[HN Gopher] Unusual login activity was due to bug
___________________________________________________________________
Unusual login activity was due to bug
Author : andruby
Score : 125 points
Date : 2021-12-30 16:19 UTC (6 hours ago)
(HTM) web link (blog.lastpass.com)
(TXT) w3m dump (blog.lastpass.com)
| andruby wrote:
| > Our investigation has since found that some of these security
| alerts, which were sent to a limited subset of LastPass users,
| were likely triggered in error.
|
| A lot of corporate text in this blog. This seems to be the only
| sentence where they say that the unusual login activity was
| actually a software error.
|
| (PS: I editorialised the title since the actual title is very
| generic says nothing)
| avsteele wrote:
| Exactly. What a garbage post from LastPass.
|
| What's the error?
|
| - was the message which says 3rd party had the correct password
| wrong?
|
| - was it was sent out to accounts other than those for which
| the 3rd party had the password?
|
| - something else?
| windthrown wrote:
| And even then, "some" of the alerts being "likely" triggered in
| error makes it sound like quite a few may have been actual
| security issues.
| ipiz0618 wrote:
| I saw the post the other day, and immediately switched to
| Bitwarden. I guess I was right that LastPass isn't safe enough.
| Bugs are inevitable but how they spin it shows they don't want to
| take responsibility (what was the bug??)
| Mockapapella wrote:
| Alright, I don't like the deflectionary way they talk. Reminds me
| of this post by Paul Graham:
| https://twitter.com/paulg/status/1366811342699696129
|
| I'm going to switch to another password manager. Is there
| anything that is a drop in replacement for LastPass? ie has a
| browser extension for firefox, hosted in the cloud (I don't want
| to be managing a server for this), and has a mobile app. I've
| heard a lot about bitwarden and keepass, but they're usually
| accompanied by comments regarding self hosting, which I'm not
| interested in doing.
| phillipwei wrote:
| I use 1Password and like it.
| DeathMetal3000 wrote:
| How about the built in Firefox password manager? You can
| (optionally) sync across devices and set it as the password
| store in iOS (probably Android too).
| gpm wrote:
| Bitwarden's hosted service works just fine, you can self host,
| but you certainly don't need to.
| gruez wrote:
| >has a browser extension for firefox
|
| you might want to reconsider this. browser extensions has
| historically been a common attack surface in the past[1].
|
| [1] https://lock.cmpxchg8b.com/passmgrs.html
| [deleted]
| [deleted]
| elFarto wrote:
| I'm using Enpass, which mostly works fine. However, they've
| recently moved to a subscription model which is unfortunate,
| where-as I bought the Android version a while ago which gave me
| a 'Premium license'.
| charles-m-knox wrote:
| You can use Bitwarden's official servers without self-hosting
| anything at all. I did it for a couple years and it was a great
| experience.
| shafyy wrote:
| I second Bitwarden!
| BOOSTERHIDROGEN wrote:
| https://bitwarden.com/pricing/
|
| You use Bitwarden premium for 10$/y
| quelltext wrote:
| Why not the free version?
| zimpenfish wrote:
| I pay for premium even though I don't really use any of
| their premium features (and could easily host my own)
| because I like the Bitwarden product and want them to
| continue as a company (without having to sell out to
| someone like LogMeIn...)
| stingraycharles wrote:
| This is not just for startups or blog posts, but all
| communication: people that aren't confident in what they're
| saying, tend to use a lot of words to disguise it. The opposite
| is also true.
| jrockway wrote:
| I switched from LastPass to 1Password and the export/import
| worked flawlessly. I didn't switch because of this issue,
| rather I use 1Password for work and thought it was just better,
| so I made the jump for my personal stuff.
| LeoPanthera wrote:
| I use 1Password. It meets all your criteria and, IMHO, has by
| far the best UI in both web and app interfaces. $35.88/year
| riffic wrote:
| there's not a lot of _quality_ in the LastPass product, and there
| hasn 't been for a very long time. There are much better
| competing products to use instead.
| dang wrote:
| Ongoing related thread: _How did LastPass master passwords get
| compromised?_ - https://news.ycombinator.com/item?id=29735132
|
| Recent and related:
|
| _LastPass Login Attempted Activity Blocked - More Information_ -
| https://news.ycombinator.com/item?id=29731317 - Dec 2021 (12
| comments)
|
| _LastPass says no passwords were compromised following breach
| scare_ - https://news.ycombinator.com/item?id=29723319 - Dec 2021
| (68 comments)
|
| _LastPass users warned their master passwords are compromised_ -
| https://news.ycombinator.com/item?id=29716715 - Dec 2021 (313
| comments)
|
| _Ask HN: How did my LastPass master password get leaked?_ -
| https://news.ycombinator.com/item?id=29705957 - Dec 2021 (508
| comments)
| [deleted]
| Havoc wrote:
| They really botched the entire thing.
