On Tuesday, 5 February 2019 07:55:41 GMT Dale wrote: > Mick wrote: > > https://en.wikipedia.org/wiki/LastPass#Security_issues > >
> From what I read, no users had their passwords compromised in those. I read it differently. LastPass didn't know if any passwds were compromised (or wouldn't tell you). As a precaution they asked users to change their master passwd, while they changed their server's salt. In addition, there were XSS vulnerabilities later on, which is probably to be expected with JavaScript and similar technologies. > As > I pointed out earlier, the passwords are already encrypted when they are > sent to LastPass. If I called LastPass, could prove I am who I claim to > be and asked them for a password to a site, they couldn't give it to me > because it is encrypted when it leaves my machine. I don't know exactly how the LastPass architecture is configured, other than it relies on device based encryption activated with JavaScript, but anomalies they observed in incoming and outgoing traffic on the 2011 incident indicate someone was interfering with their data streams. Given Diffie-Hellman could be compromised (e.g. as per Logjam) by precomputing some of the most commonly used primes in factoring large integers, it may be someone was undertaking comparative analysis to deduce ciphers and what not. If the server salt was obtained, then one layer of encryption was compromised. All this is juxtaposition and my hypothesizing does not mean LastPass is not useful, or not secure. It just means its design is not as secure as locally run simpler encryption mechanisms, which do not leave your PC and are not stored somewhere else. The greater surface area a security system exposes, the higher likelihood someone will take a punt at cracking it. A browser, sandboxed or not, has far too many moving parts and exposed flanks to keep crackers and state actors busy. I expect with advances in AI this effort will accelerate logarithmically. > As I pointed out to Rich, I don't expect these tools to be 100%. There > is no perfect password tool or a perfect way to manage them either. No > matter what you do, someone can come along and poke a hole in it. If > you use a tool, the tool is hackable. If you use the same password that > is 40 characters long for several dozen sites, then the site can be > hacked and they have the password for those other sites as well. The > list could go on for ages but it doesn't really change anything. We do > the best we can and then hope it is enough. Using tools is in my > opinion better than not using a tool at all. At the least, they will > have a hard time breaking into a site directly without my password. It > beats the alternative which is cutting off the computer and unplugging > it. :-( Yes, well said. A disconnected and switched off PC is probably quite secure, but what use is this to anybody. LOL! The effectiveness of PC security is challenged on a daily basis and you eventually have to arrive at a personal trade-off between security and usability. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
