Lastpass setting the delete account div to display: none
infosec.exchange
infosec.exchange
After reaching out to support with screenshots, they fixed the issue and I gained full access, but it is clear to me that Lastpass uses 'display: none' as feature gating and that their software is absolute garbage.
This was 100% intentional on Lastpass' side
I love it when web sites do stuff like this. Makes it so easy to reverse engineer and circumvent their little controls just like you did.
Be the programmer homie
I think both no longer do, but the fact that they once did was very surprising to me.
[1]: https://1password.community/discussion/12237/metadata-is-not...
It doesn't escape me that their threat model could still be that, if they'd relent the cloud-only licensing choice
So, according to them, they encrypt the other fields. I suppose the website field is unencrypted to enable autodetection or something like that.
See: https://www.reddit.com/r/1Password/comments/za0zpn/any_vault...
They specifically do encrypt everything, with URLs being only briefly exposed for favicons (a feature you can turn off easily in 1P and in bitwarden where it is also done.)
Also, I think the failure here is to not use cryptographical methods in the first place which would seem to be a screw-up in a different security specialty.
HN12345[*] is easier to find if you know that the website used is called Hacker News.
[*] Not my actual password.
The real exception is URLs linked to passwords. Some metadata is also unencrypted (e.g. created date).
Both the "secure notes" category and the "notes" section on a password are encrypted.
Take a look at the following analysis of the LastPass data structure:
https://github.com/cfbao/lastpass-vault-parser/blob/master/l...
There's a nice migration guide here: https://support.1password.com/import-lastpass/
Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.
https://bitwarden.com/blog/new-deployment-option-for-self-ho...
- Where do you host all that? If on your home network, then your availability is probably not going to be great. Sucks to be travelling and unable to get to anything because your Wireguard Raspberry Pi died, so you need to make sure you don't need that. If using a cloud or other IaaS you run similar risks to 1Password etc., same with "conventional" root server hosters. If they get owned, you may too.
- How secure is your domain name? DNS? Your app may not warn you if the server answering isn't the one that answered yesterday.
- Is your OS hardened? What else is running on your critical machines? How do you keep everything updated, OS and the actual applications?
- How do you keep abreast of zero days and critical issues in the exposed components?
- How do you know when automatic updates fail? How do you know you've been compromised?
- Do you keep all your machines on the same network? Can a smart lightbulb be an exploit vector?
- What about machines that access Bitwarden or whatever directly – how secure are those?
- What will the whole thing cost, both in terms of time and money? What about upskilling?
- If you manage this for others, which is something that cloud services excel at, with rights management and the like: Are you ready to admin this for the long run, do "customer" service, etc.?
Not saying everyone will need to have cover all those bases, or that you couldn't or wouldn't just take some risks, but if the aim is to get better security than e.g. 1Password with their security teams and posture, then it's worth to at least try to have a complete picture and make conscious decisions on them. What needs to be covered will depend on a lot of factors, including how exposed you think you are.
There may not have been any mass-takeovers of badly secured domains, but we've seen during the Log4J incident that a lot of people believe not being listed on Google means their services cannot be discovered only to find they're getting hammered with attacks, and that attackers have levelled up their capabilities a lot, with large-scale and surprisingly well-engineered attacks springing up pretty quickly. That trend will likely continue and that combination of very capable attackers perceived as incompetent and lots of false assumptions about the actual risks is pretty dangerous; a lot of people will not realize how exposed they are because HTTPS==secure, right?
That no one has targeted self-hosted Bitwarden instances on a large scale so far is no guarantee that no one ever will. People are presumably trying to breach 1Password all the time and so far they seem to hold up well, though LastPass hasn't. What risk is bigger? That a homebrew setup is falling to an untargeted mass exploit? That someone will target you with something more sophisticated? That 1Password is breached and keeping data they say they don't? That LastPass keeps data they everyone assumes they don't but never publicly said they don't, and get breached? If anyone knows, I'd like the details of their analysis, because to me it doesn't seem straightforward at all.
I really dig the 2FA auto-copy to clipboard feature in bitwarden.
