LastPass hacked Again

[ajf.350d]

Would you mind me asking - why aren't you all-in on Keychain OR Bitwarden? @ajf.350d

iCloud for Windows lets you access Keychain passwords while in a Windows web browser.

How do you segregate the use of Keychain and Bitwarden?

Fair point, I probably ought to.
I couldn’t get iCloud passwords to work within the Windows app, and after various searches I’m not the only one.
So I had to switch to BitWarden for that part.
I’d already moved most stuff into Keychain though and it does work smoother with Apple, which is what I mainly use, so decided to just stick with the two.
I rarely add new accounts that need to be in both so, so far, it has worked OK.

Not ideal, but not unworkable for me at the moment.
If I had to use Windows again more often I would probably move everything into BitWarden though.

 

[StellarVixen]

There was a debate going on in my mind some time ago about convenience of password manager like that vs. inconvenience of managing passwords on my own.

I chose inconvenience.

 

[SalisburySam]

There was a debate going on in my mind some time ago about convenience of password manager like that vs. inconvenience of managing passwords on my own.

I chose inconvenience.

I chose convenience. Still use 1Password in the v7 version that remains NOT a subscription but still is $34/year. Works.

 

[maflynn]

use 1Password in the v7 version that remains NOT a subscription but still is $34/year.

I don't think I've had enough coffee this morning. You're saying version 7 is not subscription but you pay 34 dollars a year? I'm confused, that sounds awfully like a subscription.

 

[SalisburySam]

I don't think I've had enough coffee this morning. You're saying version 7 is not subscription but you pay 34 dollars a year? I'm confused, that sounds awfully like a subscription.

Well, when you look at it like that…. Yeah, could be called a subscription but it’s more like the historical process of requiring a payment for an upgrade to a new release vs. an update to a dot release. But OK, I like your thinking better.

 

[AT76]

I've decided to leave Lastpass and give Bitwarden a try.

 

[Choco Taco]

I've decided to leave Lastpass and give Bitwarden a try.

It's 800 times better, if my math is correct.

 

[KaliYoni]

Revelations about LastPass keep getting worse and worse. Some choice quotes from a recent article on Krebs on Security:

a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults[...]the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments.

while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum.

Palant believes LastPass also failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years.

for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000[...]Palant said the 2018 change was in response to a security bug report he filed about some users having dangerously low iterations in their LastPass settings.

“Worse yet, for reasons that are beyond me, LastPass didn’t complete this migration,” Palant wrote. “My test account is still at 5,000 iterations, as are the accounts of many other users who checked their LastPass settings. LastPass would know how many users are affected, but they aren’t telling that. In fact, it’s painfully obvious that LastPass never bothered updating users’ security settings. Not when they changed the default from 1 to 500 iterations. Not when they changed it from 500 to 5,000. Only my persistence made them consider it for their latest change. And they still failed implementing it consistently.”

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

 

[laptech]

Revelations about LastPass keep getting worse and worse. Some choice quotes from a recent article on Krebs on Security:

a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults[...]the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments.

while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum.

Palant believes LastPass also failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years.

for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000[...]Palant said the 2018 change was in response to a security bug report he filed about some users having dangerously low iterations in their LastPass settings.

“Worse yet, for reasons that are beyond me, LastPass didn’t complete this migration,” Palant wrote. “My test account is still at 5,000 iterations, as are the accounts of many other users who checked their LastPass settings. LastPass would know how many users are affected, but they aren’t telling that. In fact, it’s painfully obvious that LastPass never bothered updating users’ security settings. Not when they changed the default from 1 to 500 iterations. Not when they changed it from 500 to 5,000. Only my persistence made them consider it for their latest change. And they still failed implementing it consistently.”

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

I sense law suits coming from lastpass customers who have had their crypto accounts hacked and the currency stolen.

 

[gwhizkids]

I sense law suits coming from lastpass customers who have had their crypto accounts hacked and the currency stolen.

I sense an impending bankruptcy.

 

[SalisburySam]

I sense an impending bankruptcy.

I see dead companies.

 

[maflynn]

I sense an impending bankruptcy.

Nah, there's already a class action lawsuit and it will be settled at a dollar amount that will hurt but not kill lastpass and it will only benefit the lawyers.

 

[rhett7660]

It's 800 times better, if my math is correct.

I checked your number... seems legit.

I have been extremely happy with Bitwarden. No complaints.

 

[Lioness~]

Sure 1Password is subscription, but subscriptions are part of life now. We have to accept it, and chose what is worthwhile for us.

Security is super important, and it’s a great app, and worth it for me. Think it was on some discount a few yrs as well.
I have a bunch of subscriptions, and when I end one usually another one starts.
When I ditched Apple Music that I found overpriced for me, I started YouTube which is way more worth it in my opinion.

