Slashdot Mirror
LastPass Accounts Can Be 'Completely Compromised' When Users Visit Sites (theregister.co.uk)
Reader mask.of.sanity writes: A dangerous zero-day vulnerability has been found in popular cloud password vault LastPass, which can completely compromise user accounts when users visit malicious websites. The flaw is today being reported to LastPass by established Google Project zero hacker Tavis Ormandy who says he has found other "obvious critical problems". Interestingly, Mathias Karlsson, a security researcher has also independently found flaws in LastPass. In a blog post, he wrote that he was able to trick LastPass into believing he was on the real Twiter website and cough up the users' credentials of a bug in the LastPass password manager's autofill functionality. LastPass has fixed the bug, but Karlsson advises users to disable autofill functionality and use multi-factor authentication. At this point, it's not clear whether Ormandy is also talking about the same vulnerability.
All millennials suck. I hate millennial snowflakes. Just remember your damn passwords and you'll have no trouble. Fuck millennials and their lazy security. Die in a fire.
Well, that's the cloud for you. Stop connecting stuff that doesn't need to be connected.
The best firewall- route to null
Yeah most vapor is easily penetrable. Imagine what would happen to an airplane if it wasn't.
Would it really be incorrect to assume that keeping a local text file with your passwords is quite a bit more secure than anything in the Cloud?
“He’s not deformed, he’s just drunk!”
The entire "2FA" concept is simply an info grab masquerading as security theater. In what way is it supposed to improve my security by A: Giving a piece of information that is NOT strictly need-to-know to to some random weirdo on the Internet, and B: Tying the security of that thing to said third-party service?
This is not security. This is simply an attempt to grab information masquerading as security theater. Real security has always worked based on the premise that a piece of information exists that is known only to two parties. We call this a "password". If one is not good enough, you can add a SECOND password. This avoids the involvement of any third parties which can add more holes to the chain. It's quite common, for instance, for sites to include a security hole: That this password process can be bypassed through a "reset" procedure that essentially invalidates the entire security system and pushes the ultimate security off to some third-party site. Are THEY secure? Who knows...but probably not, since now you have all that information funnelled into that one email. It's a common practice upon compromising an email account to attempt to initiate a password recovery for that email account on any interesting sites to see if you get any recovery mails to them.
At that point your email-based "2FA" is totally worthless and more of a liability than if it was simply a non-automatically-recoverable password that wasn't stored anywhere, with no record of any association with an email address. Throwing in "phones" is even more obnoxious, because A: Not everyone has or desires to have a phone, as phones are a security breach that allows third-parties to remotely track and monitor your physical location at all times, and B: Phones are easily lost or stolen.
I think it's reasonable to say that I'm regarded as one of the more paranoid people around, and I say this entire business is simply a scam. They just want to steal your phone or another email so they can spam you.
You have got to be fucking kidding me. Whose idea was that? Even if you do a good job of it, it's still going to be an over-the-top, in-your-face, obviously stupid idea, self-parodying on the face of it.
Part of me insists that, therefore, this product must not have any users anyway.
And the other part of me knows that everyone-except-me is probably using it, because I live in a world gone mad. WTF is wrong with you people? Do you ever think about anything?!?
...is a notebook with usernames and passwords written down in it. Primarily because any system I use has to work on Linux, Mac, Windows, iOS, and Android.
I don't actually write down the password, but a description of it. "Usual, first letter cap, +9*3, without old First Sergeant's name" type of thing.
Best Slashdot Co
The headline says 'Lastpass accounts can be completely compromised'.
But this isn't a method of getting the Lastpass account password itself, its a way of getting passwords for specific sites that the malicious site is trying to get passwords for.
That isn't 'completely' compromising the Lastpass account.
In the free world the media isn't government run; the government is media run.
Remembering lots of passwords is not possible for most people.
Keeping all the passwords the same is not smart.
Using a password vault seems logical, except that any such vault is a huge target for hackers. Certainly any vault in the cloud is just a disaster waiting to happen.
Two-factor authentication is probably the best solution -- unless your phone is at the bottom of the river, or your employer puts you in a spot where phone service is non-existent, like the basement. Of course, for those of you who are doing everything via phone, these two arguments don't apply.
