Last week, just before Christmas, LastPass made a shocking announcement. An August breach led to another of his November breaches, resulting in hackers gaining access to users’ password vaults. The company claims its login credentials are still secure, but some cybersecurity experts said it could make people feel more secure than they actually are, a move that follows a series of incidents. He strongly criticizes that post, pointing out that it is up to date.It’s hard to trust a password manager.
LastPass’ December 22 statement was “full of omissions, half-truths, and outright lies,” according to a blog post by Wladimir Palant, a security researcher known for helping develop AdBlock Pro and others. reading. Some of his criticisms deal with how the company framed the case and how transparent it is. He accused the company of trying to portray his August incident, in which LastPass said “some source code and technical information was stolen,” as another breach, and that in fact the company was a breach. “couldn’t be contained”.
“LastPass’ claim of ‘no knowledge’ is a run-of-the-mill lie.”
He also emphasized that LastPass admitted that the leaked data included “the IP addresses from which customers were accessing the LastPass service,” and that LastPass logged all IP addresses used. If so, the attackers may be able to “create a complete roaming profile” of the customer. at that service.
Another security researcher, Jeremi Gosney, wrote a lengthy post on Mastodon explaining that he recommends moving to a different password manager. “His LastPass claim of ‘zero knowledge’ is a clichéd lie,” he said, claiming the company “has enough knowledge that a password manager could probably get around it.”
LastPass claims its “zero knowledge” architecture keeps users safe, as the company does not have access to the master password that a hacker needs to unlock a stolen vault. Gosny doesn’t dispute that particular point, but says the phrase is misleading. You’re thinking that, but it’s not, with LastPass, your vault is a plaintext file, and only a few select fields are encrypted.”
Palant also points out that encryption is only useful if hackers can’t crack the master password. This is the main defense in LastPass’ post. “It would take millions of years to guess the master password using commonly available password cracking techniques,” writes the company’s CEO, Karim Toubba.
“This sets the stage for blaming the customer,” Palant wrote. intention Decrypted for at least some customers. And they already have a useful explanation. These customers were clearly not following best practices. However, it also points out that LastPass does not necessarily enforce these standards. Despite the fact that 12-character passwords became the default in 2018, Palant said, “Eight-character passwords still allow us to log in without any warnings or prompts to change.” I’m here.
LastPass’ post also elicited a response from competitor 1Password. On Wednesday, the company’s chief security officer, Jeffrey Goldberg, wrote a post on the site titled “Not in a million years. Cracking LastPass passwords may take much less time.” I have written. In it, Goldberg called his LastPass claim that it would take him a million years to crack Master’s passwords “extremely misleading,” and that the statistic was based on his 12 randomly generated characters. It states that it looks like it expects a password for “Human-created passwords fall far short of that requirement,” he wrote, suggesting that attackers prioritize certain guesses based on how they created passwords that they can actually remember. said it can be attached.
Of course, you shouldn’t take your competitors’ word for it, but Palant echoes a similar line of thought in his post — he argues that the viral XKCD method of creating passwords can be cracked on a single GPU. It claims to take about 25 minutes. Rolling the dice and guessing would take about 3 years on the same hardware. Needless to say, an aspiring actor trying to crack into a particular target’s vault could probably throw multiple GPUs into the problem, reducing that time by an order of magnitude.
“They are essentially guilty of all ‘crypto 101′”
Both Gosney and Palant also dispute LastPass’ actual encryption, but for different reasons. Gosney accuses the company of essentially committing “all ‘crypto 101’ sins” over how it implements encryption and manages data loaded into device memory.
Palant, on the other hand, criticized the company’s post for describing its password-strengthening algorithm, known as PBKDF2, as “stronger than usual.” The idea behind this standard is to make passwords harder to guess by brute force, as each guess requires performing a certain number of calculations. Palant writes:
Another popular password manager, Bitwarden, says its app uses 100,001 iterations and adds another 100,000 iterations when passwords are stored on their servers, for a total of 200,001. 1Password says she uses 100,000 iterations, but that encryption method requires both a private key and a master password to unlock data. According to Gosney, this feature “prevents cracking if someone gets a copy of the vault because the master cannot access it with just his password.”
Palant also points out that LastPass doesn’t always have that level of security, and older accounts may have less than 5,000 iterations. The Barge Confirmed last week. This, combined with the fact that you can use 8-character passwords, makes it difficult to take LastPass’ claims that it takes millions of years to crack a master password seriously. But what about people who have been using the software for years? If LastPass isn’t warning you or forcing you to upgrade to better settings (as Palant is, it’s not). ), but that “default” isn’t necessarily a useful indicator of how concerned users are.
Another catch is the fact that LastPass has ignored pleas to encrypt URLs and other data for years. Palant notes that knowing where people have their accounts can help hackers target individuals specifically. “Threat actors Love to know what you can access. That way, you can craft targeted phishing emails to only those who are worth the effort,” he wrote. He also points out that URLs stored in LastPass can sometimes give users more access than intended, citing examples of password reset links not expiring properly.
There is also an angle of privacy.you can say many About you personally based on the websites you use. What if you used LastPass to store your account information for a niche porn site? Can someone identify the region you live in based on your utility provider account? Does the information you use endanger your freedom or life?
One thing that several security experts, including Gosney and Palant, seem to agree on is the fact that this breach is not clear evidence that cloud-based password managers are a bad idea. This seems to be in response to people promoting the benefits of a fully offline password manager (or, as one commenter suggested, just writing down randomly generated passwords in a notebook). is. Of course, this approach has obvious advantages. A company that stores passwords for millions of users will attract more hackers’ attention than a single computer. Also, it’s much harder to get something that isn’t on the cloud.
But like the promise of cryptocurrency that you will be your own bank, running your own password manager can come with more challenges than people realize. Losing your vault in a computer crash or another accident can be catastrophic, but backing it up risks making it vulnerable to theft. (And did you remember to tell your automated cloud backup software not to upload your password?) Plus, syncing your offline vault across devices is a bit of a hassle, to say the least.
As for what people should do about all of this, both Palant and Gosney are skeptical of how LastPass handled this breach, and the fact that this is the company’s seventh security incident in a little over a decade. For this reason, we recommend at least considering switching to another password manager. Mr. Gosney writes: Happening. (The company’s post reads, “We’ve added additional logging and alerting features to help detect further fraudulent activity.”)
LastPass says most users won’t have to do anything to protect themselves after this breach, and Palant objected to the recommendation, calling it “gross negligence.” Instead, anyone with a simple master password, a low number of iterations (here’s how to check), or a potential “high-value target” should have all their passwords You should consider changing that soon, he says.
Is it the most fun thing to do on vacation? But you also can’t clean up after someone gains access to your account with a stolen password.
Update December 28th at 7:39 PM ET: Updated to include comments from 1Password, which has published its own refutation of LastPass’ claims.
