Slashdot Mirror
LastPass: Users Don't Have To Reset Master PWDs
CWmike writes "LastPass on Friday rescinded its day-old order that all users of its online password management system reset their master passwords due to a database breach. In a blog post this morning, the company said it won't allow users to change master passwords 'until our databases are completely caught up and we have resolved outstanding issues.' In an e-mail to Computerworld, LastPass CEO Joe Siegrist said the company changed its plan in response to demands from users asking they not be required to reset their passwords. However, comments posted on a LastPass blog suggest that the company's decision may also be related to trouble some users appear to be having with the password reset process. The blog post acknowledged that it had 'identified an issue' with roughly 5% of users that reset their master passwords. The company said it would be contacting those users about a fix for the problem LastPass said earlier that passwords for its Xmarks bookmark sync, which it acquired last December, were not affected."
Really, how many dozens of passwords and accounts am I supposed to have?
It's just trouble waiting to happen.
Can't we have a biometric identity verifier, or some unique token, or whatever?
I'm rather curious about how the site passwords are stored on this site. My assumption was the all the passwords were encrypted with the master password. If this is the case and only some of the passwords are encrypted with the new password because the databases weren't "caught up" or if someone forgets their master password and needs a password reset then wouldn't the account be unrecoverable?
...but am I the only one who is very hesitant about storing my precious passwords "in the cloud"? I use this gvim gpg plugin to encrypt my passwords, on my own terms, and I make them accessible to myself by any number of ways that I control.
Is this so incredibly difficult to do for most people that they must depend upon others to maintain their personal data?
The whole concept of this system screams "bad idea" to me. Of course, I said the same thing about Hushmail, and even after the DEA demonstrated why Hushmail was a bad idea people continued to use and even recommend it.
Palm trees and 8
TFA says .5%, not 5%.
This and other recent "breaches" pretty much show that for the preset (anyway), storing critical information "in the cloud" is neither secure nor reliable.
Certainly, high traffic web serving can benefit from "The Cloud", especially for those that don't have the money to support the kind of hardware and infrastructure.
But highly valuable and/or proprietary corporate or personal information? Nope...
If you want news from today, you have to come back tomorrow.
While the implementation was always questionable what stops the DEA from using Microsoft or some other vector to compromise your security? Besides that we in theory should be protected from such actions by the way that such actions are violating our rights (something to needing a warrant to search-and the government is conducting a massive search). The way it works is by sending an update to a program everybody uses and that update monitors every computer for which sites users visit and then return the IP for those users (with enough restrictions you will likely get only one) which match certain criteria.
This narrows it down to only providing the government with a single person (possibly). Millions might be searched in order to discover which person likely accessed a site. The compromised individual does have to repeatedly access the same site. That is likely though. Once they have an IP they can get a ?second? warrant for further investigation. Maybe the first one is sufficent. I guess it depends on what the exscuse is for the violation of all those users rights which you violated in order to get the IP of the individual you were after.
This is how the German authorities compromised the security of a user of an anonymity program similar to Tor. In that case they just made the authors of the anonymity program modify it and then when most users including the user they were after updated it they were screwed. Could this technique be used again? I don't see why not. It'll take a court ruling to smack it down. While this example was of someone targeted by German authorities and the company was located in Germany it likely wasn't legal. They still got away with it.
It isn't legal in the USA. At least in my view and hopefully that of every judge all the way up to the supreme court. I wouldn't for one second think that the US authorities wouldn't try it though and get away with it.
This might be a lack of understanding of the LastPass system on my part, but I'm not understanding why they are/were suggesting customers reset their master password. Surely, if this password decrypts a password safe then it is as, if not more, important to reset all passwords which were stored in the database.
Based on that description, it sounds like they are saying users don't have to change their master password because their systems can't keep up with load, rather than because they've proven that user data isn't at risk.
Government and police can access anything in your cloud and on your machine if they want to: they can put trojans and keyloggers into your software updates and downloads, and they can fake SSL certificates and decrypt your encrypted traffic. And they don't just do that in the US, they do it in many countries. To protect against government intrusion into your data is very hard. A service like Hushmail is probably more secure than almost anything you can do yourself, even on your own harddisk.
It isn't legal in the USA. At least in my view and hopefully that of every judge all the way up to the supreme court. I wouldn't for one second think that the US authorities wouldn't try it though and get away with it.
I'd be shocked if the US authorities could make a software vendor (or FOSS maintainer) modify code under court order. It screams first amendment (code is copyrighted speech after all). They could (potentially) bar a vendor or maintainer from announcing modifications to a code base (gag orders, etc.), but forcing them to make the modifications would be utterly unprecedented (to my knowledge).
I'd be shocked if the US authorities could make a software vendor (or FOSS maintainer) modify code under court order.
They don't have to. The feds can hire assembly programmers to patch binaries themselves. If they want to monitor a subject, they'll get an order that allows them to covertly break in, plant the modified binary on the target's computer, and leave; taking measures to ensure the subject won't be aware the FBI had visited their place.
Only works if they know who their target is. My parent discussed German authorities trying to find a user of an anonymity program. You're right that the point is moot if the investigators already know where to find the target.
First off you must trust the local system. If not then it can just use a keylogger to get your master password and then the hackers can just log into your account normally and read all your stored passwords. So why not do everything on the local system, and just use the server to store encrypted data? Generate a key, encrypt it with the passphrase, and encrypt the data. Send the encrypted key and data to the server. Whenever you add/remove/change a password just re-encrypt the data and send it to the server again.
Browsers these days should be plenty fast enough to encrypt a small amount of data like this, and it would mean the server wouldn't ever need to know any passwords or keys at all. You could even set it up like mailinator without accounts... after all a username and password is the same as "username password".
About the only problem is that somebody that knew your "username phrase" could brute force your main password offline, instead of being rate limited by asking the server. But this wouldn't be a problem with a strong password anyway. Also getting crypto right in with only floating point math...
There are two pretty fundamental problems with lastpass.
1. The stronger the security the less usable the system is. They could require two factor and one factor could be a username password pair where the password is at least 24 bytes, no two bytes in a row. The second factor could be an RSA token, or their grid system for one time pads seems pretty solid to me. AES-256 blockmode encrypt the users data as one big struct with those keys and you have a data store that even if becomes completely public is likely to stand up against any cryptographic or even bruit force attack no matter how long the attacker has to wait. Trouble while this would be secure it would be usable for many.
2. Because you can't do it right, in that someplace in the chain there has to be a key weak enough for typical humans to remember and a token easy enough to carry, last pass presents a target. Worse it presents a very valuable target.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Here's an idea/question: Why can't Lastpass generate strong temporary passwords and send that to users?
There was no confirmed breach just suspicious traffic.And a lot of media hype. Almost all media misquoted the incident so the hole incident sounds more exiting.
And even if there was a breach: Unlike almost all other Cloud services Lastpass encrypts all data client site. Either by plug-in or JavaScript. Without the master password data is useless.
And no: master passwords where not stolen — as the media tells everybody — if your master password is weak then someone might guess it.