Yet another fine reason to use 1Password, which puts a lot of time and attention into user experience stuff like this. I know Bitwarden is the Internet's darling, but holy hell the user experience is so aggressively bad
Bitwarden's previous(?) on-premises deployment script was a raging tire fire, which I openly admit is not exactly a _security_ issue, but it further lowers my lack of faith in them
With all that said, I think both Bitwarden and 1Password are miles and miles ahead of LastPass, so one will for sure be better off just picking one and trying it out. It seems to be a reversible decision, if you wanted to switch again
Thus the advantage goes to 1Password here, since Bitwarden does not require that "second factor" known only to the client (and I'm not talking about 2FA for logins, I mean for the vault)
is that if you're using bitwarden's 2FA authenticator instead of e.g. authy?
I've used various clients with the keepass db format for years now and have not yet been disappointed. Browser integration, Windows, Linux, Mac, and Android clients, open source, encryption I (naievely) trust... ticks all the boxes for me.
They also have incredible support (browsers, iOS, apps, etc...)
However there's an open source reverse engineered server, called vaultwarden (previously bitwarden-rs) that is indeed in Rust and quite slim.
Both can be used with the official clients (which are also open source).
Besides that, yes, Bitwarden is amazing.
Does it work if you have apple devices and also non-apple devices?
Junior LastPass manager: "Okay!"
I switched off of LastPass 2 years ago and convinced my brother to do the same because some things in LastPass apps started to feel very old, especially their 2FA implementation, which signals to me that either their stack is inflexible or there's a lot of churn in their dev teams. When those things are true, that means they're probably just maintaining old code instead of evolving it. Or even more terrifying: they don't know what needs to evolve.
Not regretting it so far.
I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass.
Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well.
When the news broke that the breach was worse than predicted, I sent another letter to the CISO highlighting the concern.
So far, I've had zero responses to any of my emails. Just radio silence. The cold shoulder treatment. Dogs barking in the distance. Etc...
I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision.
Has anyone else had any experience with LastPass offering outright bribes to senior staff to get sales? If I can point to a precedent, that would be helpful.
The moment some exec pushes for some tech or process change, they become incentivized to ignore all problems and sell it as a success.
Kinda like deploying SAP. But this one bolted to another unsuspecting org when the shitshow that everybody was warning them about became reality.
Feh.
Corporate Occam's Razor says that either the CISO thinks that reverting the LastPass move right now would be a business mistake, or that ordinary big-company politics is a factor (in either doubling-down to protect from political fallout, or having to do things delicately behind the scenes).
On corporate politics, your paper trail letters to the CISO could be awkward. You might've tried collegial verbal dialogue with them first.
Corporate INFOSEC has a lot of nonsense, the CISO is often the predetermined fall-person when something inevitably goes wrong, and a paper trail that looks like the CISO made an oops despite being warned isn't a great situation for the CISO.
Fortunately for the CISO, mess-ups by vendors like LastPass are commonplace in enterprise software, and people routinely go unscathed for much obviously worse corporate purchasing/deployment decisions. Bad decisions are almost the norm.
The only thing possible would be something like "reevaluating the situation due to new informations" or an otherwise heroic element, that shows how important CISO is will change the situation. This must come from outside channels: "The prophet has no honor - or at least, little - in his own country" ;)
Using a password manager is one of those infosec memes that gets oft repeated but doesn't make a lot of sense to me as being "more secure". To me it seems like your passwords existing outside of your head in any way is a risk, and to have them all in one place (even encrypted) seems way worse than having to go through the reset dance every once in a while because you forgot one.
EDIT: I was being a bit snarky and I apologize. As some commenters have rightly pointed out for the average person this is better than the uneducated alternative of using the same PW everywhere, and as method for reducing a random person's risk exposure it is extremely transmissible vs the alternatives.
That being said (as a commenter pointed out I should have included this in the post originally) I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. I don't think that these sorts of things are prohibitively complicated, and I think never storing passwords outside of your head has a lot of benefits. That's my personal approach and I think it's a better way to go.
