News for hackers. Stuff that matters.
Re:How did LastPass master passwords get compromised? by willis936 on Thursday December 30, 2021 @11:18AM (#29737963)
Which is exactly what you say when facing an existential crisis. If you have a master password leak you either:

  1. lie about it and the truth never comes to light
  2. lie about it and get caught and the consequences are the same as if you came clean
If LP suffered a master password leak then there is no benefit to telling the truth.
Re:How did LastPass master passwords get compromised? by mgraczyk on Thursday December 30, 2021 @11:28AM (#29738055)
One advantage of telling the truth is that you don't go to prison for fraud.

When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very long.

Re:How did LastPass master passwords get compromised? by tibbetts on Thursday December 30, 2021 @12:15PM (#29738574)
A few dozen, most of whom took a job at a security firm and one might imagine are the type reluctant to maintain a lie like this.
Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @12:49PM (#29739080)
This is broken thinking built on faulty assumptions. There are countless examples of massive conspiracies and secrets never leaking.
Re:How did LastPass master passwords get compromised? by nmca on Thursday December 30, 2021 @01:21PM (#29739570)
Can you provide some? I have previously only heard "santa".
Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @01:28PM (#29739651)
Sure, I do contracting work for the military. There are hundreds of millions of secrets kept every day with hundreds of thousands of people keeping their mouths shut. Leaking is exceedingly rare.
Re:How did LastPass master passwords get compromised? by atty on Thursday December 30, 2021 @01:42PM (#29739813)
You have not provided any evidence or examples, just a “trust me”, which is essentially worthless. Also, there is a difference between a secret and a conspiracy. Secrets can survive for a long time, whereas history suggests that conspiracies rarely, if ever, succeed long term.
Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @04:26PM (#29741642)
Well, you know that the military has a lot of secret stuff you know nothing about right? Let’s use Area 51 as an example. Leaks like Snowden or Manning are a drop in the bucket compared to the total amount of secrets that were not leaked.

As far as examples of successfully kept secrets, I can’t give those, because I’m in on it.

All a conspiracy is, is a group of people keeping a secret.

As far as conspiracies not being successful long term, history tells us no such thing. Conspiracies with tons of people are successfully kept every single day, only to be discovered decades later when something is declassified for example.

You can never prove if a conspiracy to keep a secret is not successful if you never knew it existed.

Am I making any sense?

Re:How did LastPass master passwords get compromised? by colejohnson66 on Thursday December 30, 2021 @01:30PM (#29739676)
The military has a much bigger threat of prison for yourself than a company that the investors sue
Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @01:41PM (#29739796)
Oh absolutely. My point was strictly the assumption that many people can’t keep secrets. Depending on ideology, reprisals, or personal ethics (good and bad), secrets can be kept by a startlingly large group of people.

I’ve seen estimates as high as 10% of the population of east Germany were spying on their neighbors.

Re:How did LastPass master passwords get compromised? by colejohnson66 on Thursday December 30, 2021 @01:44PM (#29739835)
I agree. Humans like sharing things, even if they shouldn't. We're bad at keeping secrets. I was just making the point that your claim of leaks in the military isn't necessarily comparable to a leak about a company. You do have a point about the large numbers of service members - that would raise the chances of something happening.
Re:How did LastPass master passwords get compromised? by aflag on Thursday December 30, 2021 @03:35PM (#29741135)
They are indeed different. But if they were compromised, it doesn't mean that all employees there know. It would probably be a handful of engineers only. Maybe one day one of them will make a blog post with all the details, however, there are more incentives to keep their mouths shut than otherwise. If they come publicly about this, they will get a lot of unwanted exposure (which most people don't like), they will certainly lose their jobs, they will have to talk about that in every job interview they do, they will likely get sued due to NDA breaches, etc which will actually prevent them from being hireable in many places (specially security firms). So, it's much easier for these people, if they morally object this, to just quit, find another job and move on. They'll likely tell their friends and family not to use lastpass, but that will only travel so far.
Re:How did LastPass master passwords get compromised? by wongarsu on Thursday December 30, 2021 @06:43PM (#29743009)
D-Day and the operations around it? Various price fixing cartels that were eventually prosecuted?

