for password length and strengthening and haven't reused it on another site, "it would take millions of years to guess your master password using generally-available password-cracking technology" wrote Karim Toubba, the company's CEO. "This prepares the ground for blaming the customers," writes Palant, saying that "LastPass should be aware that passwords will be decrypted for at least some of their customers. And they have a convenient explanation already: these customers clearly didn't follow their best practices." However, he also points out that LastPass hasn't necessarily enforced those standards. Despite the fact that it made 12-character passwords the default in 2018, Palant says, "I can log in with my eight-character password without any warnings or prompts to change it."
phestival of pwnage (Score:1)
Re: (Score:3)
Slashdot editor, twice.
FREE means you are the product (Score:3)
Never understood why people used it either. These are your most important items. Why trust a second rate company with them?
Re: (Score:2)
Re:FREE means you are the product (Score:5, Informative)
FREE means you are the product
Not necessarily. I use KeepassXC and keep the database on my google drive. KeepassXC is free and opensource and there is an android app and plugins for all the major browsers. I don't know about the apple world. Yes I have looked at the code (at least for the desktop version, admittedly not the phone version) and am pretty sure that it doesn't do anything nefarious.
Re: (Score:2)
Indeed if that mantra is true, then what does that make open source users?
Re: (Score:2)
> Indeed if that mantra is true, then what does that make open source users?
Anarchocommunists.
Re: (Score:2)
Re: (Score:2)
The difference here is it's not a service. You are basically running the service yourself. FOSS is a slightly different animal since the maintenance cost can be zero (and is usually extremely low even if not zero).
But LastPass is a service. They are providing hardware and bandwidth which carry ongoing expenses. To whit, according to their privacy policy [lastpass.com] they are absolutely using your data to make money through advertising/tailored promotions.
=Smidge=
Re: (Score:2)
For some reason people don't understand security stuff like this. Even on Slashdot, where you might expect people to know the basics, your read dozens of confused posts about password managers and 2FA.
LastPass's product is convince. People who don't know better have a simple solution that claims to be secure, and to be fair they are probably not in a position to evaluate that claim and the ones made by rivals.
Hopefully this is the end of LastPass, but the real issue is helping people understand this stuff.
Re:FREE means you are the product (Score:4, Insightful)
Like the saying goes, the cloud is just another name for someone else's computer.
Re: FREE means you are the product (Score:1)
Just like an application. I'm sure this was a front-end breach like a web injection or something. So storing sensitive info on a web application is exactly like putting it on someone else's computer I agree.....
Re: (Score:2)
Like the saying goes, the cloud is just another name for someone else's computer.
Or even, the cloud is your data in the hands of someone else's incentives.
Re: (Score:3)
And the internet is someone else's equipment. Tell us something useful.
Re: (Score:2)
The point is don't store anything import on equipment out of your control.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Never understood why people used it either. These are your most important items. Why trust a second rate company with them?
I understand why people used them back before Chrome and Safari added built-in password managers that sync passwords across devices, but I have no idea why anybody uses any of them now. The most secure solution will almost always be the one that's designed by companies that have spent decades building software and hardware used by billions of users, rather than companies that build a single app used by millions.
I stopped using this garbage service almost 10 yrs (Score:2)
Re: (Score:2)
Example: https://bitwarden.com/blog/hos... [bitwarden.com]
Re: (Score:2)
Is there any reason to believe that Bitwarden is more secure than other options?
Re: (Score:2)
Is there any reason to believe that Bitwarden is more secure than other options?
Aside from the fact that AFAIK it doesn't have a laundry list of breeches, no. On the other hand, apparently you can set up your own server vault somehow. I haven't looked into that yet. One thing about Bitwarden as opposed to Lastpass is it has seemingly bad form support. For example, in Brave on iOS you have to go to a share menu and scroll down, copy usernames and passwords separately, and then paste them into the fields. Lastpass puts up a "passwords" prompt or something and does it more straightforward
Re: (Score:3, Funny)
1. Don't store it on your PC at all. Hackers can penetrate windows.
2. Don't write it down on a physical piece of paper a burglar could find it.
3. Don't memorize it, someone could compel you by torture.
4. Don't use biometrics, someone could chop your finger off.
5. Don't use your phone someone could clone your SIM.
Did I miss any chicken little?
Re:I stopped using this garbage service almost 10 (Score:4, Funny)
Don't store it in your head. Elon Musk could get it. [theguardian.com]
Re: (Score:1)
1: your bitwarden is not setup properly. logging into a site, even with 2FA, takes 1 click, 1 paste, and another click. thats it.
Their self-hosted stack is the worst abomination of software abuse I have seen ever though. MSSQL: + .NET on linux in docker.
Re: (Score:2)
> Is there any reason to believe that Bitwarden is more secure than other options?
Depends if you think Open Source is a disaster of easy-to-find bugs or a many-eyes-make-light-work triumph.