|
| Bunch of people report their unique password gets this message
| and they investigate credential stuffing? Makes no sense.
|
| >some of these security alerts, which were sent to a limited
| subset of LastPass users, were likely triggered in error.
|
| "some"? "likely"?
|
| They really don't sound like they've got a grip on this
| singlow wrote:
| There are probably a baseline of real security alerts for 3rd
| party credentials per day. For any given user, hers may have
| been from this bug or it may have been a real attack. If
| normally there are 200 alerts per day but while this bug was
| present there were 20k per day, then any given message was
| likely to have been from the bug, but some were probably real.
| thrwaway9871 wrote:
| > Bunch of people report their unique password gets this
| message and they investigate credential stuffing? Makes no
| sense.
|
| You never worked in IT if you believe what your customers tell
| you, especially the ones that don't pay you.
| Croftengea wrote:
| With Bitwarden (which is better, cheaper and more open) I
| honestly don't see any good reason to use LastPass now given
| their poor track record of security incidents and naive (not to
| say stupid) business decisions.
| registeredcorn wrote:
| rlex wrote:
| I selfhost bitwarden with rust implementation called
| vaultwarden, it uses little to no resources and works
| flawlessly. Compatible with original clients, too. Never looked
| back.
| kennywinker wrote:
| Where do you host it? I was thinking I'd host it on my NAS
| and only sync when i'm on my local network. Not sure if
| that'll work with the clients? My nas is also it's too old to
| have a supported docker package, so that's a bit of a hurdle
| there. Pretty uncomfortable with the idea of hosting it on
| digitalocean or similar... wondering what others do?
| rlex wrote:
| Personal k8s cluster
|
| >Pretty uncomfortable with the idea of hosting it on
| digitalocean or similar
|
| Everything is encrypted. Use strong master password and
| 2fa, even if your VM gets dumped and your password gets
| stolen there's no data they can recover. Alot of people
| host it on raspberry at home, if you have VPN to home it
| can be more secure. Also clients are synced, so you can
| sync while at home network - your in-browser or in-app
| vault will be available even if server is not reachable at
| the moment.
| klyrs wrote:
| If your VM gets dumped and your password gets stolen, are
| you not vulnerable to a SIM swap? Asking out of paranoia.
| rlex wrote:
| Nobody forces you to use sms for 2fa. I'm not even sure
| vaultwarden supports SMS. I use https://getaegis.app with
| usual 2FA TOTP, also protected by password. So for
| someone to gain access to your vault will need:
|
| * access to your server with bitwarden/vaultwarden (this
| one is tricky, someone might inject something in webui JS
| if it's open to public internet, so keeping it VPNed
| might be good idea indeed)
|
| * access to your master password
|
| * access to your mobile device / totp storage and
| password for it
|
| I'd say it's pretty safe from random hackers, but if
| someone is dead set on getting your data, well
| https://xkcd.com/538/
| flandish wrote:
| I do that but also allow sync when not on local network -
| via traefik and such as a reverse proxy. However ... I may
| still turn that off as I have wireguard on everything
| anyway, so it's super simple to turn wireguard on, sync
| "locally" and then turn wireguard off.
| Closi wrote:
| I subscribe to 1Password which has a similar security model -
| it's a bit more expensive but I've been very happy with it and
| it's very polished.
|
| (Plus their support is excellent and saved my butt once - I
| upgraded my personal account to a family account and made my
| father an admin, after which he decided to 'cancel' his account
| by deleting the full family account, despite a warning saying
| everyone's passwords would be permanently erased for the full
| family. I lost access to all my accounts, however thankfully
| the 1Password team were incredibly helpful and managed to
| recover our vault from a backup).
| vorpalhex wrote:
| I hope they intend to provide more proof than their word...
| 5- wrote:
| i don't understand why people comfortable with running a vps
| bother with these cloud services.
|
| i use pass https://www.passwordstore.org/ git sync'd (encrypted)
| to a $5/month vps that also runs many other things. you could
| even get a free one from large cloud providers.
|
| pass has lots of clients for all kinds of platforms, works really
| well (how could it not? it's just a thin wrapper around git +
| gpg) and i don't have to worry about anything like the topic at
| hand.
|
| what am i missing?