 

[gregmac19]

Sure 1Password is subscription, but subscriptions are part of life now. We have to accept it, and chose what is worthwhile for us.

You don't need a subscription to have a secure password manager solution. I use Codebook, which does not offer subscriptions, and keep my password vault only on my computer and offline backups. This setup is at least as secure as anything else.

And I don’t feel I have to accept that software subscriptions are “part of life.” The only thing I have a subscription for is my secure email account.

 

[AZhappyjack]

Nah, there's already a class action lawsuit and it will be settled at a dollar amount that will hurt but not kill lastpass and it will only benefit the lawyers.

Isn't that true of all class action suits? Class members get a pittance and the lawyers cash in.

 

[chrono1081]

I have become less confident with Apple Keychain since reading about the iPhone vulnerabilities.

Apple Responds to Report About Thieves Spying on iPhone Passcodes to 'Steal Your Entire Digital Life'

An in-depth report published today by The Wall Street Journal's Joanna Stern and Nicole Nguyen highlights instances of thieves spying on a...

www.macrumors.com

"To make matters worse, knowing an iPhone's passcode allows a thief to use Apple Pay, send Apple Cash, and access banking apps using passwords stored in iCloud Keychain."

It seems that the more secure approach is to use a password manager that has a different passcode than the one that accesses the iPhone, and to not store sensitive info in Apple Keychain on the iPhone.

It doesn't mean you shouldn't trust it. If someone has your password for anything yes, they can do damage. This is why you use stuff like FaceID (where you actively have to look at your phone to unlock it) in a public place and mind your surroundings, also set a password with more complexity.

Not trusting keychain because someone watched you type your password on your phone and stole it is akin to not trusting ATMs because someone watched you type your pin in and stole your card.

 

[Lioness~]

You don't need a subscription to have a secure password manager solution. I use Codebook, which does not offer subscriptions, and keep my password vault only on my computer and offline backups. This setup is at least as secure as anything else.

And I don’t feel I have to accept that software subscriptions are “part of life.” The only thing I have a subscription for is my secure email account.

Each to their own - what saves time and is secure for me is worth money too 😉
Having an app that I can trust and provide what I pay for and are dedicated to their work, is definitively worth it to me.

 

[mailbuoy]

It doesn't mean you shouldn't trust it. If someone has your password for anything yes, they can do damage. This is why you use stuff like FaceID (where you actively have to look at your phone to unlock it) in a public place and mind your surroundings, also set a password with more complexity.

Not trusting keychain because someone watched you type your password on your phone and stole it is akin to not trusting ATMs because someone watched you type your pin in and stole your card.

I don't disagree that the risk of loosing your iPhone and its PIN/passcode is controllable. However, in the worst case scenario, your iPhone plus your phone PIN/passcode can lead to being locked out of your phone, iCloud account and every account for which you have a password in keychain; potentially it could lead to identity theft depending on what info you have in your phone.

In your ATM example the risk is limited - most likely nothing, if you report the card's compromise to your bank.

 

[SalisburySam]

Isn't that true of all class action suits? Class members get a pittance and the lawyers cash in.

Only if they ”win.” If they don’t, then there’s nada.

 

[maflynn]

Isn't that true of all class action suits? Class members get a pittance and the lawyers cash in.

Yes, that's my point. Most class action suits do very little to make the injured party whole again.

 

[SalisburySam]

To actually be made whole, an injured party must skip the class action and sue directly, win, and then be granted enough compensation to overcome the perceived loss, and have the ability to actually collect. And do it again should the defendant appeal. And possibly again. While all this goes on, the injured is also likely paying their lawyer(s) out of pocket as otherwise they’re doing a lot of work for free. And this could easily take years. Given this, the class action is attractive.

Class action suits serve two purposes: changing defendant behavior by making it very expensive for a company to continue that behavior, and ensuring great wealth for the lawyer team should they win. There is little-to-no benefit for any injured individual beyond a token “thanks for playing” and MAYBE a tiny (think well under $100) cash settlement. Members of the class (the victims) aggregate themselves because there is no downside, a very tiny upside, they don’t have to do anything, they don’t have to pay lawyers, and they MIGHT be able to altruistically alter a market-offending behavior.

 

[maflynn]

Class action suits serve two purposes

I think in this case its less about changing the behavior and more about recouping lost monies.

 

[SalisburySam]

I think in this case its less about changing the behavior and more about recouping lost monies.

Exactly, and that’s a very unlikely outcome for the injured party with a class action.

 

[370zulu]

Each to their own - what saves time and is secure for me is worth money too 😉
Having an app that I can trust and provide what I pay for and are dedicated to their work, is definitively worth it to me.

Absolutely true!

Bitwarden Premium sub with Yubikeys here. Very inexpensive overall. Gives me peace of mind.