Hacker News Reader

Comment by bigmattystyles | Hacker News Reader

I work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just waiting for a call from infosec asking me to log on and to rotate a bunch of creds. Happy Holidays.

View on HN

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months.

I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass.

Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well.

When the news broke that the breach was worse than predicted, I sent another letter to the CISO highlighting the concern.

So far, I've had zero responses to any of my emails. Just radio silence. The cold shoulder treatment. Dogs barking in the distance. Etc...

I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision.

Has anyone else had any experience with LastPass offering outright bribes to senior staff to get sales? If I can point to a precedent, that would be helpful.

He doesn’t need to be getting a kickback. He probably just wants to spin as hard as he can that his poor choice cost did not cost the company a bunch of money.

If it only costs some money that's a good outcome.

Emotional kickbacks are still kickbacks.

I wouldn't suspect kickbacks immediately, simply trying to avoid blame for the initial decision seems motive enough.

It's human nature to repeatedly double-down on any strongly stated opinion until its defence becomes untenable. It takes repeated intentional practice to keep your ego in check.

You are reading too much into it. Probably ciso is busy with other things and cannot respond to every's smartass wishes.

How much of a smartass can you be when Lastpass keeps lying about how bad each of the numerous hacks actually were?

There is absolutely no reason to suspect kickbacks when there is already a massive incentive to not be seen as responsible for a massive blunder and waste of company resources.

The moment some exec pushes for some tech or process change, they become incentivized to ignore all problems and sell it as a success.

Yeah.

Kinda like deploying SAP. But this one bolted to another unsuspecting org when the shitshow that everybody was warning them about became reality.

Feh.

You may want to reach to a higher level on this one.

I totally side with you. But what do you expect? That some senior manager admits he did a mistake? This will never happen. Too many times did I witness similar situations.

The only thing possible would be something like "reevaluating the situation due to new informations" or an otherwise heroic element, that shows how important CISO is will change the situation. This must come from outside channels: "The prophet has no honor - or at least, little - in his own country" ;)

> I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision.

Corporate Occam's Razor says that either the CISO thinks that reverting the LastPass move right now would be a business mistake, or that ordinary big-company politics is a factor (in either doubling-down to protect from political fallout, or having to do things delicately behind the scenes).

On corporate politics, your paper trail letters to the CISO could be awkward. You might've tried collegial verbal dialogue with them first.

Corporate INFOSEC has a lot of nonsense, the CISO is often the predetermined fall-person when something inevitably goes wrong, and a paper trail that looks like the CISO made an oops despite being warned isn't a great situation for the CISO.

Fortunately for the CISO, mess-ups by vendors like LastPass are commonplace in enterprise software, and people routinely go unscathed for much obviously worse corporate purchasing/deployment decisions. Bad decisions are almost the norm.

Oh dear, what you were doing was just a little bit less than pointing at the CISO's nose and saying: "Look, you don't know what you are doing by choosing such a sh*tty product!" Of course, nothing going to happen. As any actions taken afterwards to mitigate the issues you highlighted can be and amlost for sure will be taken as evidence of failing to do his/her job. All office politics, nothing to do with facts.

At my previous employer I remember saying don't do it with LastPass as the credentials will get stolen. The so-called tech lead said, "I hear what you're saying but it's been decided." I wonder what he is thinking now when he hears about this. Probably nothing.

Reply on news.ycombinator.com