| Arainach wrote:
| There's a longer chain of trust and research required here. I
| need to trust the original authors, the authors of whatever
| Android client I want, the authors of whatever Windows client I
| want, and so on. I need to figure out what options are
| available and why I should trust them and I need to constantly
| continue doing so to make sure those apps aren't sold to some
| other party I don't trust.
|
| There's no simple mechanism for sharing. Many clients don't
| support using multiple stores. Even if they did, the UX is
| never one that I would be able to convince anyone other than a
| software engineer to use.
|
| Single-party centralized solutions offer a simplified trust
| model and a common auth service makes sharing and recovery much
| simpler.
| aborsy wrote:
| This set up is much more secure than online password
| management.
| FredPret wrote:
| Is there a reason an all-Apple user would want to use a password
| manager like this?
| smilespray wrote:
| I use the Apple keychain and am perfectly happy with it. If you
| need team functionality you might want to look around for
| another solution. I ditched LastPass years ago because of
| crappy UX/UI.
| kup0 wrote:
| Posts like this are so frustrating. It's a whole lot of words to
| say nothing. There's a small mention of the alerts being
| triggered by a bug/error, but it is surrounded hundreds of words
| of deflection/spin.
|
| Additionally, it is bothersome that absolutely zero detail on
| this error is given.
|
| Given the incredible gravity of the situation (potential of
| having one's entire password vault compromised), I expect a
| better response than this
| unixbane wrote:
| never used them but just went to their website and concluded
| it's some novice programmer who has no skill and wants to make
| a business around software so after going through a few ideas
| he came up with a password manager. no idea why people (on HN)
| use these things.
| stanski wrote:
| Kind of a poor way to judge a product, I'd say. I'm no longer
| a lastpass user but if you read up on them you'll find that
| your initial assessment is _way off_.
|
| They've had their issues but the idea of it being built by a
| novice programmer is very far from reality.
| unixbane wrote:
| I use a trivial program that manages a list of passwords
| generated using /dev/urandom constrained to simple ascii
| chars and provides basic features like copying it to
| clipboard to avoid shoulder surfing. It took an hour to
| write 10 years ago. and judging software from how bullshit
| their website front page is has not failed me a single time
| in the last 20 years. my predictions of what vulns they
| have is always spot on. im not interested in your (HN's)
| definition of reality as they still think string injection
| attacks are fundamentally hard to solve
| kup0 wrote:
| They're a relatively well-known company, currently owned by
| LogMeIn, though that seems like it will be changing. It's
| definitely not some solo person's side project or anything.
| They're one of the most well-known names (whether good or
| bad) in the password manager category.
|
| While they have had security trouble in the past- they're big
| enough that it's not surprising at all to me that many
| people, including those on HN, are their customers.
|
| I would also not be surprised if they lose a chunk of tech-
| savvy customers over this- as they should.
| feldrim wrote:
| This may very well be a good example of strategic ambiguity.
| They grant themselves a broad area for future, not a limiting
| direction. Since nothing is presented precisely, the following
| reports, articles, announcements can be shaped the way the
| environment requires.
|
| With this, they say nothing more than "it was not a cyber
| attack". It is a statement of relief for shareholders. It's not
| about the customers.
| stingraycharles wrote:
| Assuming for a moment that what they claim is true (never
| attribute to malice that what can be explained by
| incompetence), that it is indeed a bug / password reuse, what
| information would you have liked them to give? It seems to me
| that they're communicating they're not hacked, looked into the
| issue and found nothing special.
|
| I do agree that they're patting themselves on the back a bit
| too much and also should have been a bit more humble when
| dismissing things as password reuse.
| kup0 wrote:
| In general, when tech-related companies have problems like
| this (with potentially severe consequences), I think a post-
| mortem should be a minimum expectation. I just feel like the
| way this post frames the issue is almost like it doesn't
| matter that much to them. "Oops, it was just a bug, for some
| accounts, we think. All fixed!" just doesn't sit well with me
| (maybe that's a me problem...)
|
| I would want some follow-up answers, to questions like:
|
| - Why would a bug trigger alerts that are as severe as
| "someone else tried to use your unique not-used-elsewhere
| master password"? I understand bugs, even severe ones,
| happen- but can I trust that your alerts aren't going to cry
| wolf on my account going forward?
|
| - Why did you originally conclude it was credential
| stuffing/reuse, when there are a number of people that got
| the alert that clearly stated they had never used their
| master password anywhere else? Are you monitoring user
| reports / social platforms / etc to respond to and address
| these situations?
