[HN Gopher] Unusual login activity was due to bug
       ___________________________________________________________________
        
       Unusual login activity was due to bug
        
       Author : andruby
       Score  : 125 points
       Date   : 2021-12-30 16:19 UTC (6 hours ago)
        
 (HTM) web link (blog.lastpass.com)
 (TXT) w3m dump (blog.lastpass.com)
        
       | andruby wrote:
       | > Our investigation has since found that some of these security
       | alerts, which were sent to a limited subset of LastPass users,
       | were likely triggered in error.
       | 
       | A lot of corporate text in this blog. This seems to be the only
       | sentence where they say that the unusual login activity was
       | actually a software error.
       | 
       | (PS: I editorialised the title since the actual title is very
       | generic says nothing)
        
         | avsteele wrote:
         | Exactly. What a garbage post from LastPass.
         | 
         | What's the error?
         | 
         | - was the message which says 3rd party had the correct password
         | wrong?
         | 
         | - was it was sent out to accounts other than those for which
         | the 3rd party had the password?
         | 
         | - something else?
        
         | windthrown wrote:
         | And even then, "some" of the alerts being "likely" triggered in
         | error makes it sound like quite a few may have been actual
         | security issues.
        
       | ipiz0618 wrote:
       | I saw the post the other day, and immediately switched to
       | Bitwarden. I guess I was right that LastPass isn't safe enough.
       | Bugs are inevitable but how they spin it shows they don't want to
       | take responsibility (what was the bug??)
        
       | Mockapapella wrote:
       | Alright, I don't like the deflectionary way they talk. Reminds me
       | of this post by Paul Graham:
       | https://twitter.com/paulg/status/1366811342699696129
       | 
       | I'm going to switch to another password manager. Is there
       | anything that is a drop in replacement for LastPass? ie has a
       | browser extension for firefox, hosted in the cloud (I don't want
       | to be managing a server for this), and has a mobile app. I've
       | heard a lot about bitwarden and keepass, but they're usually
       | accompanied by comments regarding self hosting, which I'm not
       | interested in doing.
        
         | phillipwei wrote:
         | I use 1Password and like it.
        
         | DeathMetal3000 wrote:
         | How about the built in Firefox password manager? You can
         | (optionally) sync across devices and set it as the password
         | store in iOS (probably Android too).
        
         | gpm wrote:
         | Bitwarden's hosted service works just fine, you can self host,
         | but you certainly don't need to.
        
         | gruez wrote:
         | >has a browser extension for firefox
         | 
         | you might want to reconsider this. browser extensions has
         | historically been a common attack surface in the past[1].
         | 
         | [1] https://lock.cmpxchg8b.com/passmgrs.html
        
           | [deleted]
        
         | [deleted]
        
         | elFarto wrote:
         | I'm using Enpass, which mostly works fine. However, they've
         | recently moved to a subscription model which is unfortunate,
         | where-as I bought the Android version a while ago which gave me
         | a 'Premium license'.
        
         | charles-m-knox wrote:
         | You can use Bitwarden's official servers without self-hosting
         | anything at all. I did it for a couple years and it was a great
         | experience.
        
           | shafyy wrote:
           | I second Bitwarden!
        
         | BOOSTERHIDROGEN wrote:
         | https://bitwarden.com/pricing/
         | 
         | You use Bitwarden premium for 10$/y
        
           | quelltext wrote:
           | Why not the free version?
        
             | zimpenfish wrote:
             | I pay for premium even though I don't really use any of
             | their premium features (and could easily host my own)
             | because I like the Bitwarden product and want them to
             | continue as a company (without having to sell out to
             | someone like LogMeIn...)
        
         | stingraycharles wrote:
         | This is not just for startups or blog posts, but all
         | communication: people that aren't confident in what they're
         | saying, tend to use a lot of words to disguise it. The opposite
         | is also true.
        
         | jrockway wrote:
         | I switched from LastPass to 1Password and the export/import
         | worked flawlessly. I didn't switch because of this issue,
         | rather I use 1Password for work and thought it was just better,
         | so I made the jump for my personal stuff.
        
