Author Topic: LastPass hacked: change your passwords  (Read 9400 times)

ergophobe

  • Inner Core
  • Hero Member
  • *
  • Posts: 9320
    • View Profile
Re: LastPass hacked: change your passwords
« Reply #15 on: June 18, 2015, 03:40:15 PM »
I use LastPass to generate gibberish for those fields on other sites. What's my mother's maiden name? */d3*mQ<!23Gp  ::)

I do that too and a couple of other things that I am now leery of. My reading of all this is Lastpass does an amazing job with compartmentalizing data so that passwords are on separate machines from account login URLs (based on the last suspected intrusion and their reporting of it) for example.

I realized in reading around about this that I'm sometimes using notes in ways for which they were not designed and that means I'm potentially defeating some of the security measures LastPass takes on my behalf. So Secure Notes are secure, but I think Notes are less secure, more similar to the protection on your account URLs than on your password and username.

I'm not 100% certain on that, but reading between the lines, I think the conservative assumption is to assume that your Notes are safer than 99% of the places you would keep them (Dropbox, Google Docs, email, etc), but not as secure as your password.

ergophobe

  • Inner Core
  • Hero Member
  • *
  • Posts: 9320
    • View Profile
Re: LastPass hacked: change your passwords
« Reply #16 on: June 18, 2015, 03:53:52 PM »
Actually, I might be wrong about that
https://forums.lastpass.com/viewtopic.php?f=12&t=171945&p=569945&hilit=notes#p569945

I have no idea who jpenny84 is and I haven't found anything official.

For example, the help page for Secure Notes says (my emphasis)

Quote
Since all sensitive data is encrypted locally on your computer with the key that only you know before it is sent to LastPass, you can store your most sensitive data with the knowledge that is it is completely safe.

https://helpdesk.lastpass.com/secure-notes/

I can't find anywhere official that tells me whether or not the Notes on a normal login are considered sensitive and whether or not they have the same level of encryption and what level of compartmentalization they have from other data.

My concern is less with encryption than with compartmentalization. One of the main strengths of LP, according to my possibly incorrect understanding, is that passwords and usernames and "other data" are on three different sets of machines. What I worry about with Notes is that if the notes have enough info to allow for a login, they might be stored together with the "other data" which would include the account URL. So you're defeating LP's compartmentalization of data.

It's like if you're running a spy network and you have three separate cells that don't communicate with each other so if you bring one down, you can't bring all three down. And then you assign them all the same PO Box somewhere to get their mail.

Could be totally wrong, but until proven wrong that's the assumption I'm operating under.

ergophobe

  • Inner Core
  • Hero Member
  • *
  • Posts: 9320
    • View Profile
Re: LastPass hacked: change your passwords
« Reply #17 on: June 18, 2015, 08:21:57 PM »
BTW, not to beat this to death, but if you are changing your master password, it's worth reading this first

https://blog.agilebits.com/2011/08/10/better-master-passwords-the-geek-edition/

[edit - the above link is a decent article, but the wrong one]
https://blog.agilebits.com/2011/06/21/toward-better-master-passwords/
[/edit]

bill

  • Devil's Avocado
  • Global Moderator
  • Hero Member
  • *****
  • Posts: 1286
  • Avast!
    • View Profile
    • Email
Re: LastPass hacked: change your passwords
« Reply #18 on: June 19, 2015, 01:01:40 AM »
I realized in reading around about this that I'm sometimes using notes in ways for which they were not designed and that means I'm potentially defeating some of the security measures LastPass takes on my behalf. So Secure Notes are secure, but I think Notes are less secure, more similar to the protection on your account URLs than on your password and username.

I'm not 100% certain on that, but reading between the lines, I think the conservative assumption is to assume that your Notes are safer than 99% of the places you would keep them (Dropbox, Google Docs, email, etc), but not as secure as your password.

I think you're getting confused here. During the breach announced July 15, one of the elements that was leaked was password reminders (a type of notes field).  Some people will put some really revealing info in there that might help password crackers guess their master password. Some people will even put their password in there! That password reminder data was not encrypted by LastPass.

They separate your master password hash, e-mail, and password reminder, salt, etc. from the main encrypted blob of your account, which contains all your data. Secure Notes, and the notes you add to password records, and everything else inside your LastPass account is all hashed and encrypted locally on your machine and sent to LastPass as one big encrypted blob of data (which they further hash). There's no difference in encryption because everything is all lumped together in one blob, then encrypted. 

Secure Notes are a great place to store info. When I travel I'll take a photo of my passport and visa documents and tickets and save it to a Secure Note. Then I can access that from anywhere if there is an issue. A Secure Note allows attachments. A regular password record has a Notes field, but doesn't allow attachments. That's the only major difference between the two.

ergophobe

  • Inner Core
  • Hero Member
  • *
  • Posts: 9320
    • View Profile
Re: LastPass hacked: change your passwords
« Reply #19 on: June 19, 2015, 03:46:04 PM »
I think you're getting confused here.

I think I was too ;-)

Thanks for the explanation.