Post AR6SOQNLAPDSrk3KbI by epixoip@infosec.exchange
(DIR) More posts by epixoip@infosec.exchange
(DIR) Post #AR1qkbDWxqdTyHlsx6 by epixoip@infosec.exchange
2022-12-27T09:59:12Z
2 likes, 12 repeats
I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.) So, here are my responses to all of these concerns!Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass: - LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if... - LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if... - LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if... - LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if... - LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if... - LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had. You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security. So, why do I recommend Bitwarden and 1Password? It's quite simple:- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security.- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!
(DIR) Post #AR1zVRcNGsJZRYExIe by thatguyoverthere@shitposter.club
2022-12-27T11:53:23.954339Z
1 likes, 0 repeats
@epixoip storing passwords "in the cloud" whether encrypted with strong, weak, or no encryption is less secure than storing them locally.Keepassxc keeps a local database. You could probably sync the db to multiple devices through nextcloud if need be.This post was interesting but I'm confused. If they have years of bad practices why have you only recently started to recommend people not use their product?
(DIR) Post #AR21BtEt4BS9E33dmi by modpod@blob.cat
2022-12-27T12:12:16.693988Z
1 likes, 0 repeats
@thatguyoverthere @epixoip i like keepass xc, but i dont do any cloud anything anymore, its just.............all a giant honeypot, and im not interested in being the product.
(DIR) Post #AR22WU1U7AXb3RAkMq by thatguyoverthere@shitposter.club
2022-12-27T12:27:12.077114Z
1 likes, 0 repeats
@modpod @epixoip yeah I use nextcloud for "cloud" features (like autouploading images from the phone) and that's now sitting behind my bookshelf in my house.
(DIR) Post #AR2gr9et1Lhw8v0vMu by modpod@blob.cat
2022-12-27T19:59:08.511314Z
0 likes, 0 repeats
@thatguyoverthere @epixoip my phone is in the closet unused
(DIR) Post #AR2r9Xbthr3nBM1Pn6 by charlesroper@indieweb.social
2022-12-27T18:08:41Z
0 likes, 0 repeats
@epixoip @sc00bz Any thoughts on Vaultwarden (Rust implementation of Bitwarden server) and/or Passbolt?In the charity sector, cost is a major factor. Of the password managers we have evaluated, Passbolt is a strong contender because its per-user non-profit pricing is cheapest, and it is designed with teams in mind + UX is great. We looked at 1Password and Bitwarden, but they are relatively expensive. We considered self-hosting Vaultwarden, but admin staff costs aren’t good.
(DIR) Post #AR2r9Y4xxmJQdVcd6G by moopet@toot.cafe
2022-12-27T18:18:40Z
0 likes, 0 repeats
@charlesroper @epixoip @sc00bz my thoughts on anyone reimplementing something on their favourite language is... Why? Is it for any practical reason or just so they can say they maintain something popular?
(DIR) Post #AR2r9YTmTWA5sTERmK by feld@bikeshed.party
2022-12-27T21:54:08.277581Z
0 likes, 0 repeats
@moopet @charlesroper @epixoip @sc00bz The Vaultwarden server which is basicaly 100% API compatible with Bitwarden and uses a sqlite database runs with only like 100MB of resident memory usageThe Bitwarden stack is a gigantic mess of dotnet, Windows, MSSQL, etc and well, you can do the math on the costs of running that stack
(DIR) Post #AR2rU3eiGv72MR7cmG by WPalant@infosec.exchange
2022-12-27T11:34:16Z
0 likes, 0 repeats
@epixoip Absolutely. In my latest blog post I take apart their public statement and show how many issues have been known and ignored for a long time. And #LastPass continues to ignore and downplay them even now, when they’ve put people at risk. It isn’t only the breach, it’s also the long standing and continuing negligence.https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/
(DIR) Post #AR2rU47mWqMfoaiq5Q by Jwilliams@infosec.exchange
2022-12-27T17:54:26Z
0 likes, 0 repeats
@WPalant@epixoip What I'm not seeing noted much: in calculations of cracking time, assuming the threat actor obtained this data with the intent of cracking encrypted vaults, the clock doesn't start now.It started about four months ago.That's fairly sobering for anyone who might be a high-value target, and looking at cracking times for a nation state actor measured in months.
(DIR) Post #AR2rU4Up9AnQy3VF0C by WPalant@infosec.exchange
2022-12-27T18:09:08Z
0 likes, 1 repeats
@Jwilliams Definitely. LastPass still won’t tell us when that data leaked. Whether it was August or November makes one hell of a difference. For a state-level actor, a few months are sufficient time to decrypt the data for at least some of their targets and to start operating under the radar.That’s why I wrote: “if you are an activist, dissident or someone else who might get targeted by a state-level adversary, the best time to change all your passwords was a month ago. The second best time is right now.”@epixoip
(DIR) Post #AR2sg3PR770B1fGCwK by shriramk@mastodon.social
2022-12-27T21:11:38Z
0 likes, 0 repeats
@epixoip @sc00bz As a programming languages researcher, I'm intensely curious what your complaint about garbage collection is.My only speculation is that you're unhappy that data might linger on the heap longer than one wants until the GC kicks in. But that's a problem of not zeroing out the data, right, not of GC per se? Unless you feel it lets programmers ignore this issue?The flip side is that that code is likely has fewer exploits due to memory mis-management bugs.
