Hacker News Reader

pwmanon LastPass Now Checks If Your Sites Are Affected by Heartbleed

We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem.

We wish we had all site's certificate fingerprints from before this started so we could utilize that data -- if anyone has it, an email to securit@lastpass.com would be greatly appreciated.

pwmanon LastPass and the Heartbleed Bug

We implement everything in JavaScript on that page if you're trying to login from the website -- which is as secure as that page load -- LastPass recommends people utilize the extensions to mitigate this risk.

Our choice could be to not allow people to utilize the website but it seems like educating people of the risks and letting them decide is the best policy.

pwmanon LastPass and the Heartbleed Bug

You don't get very much by MITM of LastPass compared to other targets -- the extensions aren't going to pull down Javascript, the update process only uses signed binaries... You might be able to put people utilizing LastPass.com to login which we don't recommend and isn't done by the vast majority of people.

pwmanon LastPass and the Heartbleed Bug

Extensions/Downloads are all cryptographically signed -- I'd hope if you're installing password management software like this that you see that it's unsigned or signed by someone other than LastPass.

Using the extensions to login -- it doesn't matter nearly as much if you're MITM as it would if the website was MITM and you login from the website -- what's in the middle is mostly useful only to do things like mess with you -- delete your sites / DOS your account, but in no way exposes your encrypted data.

The combination of extension use instead of going to the website, perfect forward security, data that's encrypted with a key that doesn't leave your devices, the fact that what you'd most likely leak is a session ID which will be replaced on your next login and that we haven't actually seen anyone utilize heartbleed to get a SSL key yet combine to make LastPass a tough target.

Given everything it'd be far easier to target all the banks and email clients that simply send your credentials right over the wire.

This is definitely a big problem and we're currently working on tools to try to help people recognize what's at risk and help them update it.

pwmanon The war against autocomplete=off (2013)

LastPass has a setting to respect autocomplete -- it's off by default because so many sites use it inappropriately.

pwmanon We hacked Siri on iOS 7 to interface with Spotify, Venmo, other third-party apps

The surprising part of this is that HTTPS isn't used for the requests to Siri/Google so that this is even possible without warnings / errors.

pwmanon LastPass 3.0 Is Here: New Design, New Features

This was quite an experience for us here at LastPass utilizing multiple UI/UX design firms, splitting them between products and attempting to land new UI/UX experiences all at the same time. If anyone has questions or thoughts on it we're all ears.

pwmanon Ask HN: Who is hiring? (October 2013)

LastPass https://lastpass.com Xmarks https://xmarks.com Fairfax, VA (DC area)

- Full time developer (we support everything so be ready to play with everything) - Full time support analysts

Email jobs at lastpass.com - CC joe at lastpass.com, and mention hacker news.

pwmanon Name.com Tells Customers To Change Password Due To Breach

One of the reasons we liked name.com was their multi-factor support and email on action support, but it's all an illusion if hackers can get in at this level and go undetected until they helpfully post it publicly!

pwmanon LivingSocial Hacked – 50 Million Customers Affected

Released late in the day on a Friday to try to minimize the news cycle and guarantee fewer people will see it.

pwmanon Ask HN: Tools of the trade, 2013 edition

https://LastPass.com

http://Gotomeeting.com

http://Drive.google.com

pwmanon LLC vs. S-Corp vs. C-Corp

Author is likely incorrect about the C Corp retained earnings taxes, the tax owed for 100k of profit for Federal only would be more like $22,500 as the 15% rate is only for your first 50K of profit.

The corporate tax rate is very high and should really be thought of as 35% if you have meaningful profit.

You may also be able to defer profit if you're delivering service after you're paid for it (and you should be doing this), this keeps more money in the company without paying the taxes immediately. A far more important lesson.

pwmanon Metasploit Rails 3 Remote Code Execution Hours Away

This is a huge downside -- accidentally type your password on a device you shouldn't have? You now have to update every site rather than just updating your master password.

pwmanon Metasploit Rails 3 Remote Code Execution Hours Away

You can use LastPass as completely zero knowledge app by not utilizing the binary extensions for Chrome or Firefox.

pwmanon Announcing the First Beta Release of Persona

Can you be more specific as to how you find the LastPass UX lacking? Getting UX right is a priority for LastPass too!

pwmanon Bitcoinica MtGox account compromised

It's even beyond using a duplicate password which as you point out is ignorant. They were so unclear on the concept that they used a password that was written down into their source code, and once that source code was stolen they didn't change that password!