         | LeoPanthera wrote:
         | I use 1Password. It meets all your criteria and, IMHO, has by
         | far the best UI in both web and app interfaces. $35.88/year
        
       | riffic wrote:
       | there's not a lot of _quality_ in the LastPass product, and there
       | hasn 't been for a very long time. There are much better
       | competing products to use instead.
        
       | dang wrote:
       | Ongoing related thread: _How did LastPass master passwords get
       | compromised?_ - https://news.ycombinator.com/item?id=29735132
       | 
       | Recent and related:
       | 
       |  _LastPass Login Attempted Activity Blocked - More Information_ -
       | https://news.ycombinator.com/item?id=29731317 - Dec 2021 (12
       | comments)
       | 
       |  _LastPass says no passwords were compromised following breach
       | scare_ - https://news.ycombinator.com/item?id=29723319 - Dec 2021
       | (68 comments)
       | 
       |  _LastPass users warned their master passwords are compromised_ -
       | https://news.ycombinator.com/item?id=29716715 - Dec 2021 (313
       | comments)
       | 
       |  _Ask HN: How did my LastPass master password get leaked?_ -
       | https://news.ycombinator.com/item?id=29705957 - Dec 2021 (508
       | comments)
        
       | [deleted]
        
       | Havoc wrote:
       | They really botched the entire thing.
       | 
       | Bunch of people report their unique password gets this message
       | and they investigate credential stuffing? Makes no sense.
       | 
       | >some of these security alerts, which were sent to a limited
       | subset of LastPass users, were likely triggered in error.
       | 
       | "some"? "likely"?
       | 
       | They really don't sound like they've got a grip on this
        
         | singlow wrote:
         | There are probably a baseline of real security alerts for 3rd
         | party credentials per day. For any given user, hers may have
         | been from this bug or it may have been a real attack. If
         | normally there are 200 alerts per day but while this bug was
         | present there were 20k per day, then any given message was
         | likely to have been from the bug, but some were probably real.
        
         | thrwaway9871 wrote:
         | > Bunch of people report their unique password gets this
         | message and they investigate credential stuffing? Makes no
         | sense.
         | 
         | You never worked in IT if you believe what your customers tell
         | you, especially the ones that don't pay you.
        
       | Croftengea wrote:
       | With Bitwarden (which is better, cheaper and more open) I
       | honestly don't see any good reason to use LastPass now given
       | their poor track record of security incidents and naive (not to
       | say stupid) business decisions.
        
         | registeredcorn wrote:
        
         | rlex wrote:
         | I selfhost bitwarden with rust implementation called
         | vaultwarden, it uses little to no resources and works
         | flawlessly. Compatible with original clients, too. Never looked
         | back.
        
           | kennywinker wrote:
           | Where do you host it? I was thinking I'd host it on my NAS
           | and only sync when i'm on my local network. Not sure if
           | that'll work with the clients? My nas is also it's too old to
           | have a supported docker package, so that's a bit of a hurdle
           | there. Pretty uncomfortable with the idea of hosting it on
           | digitalocean or similar... wondering what others do?
        
             | rlex wrote:
             | Personal k8s cluster
             | 
             | >Pretty uncomfortable with the idea of hosting it on
             | digitalocean or similar
             | 
             | Everything is encrypted. Use strong master password and
             | 2fa, even if your VM gets dumped and your password gets
             | stolen there's no data they can recover. Alot of people
             | host it on raspberry at home, if you have VPN to home it
             | can be more secure. Also clients are synced, so you can
             | sync while at home network - your in-browser or in-app
             | vault will be available even if server is not reachable at
             | the moment.
        
               | klyrs wrote:
               | If your VM gets dumped and your password gets stolen, are
               | you not vulnerable to a SIM swap? Asking out of paranoia.
        