One thing that's for sure is it's much easier to hide backdoors in secret code.
And BitWarden does not store URL's plaintext like Lastpass, so the metadata problem is much better.
Re: (Score:2)
It's not that a group of people in a corporate structure can't write secure code, it's that they choose not to incentivize it, and often punish people who spend extra time making sure their code is secure (ie, "why are you taking so long?").
won't change the users (Score:2)
Re: (Score:2)
So what's the alternative? Something my mother can figure out without calling me and my brother every time it doesn't work flawlessly? Solutions like Lastpass and their brethren are secure enough and work 99% of the time for the majority of their target audience. And at least I have a tiny shred of confidence that they are above board when breaches occur, so I can go change the 10 "critical" passwords (banking, retirement, e-mail, etc.) in a timely manner and move on with life.
That being said, in a corpora
Re: (Score:2)
True believers. The very worst version of clueless and arrogant. These people are incapable of even pereciving they could be wrong or having made a mistake. So the defend their flawed choices to the very end. Kind of like COVID-deniers that claimed COVOD does not exist until the very moment it killed them.
This is why 3rd party storage is "Bad" (Score:4, Insightful)
This situation is a great example of why 3rd party storage of your personal information, encrypted or not, is usually a "bad thing". No one knows just what was compromised, nor will anyone have anyway of knowing if their vault was cracked up and to the point where accounts start getting taken over.
Maintain control of the infrastructure and, ideally, keep it offline.
Re: (Score:2)
Maintain control of the infrastructure and, ideally, keep it offline.
That's nice dear. What happens when you find you need a password when you're away from home?
Re: (Score:3)
Re: (Score:2)
Memorizing password is the worst possible advice you can give someone. Storing them offline is close second.
Re: (Score:2)
Memorizing password is the worst possible advice you can give someone. Storing them offline is close second.
100% the above. Anyone who claims having users memorize passwords is effective hasn't worked in security or ever tried cracking a real PW database. All most users do is make simple passwords and increment them (Password1, Password2), or reuse the same ones over an over. They will usually forget complex passwords regularly -- even "smart" people like MIT grads need password resets regularly.
In terms of storing them offline, that might sound nice but it is horribly slow and impractical. Users retyping
Re: (Score:2)
100% the above. Anyone who claims having users memorize passwords is effective hasn't worked in security or ever tried cracking a real PW database. All most users do is make simple passwords and increment them (Password1, Password2), or reuse the same ones over an over. They will usually forget complex passwords regularly -- even "smart" people like MIT grads need password resets regularly.
I agree. But I wonder if we still mean 'password' in this context. Its more like an authentication token. It isn't 'a word that you use to pass security' anymore. It isn't something you have to, or should, remember.
Its something thats generated for you, associated with a particular purpose in an automated storage system, recalled from that storage system for you and pasted into a field. You never get to, nor should have to, see the 'password' at all.
So is it still a password?
And, if it isn't a password any
Re: (Score:2)
Perhaps there could be a word dubbed for "unique
Re: (Score:2)
Is there such a thing as a cellphone that's reliably offline??
Re: (Score:2)
Re: (Score:2)
Depends on the situation. In my case, if I'm not anywhere I can properly access my server then I live without it.
I don't really need anything with that level of immediacy if I'm away from my normal equipment, and I'd bet that applies to most folks.
Re: (Score:3)
Re: This is why 3rd party storage is "Bad" (Score:2)
Re: (Score:2)
Phones are still the weak link VPN or not. Plus you're putting faith in their being no problems on the other end as well as always on connectivity all along the chain.
Re: (Score:3)
Maintain control of the infrastructure and, ideally, keep it offline.
That's nice dear. What happens when you find you need a password when you're away from home?
VPN in to infrastructure you control.
Keep a cached copy on your mobile device that is refreshed manually occasionally?
There are solutions for this that aren't "trust someone else who is a massive target".
Re: (Score:3)
Re: (Score:3)
So very very true.
I've been using a password wallet that is stored locally on my server at home (non-accessible from the Interwebz) and on my mobile device - it uses a sync I can kick off to synchronize the files. I know that if someone gets hold of either of those files they're likely not strongly encrypted enough to survive a brute force, but at least someone would need to be targeting me specifically which ... I'm not really worth their time (most likely) if the files aren't picked up in a mass online
Re: (Score:2)
Out of curiosity, what program/wallet are you using that allows for such easy local syncing between PC and mobile?
Not the first time, not the last (Score:4, Informative)
It's happened again and again, don't trust these guys:
https://www.zdnet.com/article/... [zdnet.com]
https://www.wired.com/2015/06/... [wired.com]
It's what happens when corporate structure doesn't incentivize secure programming practices. I'll bet they have a bug tracker overflowing with bugs.
Re: (Score:2)
Even if you want to write secure code, if your manager gets upset at you for fixing bugs, then it's not going to happen.