They also failed to utilize the two different free multi-factor options LastPass offers (not to mention the premium ones).

LastPass tries to educate people and push them on not utilizing the same password anywhere with a security challenge, but that clearly didn't teach the concept here.

Their last breach involved losing access to their email: info@bitcoinica.com -- so what email did they use here with LastPass? info@bitcoinica.com They didn't utilize the security email either.

It is all unbelievable.

How do we drag this out of cargo cult security?

I see some are pushing certifications; If I made a free LastPass certification that both proves you understand the concepts, and that you're currently putting them into practice by showing that you/your company has multi-factor enabled would people demanded it?

pwmanon LastPass - LinkedIn Password Checker

Try the prebuild: https://lastpass.com/dlpre

pwmanon LastPass - LinkedIn Password Checker

https, we're not using 'GET' parameters for the hash (which is almost certainly ending up in log files on leakedin's site). We also just came out with a version for eHarmony's breach: https://lastpass.com/eharmony/

pwmanon Fuck passwords

I love how LastPass isn't the solution because ... "it's a computer program".

What kind of Luddite computer programmer is against using computer programs to solve their problems? Yet is fine with using SSH keys?

The argument of bloat is garbage -- you can utilize LastPass bookmarklets at the cost of exactly 1 bookmark in your browser. That adds a 1K bookmark and a very small amount of JavaScript to the page if and only if you utilize it.

Password certainly are painful, and our whole goal at LastPass is to make it easier. We'd be happy to help make other scenarios people are experiencing better, we've looked at handling ssh a number of times (putty in LastPass for Applications for example) -- anyone have a preference for how we tackle that next?

pwmanon How Carrier IQ was wrongly accused of keylogging

If you actually test it yourself you see that they only capture phone keypad presses, and the bottom hardware keys. They don't capture the actual screen keyboard at all, that's why Trevor's video does not show the actual keyboard being captured -- just like we found: http://blog.lastpass.com/2011/12/carrier-iq-verifying-your-l...

I'm not defending them, many of their practices are loathsome, but crucify them for what they've actually done.

pwmanon Ask HN: Who is Hiring? (November 2011)

Vienna, VA (DC area). Full time.

LastPass / Xmarks

Want to play with every new toy that comes out and make apps for them?

https://lastpass.com/jobs

Joe@LastPass.com

pwmanon AVOS’ Delicious Disaster: Lessons from a Complete Failure

http://www.Xmarks.com

pwmanon Inspired by HN: back with my 2 month project

1) Ensure your 'ebay' query doesn't automatically correct the spelling, likely a general problem -- For LastPass I have hundreds of results like: Disney Trading Pin - FASTPASS PIN SET OF 5 -- perhaps throw out results without the keyword in the result set returned.

2) My ranked sources are weird -- google.pl is one of the top sources.

3) My topic cloud has URLs in it which looks... bad.

4) LastPass must be broken up into Last Pass in places as Ben Rothelsberger is prominent in LastPass' topic cloud.

Good luck!

pwmanon Ask HN: what happened to LastPass?

Your speculation is correct -- we re-keyed the certificate just as a precaution. Rolling a new cert is tough as thousands of people's clocks are wrong, so we thought we'd give it a full day so those people wouldn't receive errors -- we didn't realize the old one would be revoked so quickly (it was automatic with the rekey).

pwmanon Another software fail: Trapster loses emails & passwords

Use LastPass and generate random passwords, you'll just chuckle at the next company that does this rather than freak out...

pwmanon Password Manager LastPass Acquires Xmarks

LastPass is already profitable enough to continue supporting Xmarks indefinitely.

pwmanon Password Manager LastPass Acquires Xmarks

The service will remain free, and we're happy to have you as a free user. Our plan is to continue to add mobile device support and ancillary services on top to convince you that maybe $1/month is worth it. We only need to convince a few percent of people to make this a success.

pwmanon Password Manager LastPass Acquires Xmarks

Enough people pay for the advanced service with LastPass (Mobile phone support) to cover all the free users. Even if LastPass was nuked every user still has access to all their data -- a encrypted cached copy is kept on every browser and every phone you ever use. Pull the plug out of your computer and verify yourself...