No method is perfect. In the end, each of us are left to work things out as best we can.
Proverbs 21:19
Password managers seem like an inherently terrible idea, particularly onlines ones.
Can someone explain to me why password hashers are not more common? I've used one for years and really can't understand why nobody else does. Take the master password, append (a portion of) the site's domain name, and hash to arrive at a random password. There's only one password to remember, you get a unique strong password for every website, and everything can be done offline without storing anything anywhere. There are extra refinements to create new passwords to replace e.g. compromised ones, or conform to the site's password length and other requirements, but they are trivial. Extensions are available for browsers and mobiles.
You can't shut us down! The Internet is about the free exchange and sale of other people's ideas!
Password managers be like, yo all eggs, meet one basket, dig?
So lastpass can be tricked to think he is on the real twitter page. Newsflash, so can a human. So the human will also enter his password on that page, no matter the password manager he use.
This problem isn't specific to LastPass. If a bogus site is masquerading as the real site, any system that doesn't have extensive site validation checks will fail, including and especially, remembering passwords.
This article is nothing but a sensationalist headline. The concept and reading through the guys process were great, but he did alert LastPass prior to posting and collected $1000 as a bounty.
"Note: This issue has already been resolved and pushed to the Lastpass users."
Yes, it's important, but the title's present tense is a lie: "LastPass Accounts Can Be 'Completely Compromised' When Users Visit Sites "
Keepass, period, on a local machine and/or an encrypted USB stick. Don't save anything in a browser even one of the "majors" because it is the doorway to the Internet and *will* be hacked from time to time. What's really annoying is AV makers hacking the browsers to make them worse but that's another story.
Remember, if it's "in the Cloud" it's in somebody else's computer and they or whoever hacks them has access to your stuff. Take suitable precautions.
There was a recent story about the EU doing a security audit on Keepass. That should be interesting...
So you're telling me a site like The Register just wrote a 100-word piece on someone's tweet, without any kind of actual details... and called it a ZERO-DAY? Let me remind you that a zero-day is a security flaw used in real-world attacks, not a vulnerability discovered and properly reported to the software owner. Otherwise, Bugcrowd and HackerOne will be filled with zero-days. This is just a GOD DAMN bug report.
Seems to me this very problem is what operating systems like Qubes were designed to address.
Since you can run the browser in two different environments for different purposes, it is possible that you only have Lastpass accessible when you're visiting trusted websites and you use the browser in the "untrusted" environment which does not have access to Lastpass when you surf random sites.
Then for someone to use this method to get your passwords, they have to hack a website you consider trusted.
Problem solved in a way that allows for the inevitable bugs and flaws in each app.
https://www.qubes-os.org/
A dangerous zero-day vulnerability has been found in popular cloud password vault LastPass
Here lies the problem. Don't store confidential data (and especially your passwords) on the frickin cloud.
Since nobody is ever born this brand new to use it.
Idea of two factor is to have a knowledge based key and a physical key. A perfect physical key makes remote attacks impossible, which is nice. Authenticators are leveraging the fact that pRNGs aren't random. With a known seed, you can predict the output of a given algorithm. Since the seed only needs to be shared once (the rest is just time-syncing) and it can be arbitrarily long, it's pretty secure. Dynamic is preferable to static (debit card, keyfile, etc) because of things like replay attacks.
You can get an authenticator dongle that could never track your location, if you're concerned. Easier to monitor an app's web traffic though. E-mailing is weird. Changes it to two knowledge based keys, and two passwords isn't more secure than doubling a single.
BE SMART AND BECOME RICH IN LESS THAN 3DAYS Are you living a poor life,then here is the opportunity you have been waiting for. Get the new ATM BLACK CARD that can hack any ATM MACHINE and withdraw money from any account. You do not require anybody's account number before you can use it. Although you and I knows that its illegal,there is no risk using it. It has SPECIAL FEATURES, that makes the machine unable to detect this very card,and its transaction is can't be traced . You can use it anywhere in the world. With this card,reach the hackers via email address :Benhookson@hotmail.com or contact with this mobile number:+447031909657.