P.S. A lot of the fault lies with requiring accounts for things that don't actually require an account. Another problem that comes out of the SaaS model which can be completely avoided by just not making SaaS.
This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impossible to remember unique strings for each site.
I'd argue that it is not just about remembering passwords. A password manager also helps you remember that you even have an account. I have a similar number of passwords stored as you and there's no way I'd remember all the sites I signed up for (never mind the passwords) if not for the password manager I use.
If I was diligent I could probably track them via confirmation emails (or self-authored "confirmations" for services that don't send a confirmation email), but I can guarantee that a lot would slip through the cracks if I were to attempt that.
A password manager also gives you a convenient place to store (and share) secrets, recovery keys, SSH keys, and similar bits of security related information that you cannot memorize.
If you’re actively under attack no Password Manager, mental algorithm/ password pattern, Yubikey, or MFA will prevent someone from just using your authenticated session(s).
Does that mean we shouldn’t use these mechanisms? Of course not. When the risk is only realized with full compromise—saying XYZ could pose a threat is moot from a security perspective.
ok but that also is prone to a weakness in any part of that chain assuming you even set it up properly in the first place. each piece is another layer that can be hacked or improperly setup.
How many of those accounts are essential?
I create throw-away accounts on the regular.
There are many accounts, but few that really matter. For the ones that matter I take care to make sure I have the passwords. For the rest, who cares :)
Pick two:
(1) memorizable passwords
(2) bruteforce-resistant passwords
(3) account-unique passwords.
I started doing this in college, and it's been super easy to keep up and my passwords are pretty secure.
For example, what do you do when you're forced to change a password? You need to remember that this website doesn't follow the rule. There's also the case of password being used by several websites with different names or urls, you need to remember which is the base one.
Also it's really convenient to store other things than passwords in the password maanger. Like some notes, your customer number, which email you signed up with, some PIN they give you...
And how did LastPass fuck this up anyway?
However, that does mean they can attempt to “brute force” the encryption, trying any number of passwords as often as they like - and it seems some earlier versions of LastPass used rather poor choices with that cryptography, meaning the amount of effort needed to make an attempt is lower than other similar services (plus some users may have rather poor master passwords, making them easier to guess).
Consider that many users may have had very guessable vault passwords, and encryption generally gets weaker as hardware and techniques advance.
I'm not saying for a moment that Lastpass are competent (there's plenty of evidence to the contrary), but... saying that this isn't complicated seems a bit much. This is an extremely complex set of transactions where many many things can be done incorrectly.
There's also of course the general as-yet-not-conclusively-solved problem of non-reproducible builds / trusting remotely-updated code.
I guess someone could key log my master password on my device, copy my vault and pwn me everywhere.
Also, when quantum computing becomes practical enough we password manager users might be in trouble, but surely in that case major changes in infosec would be needed regardless.
"The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs" - https://blog.lastpass.com/2022/12/notice-of-recent-security-...
The "such as..." without enumerating everything is very ominous as well.
You should do some actual math to roughly estimate what it would take to crack a good password. Use a strong password, use a resource-intensive key derivation function, and you should feel extremely comfortable that your encrypted data will not be cracked within your lifetime.
Fortunately for me, I don't use LastPass.
So, I use a password manager.
So you do use a centralised password manager. You just call it email, rather than 1Password.
> I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site.
That gets tedious when you also have to conform to stupid, different password policies on various sites.
If you want to compartmentalize things you could use multiple password databases with different master passwords? The master password is still something you have in your head.
What happens when you need to change a password on one site? How do you know which password algorithm you're using on which site now?
Why am I asking you this? Because I was in the same situation and it became difficult to track. Now I keep all my passwords in a password manager, my 2FA codes in another app/service, and my recovery codes in the third place that's not connect with the first two in any way. Similarly, obviously, I don't have my 2FA service account + password in my password manager.
> I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site.
I’m going to forget it.
Either I use a centralized password keeper or the real login process is the reset password flow.
Using a password manager is probably more secure and convenient than whatever solution a can feasibly come up with in my own.
Everything requires a password and I will not be able to remember them all. It took me about 15 years to finally remember my own SSN.