Naming conspiracies that have never leaked is kind of hard, since we wouldn't know about them. So you have to look for examples of things that were talked about after they stopped being relevant, or that were uncovered without anyone blabbing.

Re:How did LastPass master passwords get compromised? by tragictrash on Thursday December 30, 2021 @03:53PM (#29741297)
enron maydolf haliburton its literally everywhere you look
Re:How did LastPass master passwords get compromised? by mgraczyk on Thursday December 30, 2021 @04:43PM (#29741794)
Those all broke, that's how you know about them
Re:How did LastPass master passwords get compromised? by tragictrash on Thursday December 30, 2021 @07:26PM (#29743365)
But how long did they run for
Re:How did LastPass master passwords get compromised? by noah_buddy on Thursday December 30, 2021 @04:24PM (#29741611)
JFK, 9/11, and Epstein spring to mind for major conspiracies. I think anyone with a head on can see the government bodies tasked to investigate those affairs were rife with conflicted interests, duplicitous individuals, and some intent that they should be as narrow investigations as possible. Those secrets have been kept or at the very least the limited hangout worked so well that people think only nuts question them.
Re:How did LastPass master passwords get compromised? by op00to on Thursday December 30, 2021 @06:21PM (#29742780)
What about “JFK”? What’s special about the fraction 9/11? Are we talking Epstein from welcome back kotter?

You sound paranoid.

Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @06:31PM (#29742895)
Your comment makes no sense. Purposely muddying the waters does not move the discussion forward.
Re:How did LastPass master passwords get compromised? by dreae on Thursday December 30, 2021 @01:22PM (#29739579)
Then how do we have the examples?
Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @04:39PM (#29741763)
I’m not sure I understand your question. Can you state it in a different way?
Re:How did LastPass master passwords get compromised? by paulcole on Thursday December 30, 2021 @02:42PM (#29740579)
you’d need a microscope to see the overlap in the vein diagram of people who lie at work and the people who go to prison for lying at work.
Re:How did LastPass master passwords get compromised? by jjav on Thursday December 30, 2021 @04:45PM (#29741825)
> In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very long.

This is a very unlikely expectation. Employees are under NDA so nobody will talk publically about it unless one of them feel so strongly about it to sacrifice their career (they'd certainly get fired, and being sued for breaching the NDA isn't going to make finding a new job easier).

Employees at all companies keep quiet about bugs like these all the time, that's the most common outcome.

Re:How did LastPass master passwords get compromised? by nix9000 on Thursday December 30, 2021 @07:31PM (#29743404)
>being sued for breaching the NDA isn't going to make finding a new job easier

NDAs are unenforceable against whistleblowers who report illegal activity.

Re:How did LastPass master passwords get compromised? by hsbauauvhabzb on Friday December 31, 2021 @04:22AM (#29746300)
Would it actually be illegal to cover up/lie about? I assume the company is US based, there is certainly breach regulations in Aus (with a 12 month notification window). I guess if it’s publicly traded then it would be a breach of law, but what about if it was privately owned?
Re:How did LastPass master passwords get compromised? by fulafel on Friday December 31, 2021 @07:56AM (#29747592)
Are there examples of jail time for fraud happening for beingdishonest about sw product flaws?
Re:How did LastPass master passwords get compromised? by devwastaken on Thursday December 30, 2021 @04:22PM (#29741597)
Tech companies are not held liable by the justice department or any other federal org. It's against their interests because they now depend on these services to operate. Which is why you will never see Amazon, Google, or Microsoft sued in any damaging capacity for the obvious fraud they commit. That being fake products, reviews, promoting scams, antitrust, etc.
Re:How did LastPass master passwords get compromised? by jazzyjackson on Thursday December 30, 2021 @11:42AM (#29738207)
The consequences of “Mea Culpa, please reset your master password” seem much less existential than denying and eventually being revealed as untrustworthy.
Re:How did LastPass master passwords get compromised? by jonny_eh on Thursday December 30, 2021 @02:15PM (#29740235)
> eventually being revealed as untrustworthy

Replace "eventually" with "maybe".

Re:How did LastPass master passwords get compromised? by imwillofficial on Thursday December 30, 2021 @12:49PM (#29739062)
Except earning trust with the customer, in a line of business that is built entirely on the customer trusting you to manage things properly.