(DIR) Post #AR2sg44ucuB96IfKaW by epixoip@infosec.exchange
2022-12-27T21:20:25Z
0 likes, 0 repeats
@shriramk @sc00bz you pretty much nailed it. Typically in crypto applications it is highly desirable to have direct control over buffers, and sometimes even registers, to ensure we know exactly what is happening with the data and to ensure there are no leaks. Don't want stuff lingering in RAM or being swapped to disk, or able to be read/written through some other side channel.
(DIR) Post #AR2sg4Wuwma2V9lhEu by shriramk@mastodon.social
2022-12-27T22:10:05Z
0 likes, 0 repeats
@epixoip @sc00bz Totally agree. That's a known weakness.But you've also gotta admit the flip side, which is that reduction of seg faults is a thing, too. Programmers have not shown themselves to be terrific at avoiding those either, and it's a pretty straight line from seg fault to p0wned.(This is not a defense of GC, so much as "we need all of this, and more".)
(DIR) Post #AR2sg5138kgQ0brlCq by hayley@social.applied-langua.ge
2022-12-27T22:11:33.436280Z
0 likes, 0 repeats
@shriramk @epixoip @sc00bz Compilers are often helpful here and will optimise by deleting "dead" writes to buffers that one wants cleaned, to be fair.
(DIR) Post #AR2szV0Ik3Tq6wmACG by shriramk@mastodon.social
2022-12-27T22:14:46Z
1 likes, 0 repeats
@hayley @sc00bz @epixoip Oh yeah, for sure. I think these kinds of failures have been documented for a while now.Another is "optimizing" "redundant" instructions added to then/else branches, thereby leaking bits from a crypto computation, thereby leaking keys.The flip side is that what a compiler taketh, a compiler can, uh, giveth, too. I'm excited by projects like Everest [https://project-everest.github.io/]. Eventually these will go farther than most humans on their own can.
(DIR) Post #AR2t8cNYgsnTah0DOC by hayley@social.applied-langua.ge
2022-12-27T22:16:43.682901Z
0 likes, 0 repeats
@shriramk @sc00bz @epixoip On timing attacks there is https://github.com/PLSysSec/FaCT which also types sensitive/not sensitive information too, among other things.
(DIR) Post #AR2v97KxmyDRVw9dVg by shriramk@mastodon.social
2022-12-27T22:30:35Z
1 likes, 0 repeats
@hayley @sc00bz @epixoip Right. I've seen a few projects like this and I'm excited about them.The problem is that crypto created a bunch of new safety constraints that languages had no been designed around.That just means we have to design around more of them, not that we have to put all that burden on programmers.
(DIR) Post #AR3QaDOUTUQYhHCnMO by RokosBasilisk@ioc.exchange
2022-12-28T04:31:30Z
0 likes, 0 repeats
@epixoip @sc00bz Thank you for this extremely informative article!I have had intuitive allergy to password managers and this article confirms my gut feel was well founded.
(DIR) Post #AR4bUDHLHePhFvA8HY by ocean@raru.re
2022-12-28T18:08:21Z
0 likes, 0 repeats
@epixoip @sc00bz Absolutely great post, this is the kinda thing I love to see on my TL in the morning.I was personally really hesitant to do the password manager thing for years and years, I finally caved and started using KeepassXC and iCloud keychain
(DIR) Post #AR6Q0PwouDmegH4aJc by guardianproject@social.librem.one
2022-12-29T15:09:07Z
0 likes, 0 repeats
@epixoip @sc00bz password managers need to be #FreeSoftware or at least #OpenSource so they can be publicly inspected. Then it would have been trivial to point out all these flaws years ago.
(DIR) Post #AR6RcwpvAsnxdqmaQ4 by mjgardner@social.sdf.org
2022-12-29T15:27:17Z
0 likes, 0 repeats
@guardianproject @epixoip @sc00bz While I also advocate for #OoenSource, especially #security software, I balk at the word “trivial.” There have been many times when a security flaw was found in open source code long after it was released and deployed, especially with critical infrastructure code that’s nevertheless under-funded because the industry loves the free-as-in-beer interpretation of #FreeSoftware.
(DIR) Post #AR6SOQNLAPDSrk3KbI by epixoip@infosec.exchange
2022-12-29T15:35:52Z
0 likes, 0 repeats
@guardianproject most all of the issues I raised have been known for 7+ years. some things have been fixed, others have had only partial mitigation or have gone entirely ignored.
(DIR) Post #AR6ljWG6O1KWK4RIqu by KeeperSecurity@infosec.exchange
2022-12-28T18:21:18Z
0 likes, 0 repeats
@epixoip @sc00bz Don't forget about #KeeperSecurity, the only FedRAMP Authorized password manager with the longest-standing SOC 2 and ISO 27001 certifications in the industry. We stand by our extremely strict security standards. Here's a side-by-side comparison of how we stack up against LastPass: https://www.keepersecurity.com/blog/2022/07/18/keeper-vs-lastpass-whats-the-difference/. Our blog also features comparisons against other password managers on the market.
(DIR) Post #AR6ljWjsbJ9JoQN5Ga by feld@bikeshed.party
2022-12-29T19:12:18.377823Z
0 likes, 0 repeats
@KeeperSecurity @epixoip @sc00bz Keeper, the company who threatened to sue someone recently for not changing their LinkedIn profile after they left the organization? Why would anyone want to get involved with someone so carelessly litigious?