               | rlex wrote:
               | Nobody forces you to use sms for 2fa. I'm not even sure
               | vaultwarden supports SMS. I use https://getaegis.app with
               | usual 2FA TOTP, also protected by password. So for
               | someone to gain access to your vault will need:
               | 
               | * access to your server with bitwarden/vaultwarden (this
               | one is tricky, someone might inject something in webui JS
               | if it's open to public internet, so keeping it VPNed
               | might be good idea indeed)
               | 
               | * access to your master password
               | 
               | * access to your mobile device / totp storage and
               | password for it
               | 
               | I'd say it's pretty safe from random hackers, but if
               | someone is dead set on getting your data, well
               | https://xkcd.com/538/
        
             | flandish wrote:
             | I do that but also allow sync when not on local network -
             | via traefik and such as a reverse proxy. However ... I may
             | still turn that off as I have wireguard on everything
             | anyway, so it's super simple to turn wireguard on, sync
             | "locally" and then turn wireguard off.
        
         | Closi wrote:
         | I subscribe to 1Password which has a similar security model -
         | it's a bit more expensive but I've been very happy with it and
         | it's very polished.
         | 
         | (Plus their support is excellent and saved my butt once - I
         | upgraded my personal account to a family account and made my
         | father an admin, after which he decided to 'cancel' his account
         | by deleting the full family account, despite a warning saying
         | everyone's passwords would be permanently erased for the full
         | family. I lost access to all my accounts, however thankfully
         | the 1Password team were incredibly helpful and managed to
         | recover our vault from a backup).
        
       | vorpalhex wrote:
       | I hope they intend to provide more proof than their word...
        
       | 5- wrote:
       | i don't understand why people comfortable with running a vps
       | bother with these cloud services.
       | 
       | i use pass https://www.passwordstore.org/ git sync'd (encrypted)
       | to a $5/month vps that also runs many other things. you could
       | even get a free one from large cloud providers.
       | 
       | pass has lots of clients for all kinds of platforms, works really
       | well (how could it not? it's just a thin wrapper around git +
       | gpg) and i don't have to worry about anything like the topic at
       | hand.
       | 
       | what am i missing?
        
         | Arainach wrote:
         | There's a longer chain of trust and research required here. I
         | need to trust the original authors, the authors of whatever
         | Android client I want, the authors of whatever Windows client I
         | want, and so on. I need to figure out what options are
         | available and why I should trust them and I need to constantly
         | continue doing so to make sure those apps aren't sold to some
         | other party I don't trust.
         | 
         | There's no simple mechanism for sharing. Many clients don't
         | support using multiple stores. Even if they did, the UX is
         | never one that I would be able to convince anyone other than a
         | software engineer to use.
         | 
         | Single-party centralized solutions offer a simplified trust
         | model and a common auth service makes sharing and recovery much
         | simpler.
        
         | aborsy wrote:
         | This set up is much more secure than online password
         | management.
        
       | FredPret wrote:
       | Is there a reason an all-Apple user would want to use a password
       | manager like this?
        
         | smilespray wrote:
         | I use the Apple keychain and am perfectly happy with it. If you
         | need team functionality you might want to look around for
         | another solution. I ditched LastPass years ago because of
         | crappy UX/UI.
        
       | kup0 wrote:
       | Posts like this are so frustrating. It's a whole lot of words to
       | say nothing. There's a small mention of the alerts being
       | triggered by a bug/error, but it is surrounded hundreds of words
       | of deflection/spin.
       | 
       | Additionally, it is bothersome that absolutely zero detail on
       | this error is given.
       | 
       | Given the incredible gravity of the situation (potential of
       | having one's entire password vault compromised), I expect a
       | better response than this
        
         | unixbane wrote:
         | never used them but just went to their website and concluded
         | it's some novice programmer who has no skill and wants to make
         | a business around software so after going through a few ideas
         | he came up with a password manager. no idea why people (on HN)
         | use these things.
        
           | stanski wrote:
           | Kind of a poor way to judge a product, I'd say. I'm no longer
           | a lastpass user but if you read up on them you'll find that
           | your initial assessment is _way off_.
           | 
           | They've had their issues but the idea of it being built by a
           | novice programmer is very far from reality.
        