- Password re-use
- Formulaic passwords
- Simple passwords that are easy to type on a phone
That are easily crackable
Or performing password recovery every time you want to login.
I also found out that I can easily forget passwords if they outnumber 5. Doing creative passwords around websites also does not generate enough entropy if one of your passwords is leaked.
I then tried Trezor/Ledger and Yubi. They are the best solution, theoretically. However, I find myself more than once in a situation where I am at an airport and I need quick access to something through my phone. All options above require a laptop, though with Yubi NFC it might be possible. But that means you are also taking your Yubi everywhere you go...
Bitwarden fixes all of that, or any pw that is open source and self-hosted. I'm using the paid version because 1. I want to support them and 2. self-hosted can be a dangerous option if your server goes down and you are locked out of your stuff...
Employee sends me two emails encrypted. Email 1 contains a list of usernames. Email 2 contains a list of passwords.
Any time I need to access any site, I need to open up the two files that were sent, count down to whatever line that project would be relevant to, then copy/paste the username from the first file. Then do the same with the other. (And hope that I didn't miscount.)
This also doesn't account for things like password expiration. Some of our projects require it, while others don't. I would constantly be receiving new encrypted emails with this info from people, and be struggling to keep the locally stored files updated.
This would then also open me up to higher risk in that, if my computer ever got compromised, or anyone elses for that matter, than then every single password would have to be changed for every single site, and new encrypted emails would have to be sent out.
It's stressing me out just to think about, honestly.
Password managers are, honestly, kind of a clunky and weird idea. I think that the sorts of problems we see are likely always going to be an issue, but until we get passed the entire idea of even using username/password as the standard, than we're going to need a means to manage them in this way. Basically, I wouldn't call Password Managers "secure" but I'd call them "secure-ish". It's making the best of a bad situation.
The thing is... Your password manager should be offline, not a cloud service.
The part I don't get about these discussions is that Firefox saves passwords offline for me just fine, and I have to trust my browser to handle my passwords already anyway. Sure, I have to manually copy a password between devices sometimes. Happens maybe three or four times a year, big f'ing deal.
There's absolutely no reason to add more attack surface by using a password manager.
Why?
If someone wants to avoid having their vault in a LastPass/1Password/… cloud for some reason, it’s also possible to sync the vault through general use cloud solutions like Mega/Dropbox/…
An obvious way to attack typical cloud password managers is via their web apps, which is an endpoint attack and hence bypasses the encryption. This type of attack is much harder for native, offline password managers.
The problem here is that a bunch of unencrypted data was exposed, which is really bad and dumb of LastPass.
Exploiting bugs in the end-user web application, accidentally exposing unencrypted data, unnecessarily collecting all data in a single location in the first place, a break in cryptography leading to a total break of security are all failure modes that only affect cloud password managers.
I agree it's 100% stupid --- "all your eggs in one basket" is exactly the phrase that comes to mind for me too. Centralisation makes for one massive point of failure. If everyone stored passwords in their head or offline, it'd already make it much harder for attackers but there's no recurring $$$ for services in helping people do that. If people can be convinced to believe fake news, what other irrationalities can they be persuaded to believe? It's all just the power of marketing.
The typical person, as long ago as 2015, had around (and possibly over) 100 accounts. I'm seeing people referring to many hundreds managed by LastPass or other password-management systems.
Using, say, a paper-based system whether in a bound journal or a set of index or Rolodex cards, a 500-account archive would take up most of a journal, or a pretty hefty chunk of cards, and that archive itself would require physical security (though at least data exfiltration would be slower than from a digital archive). It's not the sort of thing you could easily carry around with you, or access from multiple locations, should you need to do so.
In corporate use, the problem is compounded by:
- Multiple people requiring access to systems.
- Both shared-account and multi-account systems (e.g., a shared root to servers, master DBA account, or embedded / appliance devices with a single account).
- Multi-office (or remote / home office) access.
- Multi-device access (as in people are accessing systems from multiple devices).
