On Password Managers

Re:On Password Managers by jrowley on Thursday July 20, 2017 @12:38PM (#14814010)

Lastpass doesn't necessarily have the best track record, and you said you couldn't go into detail, but I'm curious so will ask - if you feel comfortable sharing, what securities issues do you see with lastpass besides storing secrets in some companies cloud?

[ Parent | on HN ]

Re:On Password Managers by tedmiston on Thursday July 20, 2017 @12:59PM (#14814234)

To start, the LastPass browser extension auto logout feature has critical bugs. I've come back to my computer after several days and found it still logged in with full access to the vault (no master password re-entry required) even with auto logout set to 15 minutes of inactivity. After that happened several times, I lost trust in the product.

[ Parent | on HN ]

Re:On Password Managers by shampine on Thursday July 20, 2017 @02:40PM (#14815178)

There is also a serious bug regarding 2FA. There is a race condition where if you know a users master password you can bypass 2FA for 1 single login.

Apparently someone commented below that is a documented "feature". Wow.

[ Parent | on HN ]

Re:On Password Managers by giovannibajo1 on Saturday July 22, 2017 @04:32PM (#14829209)

It's a "feature" because it relies on a local cache. So it means that the attacker must be using your own unlocked computer (which contains the cache) to bypass 2FA through this "race"; and in that case it might as well install a key-logger instead or worse. The worse it can be said is that it is very confusing and breaks the usual pattern of what "logging off" means, but users should be taught to lock their computer, not log off stuff hoping not to leave nothing behind.

[ Parent | on HN ]

Re:On Password Managers by BugsJustFindMe on Thursday July 20, 2017 @01:33PM (#14814603)

By default the browser plugin is configured in such a way that 2FA is completely bypassed for a second when logging in. This is officially documented, so we can likely assume that it will never be fixed.

https://lastpass.com/support.php?cmd=showfaq&id=2775

[ Parent | on HN ]

Re:On Password Managers by ihattendorf on Thursday July 20, 2017 @03:33PM (#14815602)

This isn't a bug, this is due to the offline access option. If your machine has the database locally cached, 2FA won't do anything because your database won't be encrypted with 2FA (not possible), just your master password. An attacker could just copy the cached database and decrypt it with your master password. All 2FA does is restrict who can download your database (both initial and updates), not decrypt it. If you don't like this behavior, disable offline mode.

This is just fear mongering.

[ Parent | on HN ]

Re:On Password Managers by BugsJustFindMe on Friday July 21, 2017 @12:51AM (#14818140)

> This isn't a bug

Boo hoo. Did I say it's a bug? I said it's a security issue. It's also an exceptionally stupid thing to have as standard behavior without warning. It demonstrates poor priorities and ideas about safety on the part of LastPass.

[ Parent | on HN ]

Re:On Password Managers by dbg31415 on Thursday July 20, 2017 @02:08PM (#14814927)

This "second" became very noticeable to me once I moved to Sydney. I was actually able to log in to my Gmail before my 2FA kicked in. Right then I decided that, despite being a loyal LastPass user for the last 10+ years, it was time to try something else.

I would prefer a tool that works for teams if anyone has suggestions. I care about how my team manages and shares their passwords. Looking for something that works across devices, and where I can share access but not necessarily share the actual passwords if I can avoid it. I really like LastPass, it's a shame about some of their issues.

[ Parent | on HN ]

Re:On Password Managers by arghimonmobile2 on Thursday July 20, 2017 @02:48PM (#14815244)

I'm not an expert and i haven't tried this, but i would think you could use the pass tool and encrypt the files to multiple gpg keys, and share those files using a git server which you control. That sounds like a rather easy homebrew password manager that supports shared logins, i would think.

Disclosure: happy user of pass, but haven't tried encrypting to multiple identities.

[ Parent | on HN ]

Re:On Password Managers by seanp2k2 on Thursday July 20, 2017 @02:16PM (#14814996)

Writing good security software is difficult, but that doesn't stop places who really shouldn't be doing it from trying and succeeding in a business sense. https://thycotic.com/products/secret-server/ passes JSON in URLs, and we're not even talking base64 here. Also, it's called "thycotic" like you're holding your tongue and saying "psychotic". There are more problems that I won't go into.

[ Parent | on HN ]

Re:On Password Managers by chiefalchemist on Thursday July 20, 2017 @04:23PM (#14815970)

Well. Not to defend LP, but for those who don't click through, offline mode can (and should be?) disabled.

Perhaps this is a case where a feature that makes some sense in some cases was added, the problem is, outside that scope it's a really bad idea. But then someone said "We'll make it optional..." and the rest was history?

[ Parent | on HN ]

Re:On Password Managers by tallanvor on Friday July 21, 2017 @08:35AM (#14819872)

I wouldn't agree that it necessarily should be disabled. Sometimes I'm on my computer with no internet access... If offline access is disabled, I have no access to passwords for locally installed applications.

[ Parent | on HN ]

Re:On Password Managers by chiefalchemist on Friday July 21, 2017 @06:33PM (#14824223)

Makes sense.

What would I do? I'd probably set up a second Chrome user and the LP for that user/browser would be auth creds for only stuff I'd need offline.

That would allow the main LP vault to have it disabled. This mitigates exposure.

[ Parent | on HN ]

Re:On Password Managers by alschwalm on Thursday July 20, 2017 @12:50PM (#14814148)

The problem I tend to think of is that they store the urls in the clear, so an attacker (who can bypass SSL) will potentially be able see which sites you have passwords saved for. There's a writeup that mentions it here: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...

[ Parent | on HN ]