             | unixbane wrote:
             | I use a trivial program that manages a list of passwords
             | generated using /dev/urandom constrained to simple ascii
             | chars and provides basic features like copying it to
             | clipboard to avoid shoulder surfing. It took an hour to
             | write 10 years ago. and judging software from how bullshit
             | their website front page is has not failed me a single time
             | in the last 20 years. my predictions of what vulns they
             | have is always spot on. im not interested in your (HN's)
             | definition of reality as they still think string injection
             | attacks are fundamentally hard to solve
        
           | kup0 wrote:
           | They're a relatively well-known company, currently owned by
           | LogMeIn, though that seems like it will be changing. It's
           | definitely not some solo person's side project or anything.
           | They're one of the most well-known names (whether good or
           | bad) in the password manager category.
           | 
           | While they have had security trouble in the past- they're big
           | enough that it's not surprising at all to me that many
           | people, including those on HN, are their customers.
           | 
           | I would also not be surprised if they lose a chunk of tech-
           | savvy customers over this- as they should.
        
         | feldrim wrote:
         | This may very well be a good example of strategic ambiguity.
         | They grant themselves a broad area for future, not a limiting
         | direction. Since nothing is presented precisely, the following
         | reports, articles, announcements can be shaped the way the
         | environment requires.
         | 
         | With this, they say nothing more than "it was not a cyber
         | attack". It is a statement of relief for shareholders. It's not
         | about the customers.
        
         | stingraycharles wrote:
         | Assuming for a moment that what they claim is true (never
         | attribute to malice that what can be explained by
         | incompetence), that it is indeed a bug / password reuse, what
         | information would you have liked them to give? It seems to me
         | that they're communicating they're not hacked, looked into the
         | issue and found nothing special.
         | 
         | I do agree that they're patting themselves on the back a bit
         | too much and also should have been a bit more humble when
         | dismissing things as password reuse.
        
           | kup0 wrote:
           | In general, when tech-related companies have problems like
           | this (with potentially severe consequences), I think a post-
           | mortem should be a minimum expectation. I just feel like the
           | way this post frames the issue is almost like it doesn't
           | matter that much to them. "Oops, it was just a bug, for some
           | accounts, we think. All fixed!" just doesn't sit well with me
           | (maybe that's a me problem...)
           | 
           | I would want some follow-up answers, to questions like:
           | 
           | - Why would a bug trigger alerts that are as severe as
           | "someone else tried to use your unique not-used-elsewhere
           | master password"? I understand bugs, even severe ones,
           | happen- but can I trust that your alerts aren't going to cry
           | wolf on my account going forward?
           | 
           | - Why did you originally conclude it was credential
           | stuffing/reuse, when there are a number of people that got
           | the alert that clearly stated they had never used their
           | master password anywhere else? Are you monitoring user
           | reports / social platforms / etc to respond to and address
           | these situations?
           | 
           | - When you say "some" were triggered in error- does this mean
           | some of the attempts were legitimate, or were they all due to
           | a bug? Do you even know the answer to this question? If there
           | are legitimate attempts on non-reused-password accounts, it
           | appears master passwords are leaking/being captured/etc in
           | some other way and that deserves further investigation
           | 
           | I just want more than a sentence or two surrounded by 10+
           | paragraphs of "this happened because of how good we are at
           | keeping you safe"
        
         | tryptophan wrote:
         | Not communicating clearly and pretending like dumb blog posts
         | like this are an answer are both major red flags.
         | 
         | I don't understand the thought process behind such legal-ese
         | talk. Do they think we are dumb and can't see through it?
         | Putting this sort of stuff up is just saying "we don't care
         | about you in reality but here is a post saying we do".
        
           | kup0 wrote:
           | I think one thing that really got to me is that the post is
           | by the _VP of Engineering_ , which for some reason gave me an
           | expectation of a detailed explanation of the problem, only to
           | find none
           | 
           | The post sounds like it was _actually_ written by either
           | legal or marketing instead
        
             | redis_mlc wrote:
        
             | peakaboo wrote:
             | Some (bad) companies have a VP of Engineering that has no
             | clue about technology and with a background in another
             | field.
             | 
             | But come on, Lastpass has been on a downwards slope for a
             | very long time. They can't even make their main product as
             | good as Bitwarden which is free.
        