|
| - When you say "some" were triggered in error- does this mean
| some of the attempts were legitimate, or were they all due to
| a bug? Do you even know the answer to this question? If there
| are legitimate attempts on non-reused-password accounts, it
| appears master passwords are leaking/being captured/etc in
| some other way and that deserves further investigation
|
| I just want more than a sentence or two surrounded by 10+
| paragraphs of "this happened because of how good we are at
| keeping you safe"
| tryptophan wrote:
| Not communicating clearly and pretending like dumb blog posts
| like this are an answer are both major red flags.
|
| I don't understand the thought process behind such legal-ese
| talk. Do they think we are dumb and can't see through it?
| Putting this sort of stuff up is just saying "we don't care
| about you in reality but here is a post saying we do".
| kup0 wrote:
| I think one thing that really got to me is that the post is
| by the _VP of Engineering_ , which for some reason gave me an
| expectation of a detailed explanation of the problem, only to
| find none
|
| The post sounds like it was _actually_ written by either
| legal or marketing instead
| redis_mlc wrote:
| peakaboo wrote:
| Some (bad) companies have a VP of Engineering that has no
| clue about technology and with a background in another
| field.
|
| But come on, Lastpass has been on a downwards slope for a
| very long time. They can't even make their main product as
| good as Bitwarden which is free.
| thrwaway9871 wrote:
| So much this. Don't use any online password managers but
| with this response lastpass became godaddy for passwords in
| my book.
| nescioquid wrote:
| And when the VP of Engineering writes
|
| > some of these security alerts...were likely triggered in
| error
|
| one can conclude that they do not _know_ that _any_ of the
| alerts were triggered in error (else he would have said as
| much). Some of the VP 's statements were likely triggered
| by the legal department, though I don't know that any
| actually were. It doesn't exactly shed light on anything.
| klyrs wrote:
| If I were to guess, anything written by the VP of
| Engineering would be heavily edited by legal and marketing
| until the result was indistinguishable. Source: I work for
| a company that doesn't let anything go out without approval
| of Legal, Marketing, and a few other nebulous
| 'stakeholders'
| kabdib wrote:
| As an early LastPass adopter, I paid for about ten years of their
| Premium tier (it was pretty cheap early on). After they were sold
| the first time, it took them several years to stop billing me
| every year anyway, so I've still got about a decade of pre-paid
| Premium. No, they wouldn't refund my extra payments. Strike one.
|
| I'm moving to something else now. Other companies might get away
| with "we fixed a bug, don't worry your pretty little heads." Not
| this application. Strike two.
|
| If this is nothing to worry our PLH's over, I wonder what their
| response to a REAL security issue would be like.
|
| Whatever it is, I want to experience it from a distance. I'm out.
| bevacqua wrote:
| so glad i switched to 1password a few months back
| ochronus wrote:
| Poor intern! </sarcasm>
| ochronus wrote:
| This is what I'm referring to, if it's news to somebody:
| https://www.cbsnews.com/news/hbo-max-intern-test-email-mista...
| stevebmark wrote:
| I also submit Salesforce, an overall terrible infrastructure
| and company, publicly blaming an individual for their multi-
| day global outage https://www.theregister.com/2021/05/19/sale
| sforce_root_cause... instead of firing Darryn Dieken for how
| they handled the whole thing.
| alphabettsy wrote:
| This is a completely unacceptable lack of detail from a security-
| focused software provider.
|
| Especially given their history of issues and prior poor or
| misleading communication.
| Kagerjay wrote:
| so I tried to cancel my lastpass account, I didn't find an easy
| way to cancel my subscription. So I deleted my account instead.
| Still not sure if I'll be hit with a rebill next year though
|
| I don't know if this is becoming the norm, it seems really weird
| that cancelling things is becoming more difficult. I could have
| sworn cancelling the subscription used to be easier, it seems
| they've implemented more dark patterns to make this more
| difficult? Maybe it might be my imagination
|
| Also I moved to 1password and it's wayyyy more polished than
| lastpass. Not sure why I didn't move to a different service
| sooner
| meowface wrote:
| One of the worst-worded security communications I've seen. I'm
| dropping them.
| jaburjak wrote:
| > Our initial findings led us to believe that these alerts were
| triggered in response to attempted "credential stuffing" activity
|
| They originally said they "determined the activity is related to
| credential stuffing" [1], then edited the blog post and now they
| are saying it was just a bug. That sounds like their original
| story was simply a lie.
|
| [1] The original version of their blog post is no longer
| available, but Bleeping Computer quotes their PR Director:
| https://www.bleepingcomputer.com/news/security/lastpass-user...,
| below the "LastPass says it's credential stuffing" heading.
___________________________________________________________________
(page generated 2021-12-30 23:02 UTC)