Re:Ask HN: How did my LastPass master password get leaked?
by rjp0008 on Monday December 27, 2021 @06:20PM
(#29708188)
Can't use the same PIN as a hacker would just add myhackurl.com/login to your vault and see what the PIN came across as. I think you'd also run into issues with password length as a lot of sites still have a restriction. I like the idea though and maybe a different implementation could work.
Re:Ask HN: How did my LastPass master password get leaked?
by donmcronald on Monday December 27, 2021 @07:58PM
(#29709015)
I mean a PIN that's not stored in the vault or auto-filled. It would be something extra that you add manually after the password manager fills in the password
So the password manager would put in 'password' and I'd manually type '1234' to make it 'password1234'.
Re:Ask HN: How did my LastPass master password get leaked?
by Fnoord on Monday December 27, 2021 @08:13PM
(#29709131)
That would not have stopped the vulnerability 'LastPass bug leaks credentials from previous site' (see Zdnet article posted elsewhere) though that's not a common vulnerability in software.
I wonder if password managers should be designed around, and encourage the use of, an undocumented PIN that’s appended to every stored password. You could use the same PIN for everything and if someone got your vault decrypted there would at least be a chance they didn’t get the secondary PIN too.