Re: (Score:2)
Even if you want to write secure code, if your manager gets upset at you for fixing bugs, then it's not going to happen.
Because the managers KPI and bonus doesn't depend on the outcome of the pen tests.
If it did then they'd be begging for secure code practices.
To fix this, you need to go where those performance metrics are being set.
You can bet that the C level execs who set these are saying "security is number one priority" but still failing to set motivational performance metrics on the managers etc.
Re: (Score:2)
You need to look at what is actually being incentivized, and change that accordingly.
Roll your own (Score:3)
LastPass has had a total of 7 data breaches. Better to use a local password manager like Keepass. You control the vault, not some third party firm that can't seem to do a very good job of it.
Re: (Score:2)
To be fair, they seem to be about level with Microsoft on security. And almost everybody uses Microsoft, so they probably figured that is good enough.
Re: It's named wrong (Score:2)
Last gasp always makes me think of the acronym for a fictional euthanasia charity:
Legal And Social Transition to a Government Assisted Suicide Program.
Call now to donate or be put through to our qualified, ahem, assistants.
online and offline attacks (Score:3)
Most lastpass users did not expect an off line attack on their passwords. My gut feeling is the median master password would be cracked with a dictionary* attack in under 35 bits (12 digits) of entropy.
* a dictionary for this type contains all the common words people use along with all the common letter/symbol substations, common capitalizations and common suffixes (symbol, number, number sequence...).
Re: (Score:2)
My password is 12 characters but a completely random set of characters. I think LastPass chose it for me. So it's not vulnerable to dictionary attacks.
Eventually, the technology will exist that can crack it. But not yet.
Re: (Score:2)
12 random characters would have 19,408,409,961,765,342,806,016 permutations. If they can indeed do a hundred billion attempts per second as the grandparent suggested, then we're looking at 6154 years to be certain of guessing your password, or a mere 3000 years to have a 50% chance of guessing it.
That sounds like a long time, but if they can do that simultaneously on all 30 million accounts LastPass supposedly has then they'll unlock about 5000 accounts every year. Sounds pretty valuable.
Re: (Score:2)
but if they can do that simultaneously on all 30 million accounts LastPass supposedly has
And which set of script kiddies has access to the kind of compute power that would be required to do such a thing? I will agree, yes, this is bad on LastPass. But from what the actual experts have said on this (because I doubt too many of the armchair security analysts that troll Slashdot have an actual clue) it's not that big of a deal. The advice from them ranges from "don't worry about it, they'd need 100 lifetimes to get at your actual information." to "change your vault password and any critical pass
Re: (Score:2)
And which set of script kiddies has access to the kind of compute power that would be required to do such a thing?
'Script kiddies' are largely a thing of the past. These days we have organised crime and state actors to worry about more.
Re: online and offline attacks (Score:1)
Re: online and offline attacks (Score:1)
Private Equity Scumbags (Score:2)
Just a reminder that LastPass bought got by LogMeIn 7 years ago (since when it has numerous security breaches) and 2 years ago LogMeIn got bought by a private equity company. They don't give a single crap about you as the user except how to squeeze as much money out of you as possible by selling all your info. Move to 1Password, BitWarden, or (if you can handle some manual lifting) KeePass.
Since you have to consider anything password at LastPass compromised, this is a great time to switch as long as you h
A result of the bait and switch. (Score:2)
LastPass recently enabled "passwordless" (Score:1)
The one part missing (Score:1)
Note that Last Pass put up a recent blog about the incident Here [lastpass.com]
The key bits that puzzle me are these:
Re: The one part missing (Score:1)
The 2FA basically authenticates you against an organizational store which then releases a second âoepasswordâ. So you have your own memorized password, combined with an organizational password. If you paid for LastPass Enterprise, the authentication happened somewhere else (SAML) and LastPass has no access to âyour keysâ(TM). Without the organizational keys, you only have access to a âpersonalâ(TM) vault, not the âenterpriseâ(TM) vault.
Re: (Score:1)
Re: (Score:2)
The first part is just bullshit trying to confuse the issue. They could easily have given details, in particular _where_ thwse "two or more" secrets reside. They did not and that is a clear indicator this does not actually help.
As to their future, well they apparently got hacked 7 times so far. This time the attackers apparently did not get everything, but next time they may well do. This company has disgraced itself basically to the maximum level possible for a vendor of security software. Since they have
Willie Sutton (Score:2)
"I rob banks because that's where the money is." --Willie Sutton.
A single place with millions of passwords is a much more lucrative hacking target than my personal machine with just a few passwords. The whole idea of a password manager is flawed.
Re: (Score:2)
Not so. But it is flawed when it is phoning home and doing online backups to the vendor.
Fool me once... (Score:2)
Apparently, these cretins have been hacked 7 times so far. Bests stay away, this is crapware that can be avoided easily. They probably though doing security-software on the level of "security" that microsoft does was enough.