News for hackers. Stuff that matters.
Re:LastPass breach gets worse – reddit.com/r/sysadmin by Izkata on Wednesday January 25, 2023 @09:38AM (#34518719)
> The alternative right now is to use the same password everywhere. That's even worse.

Or to just use the browser's saving functionality and never push your passwords online in the first place. They're probably only using one primary device like me; I generally don't log in to stuff on my phone, or personal stuff on my work laptop/work stuff on my personal laptop.

If their habits are like mine then these cloud password services are pretty pointless.

Re:LastPass breach gets worse – reddit.com/r/sysadmin by fullstop on Wednesday January 25, 2023 @10:18AM (#34519227)
You're unlike most people in that regard. I'm signed into services on at least two or three devices -- a desktop, a laptop, and my phone.

Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow?

I don't know if this has changed, but a few years ago the stored passwords in Chrome were stored unencrypted in a sqlite3 database. (on Linux, at least) I'd use an audited service such as Bitwarden or roll my own Keepass thing before using the browser's saved password feature. All it would take is one RCE exploit in a browser to expose your passwords.

Re:LastPass breach gets worse – reddit.com/r/sysadmin by Izkata on Wednesday January 25, 2023 @11:48AM (#34520624)
> Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow?

This has already happened a few times over the past decade: I restore from local backups.

Re:LastPass breach gets worse – reddit.com/r/sysadmin by fullstop on Wednesday January 25, 2023 @11:57AM (#34520763)
Okay, one step further then. What happens if your house burns down? Eventually you will want some sort of offsite backup.

Also: https://ohyicong.medium.com/how-to-hack-chrome-password-with...

Passwords are still easy to obtain outside of Chrome, and apparently Firefox is just as easy.

By using the browser's saved password feature you are one RCE away from someone being able to automate the extraction of all of your passwords.

Re:LastPass breach gets worse – reddit.com/r/sysadmin by Izkata on Wednesday January 25, 2023 @06:13PM (#34525504)
I have one, and minimal one on my keychain, both in an encrypted disk image I do memorize the password for.

I'm pretty sure on Firefox if you have the master password set, they're actually encrypted, and has done that for a long time.

Re:LastPass breach gets worse – reddit.com/r/sysadmin by mrWiz on Wednesday January 25, 2023 @10:27AM (#34519317)
I think that using multiple devices is probably by far the most common use case. Personally I have my own PC, a work laptop, and a phone that I regularly use, and a tablet that I use irregularly (but often enough that I want my account information available).