             | thrwaway9871 wrote:
             | So much this. Don't use any online password managers but
             | with this response lastpass became godaddy for passwords in
             | my book.
        
             | nescioquid wrote:
             | And when the VP of Engineering writes
             | 
             | > some of these security alerts...were likely triggered in
             | error
             | 
             | one can conclude that they do not _know_ that _any_ of the
             | alerts were triggered in error (else he would have said as
             | much). Some of the VP 's statements were likely triggered
             | by the legal department, though I don't know that any
             | actually were. It doesn't exactly shed light on anything.
        
             | klyrs wrote:
             | If I were to guess, anything written by the VP of
             | Engineering would be heavily edited by legal and marketing
             | until the result was indistinguishable. Source: I work for
             | a company that doesn't let anything go out without approval
             | of Legal, Marketing, and a few other nebulous
             | 'stakeholders'
        
       | kabdib wrote:
       | As an early LastPass adopter, I paid for about ten years of their
       | Premium tier (it was pretty cheap early on). After they were sold
       | the first time, it took them several years to stop billing me
       | every year anyway, so I've still got about a decade of pre-paid
       | Premium. No, they wouldn't refund my extra payments. Strike one.
       | 
       | I'm moving to something else now. Other companies might get away
       | with "we fixed a bug, don't worry your pretty little heads." Not
       | this application. Strike two.
       | 
       | If this is nothing to worry our PLH's over, I wonder what their
       | response to a REAL security issue would be like.
       | 
       | Whatever it is, I want to experience it from a distance. I'm out.
        
       | bevacqua wrote:
       | so glad i switched to 1password a few months back
        
       | ochronus wrote:
       | Poor intern! </sarcasm>
        
         | ochronus wrote:
         | This is what I'm referring to, if it's news to somebody:
         | https://www.cbsnews.com/news/hbo-max-intern-test-email-mista...
        
           | stevebmark wrote:
           | I also submit Salesforce, an overall terrible infrastructure
           | and company, publicly blaming an individual for their multi-
           | day global outage https://www.theregister.com/2021/05/19/sale
           | sforce_root_cause... instead of firing Darryn Dieken for how
           | they handled the whole thing.
        
       | alphabettsy wrote:
       | This is a completely unacceptable lack of detail from a security-
       | focused software provider.
       | 
       | Especially given their history of issues and prior poor or
       | misleading communication.
        
       | Kagerjay wrote:
       | so I tried to cancel my lastpass account, I didn't find an easy
       | way to cancel my subscription. So I deleted my account instead.
       | Still not sure if I'll be hit with a rebill next year though
       | 
       | I don't know if this is becoming the norm, it seems really weird
       | that cancelling things is becoming more difficult. I could have
       | sworn cancelling the subscription used to be easier, it seems
       | they've implemented more dark patterns to make this more
       | difficult? Maybe it might be my imagination
       | 
       | Also I moved to 1password and it's wayyyy more polished than
       | lastpass. Not sure why I didn't move to a different service
       | sooner
        
       | meowface wrote:
       | One of the worst-worded security communications I've seen. I'm
       | dropping them.
        
       | jaburjak wrote:
       | > Our initial findings led us to believe that these alerts were
       | triggered in response to attempted "credential stuffing" activity
       | 
       | They originally said they "determined the activity is related to
       | credential stuffing" [1], then edited the blog post and now they
       | are saying it was just a bug. That sounds like their original
       | story was simply a lie.
       | 
       | [1] The original version of their blog post is no longer
       | available, but Bleeping Computer quotes their PR Director:
       | https://www.bleepingcomputer.com/news/security/lastpass-user...,
       | below the "LastPass says it's credential stuffing" heading.
        
       ___________________________________________________________________
       (page generated 2021-12-30 23:02 UTC)