The LastPass Era Announcement: What Happens When Your Passwords are Copyed and Your Authentication is Unbroken?

LastPass says that using its recommended defaults should protect you from that kind of attack, but it doesn’t mention any sort of feature that would prevent someone from repeatedly trying to unlock a vault for days, months, or years. If someone re-uses their master password for other logins, it would be possible for others to see it, as it may have been leaked out during other data breeches.

The threat actor was able to copy the data from the customer vault backup which is stored in a proprietaryBinary format and contains both passwords and secure notes.

“This prepares the ground for blaming the customers,” writes Palant, saying that “LastPass should be aware that passwords will be decrypted for at least some of their customers. Their explanation is that these customers clearly didn’t follow their best practices. However, he also points out that LastPass hasn’t necessarily enforced those standards. Palant says that he can log in with his eight character password without being warned or forced to change it.

The more concerning is the unencrypted data, it could give a hacker a clue as to which websites you have accounts with. If they decided to target particular users, that could be powerful information when combined with phishing or other types of attacks.

It isn’t great news, but it might happen to any company that is storing secrets in the cloud. In Cybersecurity, the name of the game isn’t having a perfect track record, but how you respond to disasters when they happen.

Remember, it’s making this announcement today, on December 22nd — three days before Christmas, a time when many IT departments will largely be on vacation, and when people aren’t likely to be paying attention to updates from their password manager.

The announcement doesn’t state anything about the vaults being copied until five paragraphs in. And while some of the information is bolded, I think it’s fair to expect that such a major announcement would be at the very top.)

LastPass is Not in a Million Years: Can It Take Far Less to Crack a Master Password? Reply to Goldberg

The company is taking a lot of precautions as a result of the initial breach and the secondary one, which exposed the backups, including building a new environment, rotating credentials, adding more logging to detect suspicious activity, and more.

You’ve heard it many times, you need to use a password manager to generate strong, unique passwords and keep track of them. And if you finally took the plunge with a free and mainstream option, particularly during the 2010s, it was probably LastPass. For the security service’s 25.6 million users, though, the company made a worrying announcement last week: A security incident the firm previously reported on November 30 was actually a massive and concerning data breach that exposed encrypted password vaults—the crown jewels of any password manager—along with other user data.

Gosney wrote a post on Mastodon explaining why he wanted to move to another password manager. “LastPass’s claim of ‘zero knowledge’ is a bald-faced lie,” he says, alleging that the company has “about as much knowledge as a password manager can possibly get away with.”

He also highlights LastPass’ admission that the leaked data included “the IP addresses from which customers were accessing the LastPass service,” saying that could let the threat actor “create a complete movement profile” of customers if LastPass was logging every IP address you used with its service.

Jeffrey Goldberg, principal security architect at 1Password, wrote a post on Wednesday titled ” Not in a million years: It can take far less to crack a LastPass password.” In it, Goldberg calls LastPass’ claim of it taking a million years to crack a master password “highly misleading,” saying that the statistic appears to assume a 12 character, randomly generated password. “Passwords created by humans come nowhere near meeting that requirement,” he writes, saying that threat actors would be able to prioritize certain guesses based on how people construct passwords they can actually remember.

Of course, a competitor’s word should probably be taken with a grain of salt, though Palant echos a similar idea in his post — he claims the viral XKCD method of creating passwords would take around 25 minutes to crack with a single GPU, while one made by rolling dice would take around 3 years to guess with the same hardware. It goes without saying that a motivated actor trying to crack into a specific target’s vault could probably throw more than one GPU at the problem, potentially cutting that time down by orders of magnitude.

LastPass, Bitwarden and Gosney: “The Last Pass vault breach encryption rebuttal is not an open hack”

Both Gosney and Palant take issue with the actual security of LastPass. Gosney accuses the company of basically committing “every ‘crypto 101’ sin” with how its encryption is implemented and how it manages data once it’s been loaded into your device’s memory.

Bitwarden, another popular password manager, says that its app uses 100,001 iterations, and that it adds another 100,000 iterations when your password is stored on the server for a total of 200,001. 1Password says it uses 100,000 iterations, but its encryption scheme means that you have to have both a secret key and your master password to unlock your data. That feature “ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable,” according to Gosney.

There’s also a privacy angle; you can tell a lot about a person based on what websites they use. Is there a way to store account information for a porn site? Can someone figure out where you live based on your utility provider accounts? Would the info that you use a gay dating app put your freedom or life in danger?

Source: https://www.theverge.com/2022/12/28/23529547/lastpass-vault-breach-disclosure-encryption-cybersecurity-rebuttal

Are Cloud-based Password Managers Bad Idea? Comment on a Post by Gosney and Palant (and another commenter)

Some security experts like Gosney and Palant seem to agree that there’s no proof that cloud-based password managers are a bad idea. This seems to be in response to people who evangelize the benefits of completely offline password managers (or even just writing down randomly-generated passwords in a notebook, as I saw one commenter suggest). It is obvious that this approach will make it easier to get at something that is not in the cloud, and more difficult to get at a company that has millions of passwords.