This doesn't necessarily mean that a third-party service is your best or only option, but it strongly tends toward a managed third-party system being convenient where "convenient" means "our business which lacks a true CISO role would be dead in the water without it".
Mind: I'm not defending LastPass here, and I don't use it. The solutions I've seen in the past which have impressed me most were based on managed SSH keys with SSH access to critical systems, and the bare minimum of shared accounts.
I'd also like to see:
1) Far fewer authenticated services where that authentication is not necessary. For the most part, if I can avoid creating a new account, I do. (My circumstances leave me considerable latitude that many people wouldn't have, in this regard.) Systems based on asserted identity through PGP seem to me one option (e.g., rather than logging in and posting content, you'd post PGP-signed content, which the remote system would vet. Similarly, reading private content would be encrypted against your keys. This doesn't address all account-based interactions, but it does cover a large bit of landscape.
2) Physical-token based security particularly based on NFC or Yubikey-type devices. Keep in mind that an earlier widely-used technology, RSA keyfobs which would generate one-time PINs as a 2FA, turned out to have a nasty vuln some years back.
But fewer accounts, PKI-based auth, and physical 2FA ... seem increasingly necessary changes.
As numerous others apparently do: I use a local, encrypted, password keystore that is not managed by a third-party service.
(And don't even get me started on third-party data privacy doctrines.)
The issue isn't you or me, it's what 99% of the world has to use. For the large majority of people, a password manager with one super strong password (and 2FA) makes WAY more sense.
If one goes with the infosec advice that you should calculate the entropy of passwords based on the assumption that the attacker knows the password scheme, then this password scheme provides zero entropy. So if there is zero cost for the cracker to pwn you as well as all the others that don’t have this kind of leetspeak obfuscation then you’re still pwned.
What’s the difference, security wise, to an all in one offering that works the same way under the hood, like 1password cloud or bitwarden?
It seems to me that those syncing keepass databases around are just incurring pain without any real increase in security.
Let's say a national security agency wants access to your passwords. They can "easily" make LastPass send a custom version of the client to your browser. This custom version could send your password to LastPass, allowing them to decrypt your database.
To me it seems like it would be harder to ship a malicious KeePass program to a single user. Especially if that user has installed KeePass using their Linux OS package manager.
(though some sites force unique passwords/and password changes, which can be annoying as I have to remember to bump a value mentally for how many times i've been forced to do it, luckily for the most part it's not an issue)
So, for your practices maybe a password manager is a step down. But for 95% of the popular it’s a step up.
Security is a spectrum, and password managers move most people to a more secure stance. You can yell at people that they can be more secure until you’re blue in the face, but most of them will shrug and ignore you.
My passwords-in-one-place software is not on the Web/Cloud. (And I don’t understand why this point needs to be restated in every Lastpass thread.)
Congratulations, you are now a high value identity theft or kidnapping target.
How about a married man who had a secret account on a dating site?
Or the URL of a medical results portal at a specialist institution? Now your medical history is out in the open.
If someone has access to one or more of your passwords and can reverse engineer your 'algorithm' then you have effectively just reused the same password everywhere. Even if you include some amount of memorized numbers or whatever the entropy is probably a lot lower than having an xkcd-strong password in a manager and randomized passwords stored in it.
> I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site.
Being completely honest, I consider this a terrible strategy. I seriously doubt your "algorithm" is anywhere close to as secure as you think it is. Humans suck at coming up with passwords, period, no matter how clever they think they are, and then memorizing those passwords is at least as difficult. Any algorithm that would actually be secure would take far too long to mentally apply to each website each time you visit it.
Fully featured password managers like 1Password can include much more than just usernames and passwords, which increases their value significantly. Otherwise, users absolutely store that incredibly important information in completely unencrypted places, often synced with the cloud, because it is important information that they need access to, and they want to make sure it doesn't get lost. There is tremendous value in having a user-friendly encrypted vault.
Since the entire vault is fully end to end encrypted with any decent password manager (like 1Password), the weaknesses that repeatedly affect LastPass do not ever apply here. The only thing that matters is having a strong password on your vault, and keeping that password secure. It doesn't matter if 1Password gets hacked, no one will even know what websites you have accounts on. Coincidentally, 1Password also doesn't have the same history of breaches that LastPass does.
