Hacker News Reader

Comment by next_xibalba | Hacker News Reader

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.

https://blog.lastpass.com/2022/11/notice-of-recent-security-...

Zero knowledge, 100% authority on downloaded JavaScript.

I wish there was a bigger push for integrity checking in the browser. It would be foundational to any solution that fixes that problem.

There is already integrity checking for subresources: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Newcastle University had a proposal for website wide integrity checking: https://github.com/toreini/DOMtegrity

Note that only 7 people have starred it on Github.

I don't think either of those help if the website itself is pwned? SRI is fine if your website is secure but the CDN is pwned, the other one seems to be a defense a website can use against a malicious extension, but the risk with LastPass is if the LastPass website is pwned it can just read your password. You'd need some way to transfer essentially signed app bundles to the browser for the browser to verify, which seems like a different sort of project.

I assume ultimately something like signed releases will become a thing on the web, with the signing process being separate from the other processes so that a hack has to compromise two entirely different systems, not just the build pipeline, to allow new JS to run. Currently the only thing that is signed is the SSL certificate which of course guarantees precisely nothing about the actual website content served from the server other than that someone didn't tamper with it after it was sent.

Who hosts the signature? If you've hacked someones server enough to push out new JS what's to stop you from signing it?

How would you approve updates to any site content in this model? Have users approve every time any embedded JavaScript hash changes?

Until a user logs in and the passwords are decrypted using client software that could be compromised

I think this gives people a false sense of security, yes zero knowledge is extremely useful + cool, and certainly reduces the risk in event of a breach, but all it really means is that _all_ of your passwords are behind some encrypted blob in the open, that would be extremely difficult to decrypt. Not impossible. Certainly any average or even very high-end machine today would have a pretty much 0 percent chance at decrypting the data, it's still out there in the open forever. Imagine in 10 years we have some leaps in quantum computing or discover a flaw in the algorithms use, all a hacker would need to do is go back & decrypt the data to try some credential stuffing attack, etc.

TL;DR is short-term I wouldn't be freaking out of my password manager was hacked, but I would still definitely update all credentials at some point & treat it as an actual breach, and not an "oh no we were hacked but it's okay because zero-knowledge!".

Also how many times have they been hacked now? Who's still using last pass?

My wife's password for Instagram was hacked near September, which was stored there.

They lost user data and passwords and are lieing.

Does this mean usernames and notes are not encrypted in the same way?

Reply on news.ycombinator.com