The only other security risk beyond a weak password is a supply chain attack, where 1Password ships a compromised version of the 1Password client that steals your vault password, but this is significantly harder for a malicious actor to pull off than the breaches LastPass has dealt with, and any software vendor that you trust could be compromised and install a keylogger on your device, which would achieve the same outcome, so this is not specific to 1Password, and therefore I don't consider it very relevant to the discussion beyond mentioning that other people might bring it up.
> That's my personal approach and I think it's a better way to go.
It's really not, but someone who comes to the internet to rant about this stuff is so strongly convicted of their belief that I don't think I'm going to be able to change it, so I'll just leave it at that. I have cared a lot about cybersecurity for a long time, even before I worked in the cybersecurity industry for a few years, which gave me lots of additional exposure to experienced people and current events.
I have never recommended LastPass to anyone, and I would never recommend it to anyone. 1Password is a completely different story. There are valid open source alternatives, which you can self host, but most people (outside of this forum) are not going to succeed at hosting their own password manager, so it's important to find a trustworthy hosted option.
[0]: https://en.wikipedia.org/wiki/Master_Password_(algorithm)
Take a look at the following analysis of the LastPass data structure:
https://github.com/cfbao/lastpass-vault-parser/blob/master/l...
See the link.
Notes on a site/password go in the "extra" field, which is encrypted.
For most people it looks like the only field that should hold any user-provided unencrypted data is the URL field.
This says notes (encrypted). Do you have a different source?
edit: A rep called right away. They will not give me my money back. It's in their terms and conditions that they won't even if there is a security breach and it's been longer than 30 days since I paid.
[1]: https://support.lastpass.com/help/iknow-my-masterpassword-ho...
Whoever is implementing these changes, shame on you.
edit: this one works: https://lastpass.com/delete_account.php Let's see whether they remove it or not.
* The entire file is encrypted,
* Using OPAQUE,
* On a FOSS local native client
* That integrates with a FOSS browser extension that pulls the information only from the local copy.
* And the only thing the server does is store the file and user account information.
How hard could it be? (Well, outside of getting the cryptography right.)
Looking at this incident and the behavior of LastPass, it seems it's impossible. Or it's too inconvenient for users.
Both Keepassxc[0] and the browser extension are FOSS and the cloud storage may be FOSS, like Nextcloud or "just" whatever works for you rn (Google Drive, Seafile, ...). On android Keepassdx[2] (with autofill) can help too.
The only major pitfalls of this model is cross-device sync, i.e., you edit the file on device A while saving a change on B etc. Though this isn't really a problem if you (a) are using it alone or (b) make sure you keep backups. In case they do conflict it can merge multiple versions.
Keychain integration with 2fa codes is really nice. Passkeys are awesome and I wish more sites implemented this. So far I only saw Google and eBay?
99% of the time, websites that allow you to use a "Security Key" or "Fingerprint" are using WebAuthn, which is all that's needed for PassKeys to work, (besides a few sites that use a stricter webauthn config).
I exported the passwords and imported them onto my self hosted instance of Vaultwarden. After activating the Bitwarden extension for Safari, all of my passwords are now synced to two places.
That's the point OP is making - the button to do it from within the UI has been hidden with CSS attribute
display: none
Note: secure notes is not the same as the “notes” field. Secure notes are encrypted.
Edit: Also it is unclear whether records like Bank Accounts, Social Security Numbers, etc have been fully encrypted.
Offline-only is an additional attack surface reducing move. Sure, you may have to copy passwords manually between devices sometimes, but in practice it happens rarely enough not to matter.
I'm sure LastPass setting the delete account to "display: none" was coincidental
Nevertheless you are right. Clarity is needed here.
Same
> Too much time spend with CSS.
I don’t even use CSS that much anymore.
> Clarity is needed here.
I call for a vote :p the title is perfectly legible as-is to me
I'm sure LastPass setting the delete account to {display: none} was coincidental
The bottom line is: hacks are bad.