Zero day hole can pwn millions of LastPass users, all that's needed is a malicious site

[PEllis]

A dangerous zero-day vulnerability has been found in popular cloud password vault LastPass, whichThe Register has been told can completely compromise user accounts.

Many millions of users can right now be compromised by merely visiting a malicious website, we understand.

This allows attackers complete access to user accounts in which hundreds and thousands of passwords are stored.

Read more: Zero day hole can pwn millions of LastPass users, all that's needed is a malicious site

 

[Andytay70]

One of the reasons i dont use password managers.

 

[SHvFl]

Pretty sure you will need to be logged in. If that it's not the case then this vulnerability it's beyond any control. Will wait for the patch and the info that will follow from Tavis.

 

[hjlbx]

There has to be the right convergence of circumstances for the LastPass vulnerability to be exploited.

It's security news reports like this that needlessly terrorizes users; they're unhelpful sensationalism that constitute nothing but fear mongering.

Common sense = do not store banking or any financial related website login credentials in ANY password manager.

 

[SHvFl]

There has to be the right convergence of circumstances for the LastPass vulnerability to be exploited.

It's security news reports like this that needlessly terrorizes users; they're unhelpful sensationalism that constitute nothing but fear mongering.

Common sense = do not store banking or any financial related website login credentials in ANY password manager.

...and even if you do, make sure your bank has 2 step authentication of some sort that doesn't rely on it.

 

[hjlbx]

...and even if you do, make sure your bank has 2 step authentication of some sort that doesn't rely on it.

Set up with your bank two accounts.

One a savings account with inability to transfer funds to your checking account. All deposits should be made to this savings account.

The other a checking account. Only transfer funds to this account that are sufficient for the transactions and to keep the account open.

Simple enough... just requires an occasional visit to the bank in-person to make the transfer.

I keep a minimal balance in checking and use it for any on-line transactions; savings is block from all access except in-person.

* * * * *

Two-Step Authentication has already been compromised by malc0ders.

 

[SHvFl]

Set up with your bank two accounts.

One a savings account with inability to transfer funds to your checking account. All deposits should be made to this savings account.

The other a checking account. Only transfer funds to this account that are sufficient for the transactions and to keep the account open.

Simple enough... just requires an occasional visit to the bank in-person to make the transfer.

I keep a minimal balance in checking and use it for any on-line transactions; savings is block from all access except in-person.

* * * * *

Two-Step Authentication has already been compromised by malc0ders.

Lol i do the same with the 2 accounts. Don't really trust anything as the only protection step but as you mentioned it has the inconvenience of going to the bank. I live in a small town though so it usually empty and can finish in 15min.
My bank offers 2 step authentication with an sms on your phone. I have it on because maybe it will save me once. You lose nothing by using a feature. Just don't rely on it 100%.

 

[hjlbx]

Lol i do the same with the 2 accounts. Don't really trust anything as the only protection step but as you mentioned it has the inconvenience of going to the bank. I live in a small town though so it usually empty and can finish in 15min.
My bank offers 2 step authentication with an sms on your phone. I have it on because maybe it will save me once. You lose nothing by using a feature. Just don't rely on it 100%.

Well said...

 

[shmu26]

what about manually adding two or three characters to the stored password?
It could be a standard 3 character add-on for all your sensitive sites, stored in the brain.
I think most of us can remember 3 characters.

 

[hjlbx]

what about manually adding two or three characters to the stored password?
It could be a standard 3 character add-on for all your sensitive sites, stored in the brain.
I think most of us can remember 3 characters.

It will work only if you use LastPass to store the partial password, and then you will have to manually add the 3 characters during login. LastPass won't be able to successfully do auto-logins using this method -- but you already know that.

However, why give a malc0der access to most of the password ? It's insane - with only 3 characters needed to complete the complete password they will crack the entire password using softs designed to do so within a single day - probably only hours or even a few minutes.

 

[Shran]

LastPass Security Updates | The LastPass Blog

Only affect(s/ed) Firefox & has been patched. If you use LastPass on Firefox I recommend going to LastPass - Introducing the New LastPass (Firefox download link) and updating manually just to be sure.

The second report was made yesterday by Google Security Team researcher Tavis Ormandy, who contacted our team to report a message-hijacking bug that affected the LastPass Firefox addon...As noted below, this issue has been fully addressed and an update with a fix was pushed for all Firefox users using LastPass 4.0....The recent report only affects Firefox users...Other browsers are not impacted by this report, and users do not need to take action for other browsers.

 

[SHvFl]

LastPass Security Updates | The LastPass Blog

Only affect(s/ed) Firefox & has been patched. If you use LastPass on Firefox I recommend going to LastPass - Introducing the New LastPass (Firefox download link) and updating manually just to be sure.

And i was right. He found a bypass on Firefox so you first had to use Firefox, you had to be logged in, visit a site with the exploit, don't use 2 step authentication, sacrifice your firstborn, offer your soul to the devil and finally sign the deal with your blood.
Cool that the issue was fixed,in a day, but the panic some sites created it's not justifiable. Bet lots of users removed Lastpass and now use something worse or even stopped using a password manager. Media just want views and the more clickbait the topic is the more money they make.

 

[hjlbx]

And i was right. He found a bypass on Firefox so you first had to use Firefox, you had to be logged in, visit a site with the exploit, don't use 2 step authentication, sacrifice your firstborn, offer your soul to the devil and finally sign the deal with your blood.
Cool that the issue was fixed,in a day, but the panic some sites created it's not justifiable. Bet lots of users removed Lastpass and now use something worse or even stopped using a password manager. Media just want views and the more clickbait the topic is the more money they make.

= sign your life away...

* * * * *

Clickbait is all it is... and while they might be informative, are really nothing more than mental and emotional scare tactics. What a sad, shameful state of affairs...

 

[hjlbx]

Yeah... it was updated and the update broke some things -- like auto-login on some sites.

Oh well, typical stuff...

Marvasol hurried and pushed an update thru that breaks things.

 

[NullByte]

nothing is safe anymore

It never was from beginning

 

[Cats-4_Owners-2]

Comments on this thread are an invaluable resource for practical sensible security! The posts here even got my wife up from her seat (Mission Control in the other room). I am proud to say she's now sold on hjlbx's & SHvFl's safer banking practices!

 

[DardiM]

Thanks for the share

I use a local password manager for years, but none informations saved for online payment or Bank access / transactions.

Spoiler: This is how I managed online bank / payment / transaction

KTS online protection / virtual keyboard for Bank website & Online payment

Bank :
Login : id entered with virtual keyboard
Password : entered using a special website bank tool : digits from 0 to 9 are put at a random position

Payment:
(1) Paypal => almost every time ( I receive a mail after each transaction)
(2) VISA card (rarely)
after HTTPS and website security verifications :
- I enter the digits with virtual Kaspersky keyboard( not saved)
- sms received from my bank : with a very temporary code
- code entered on a secure edit box linked to my bank, to validate the payment.
- redirected on the online website

 

[Logethica]

Thanks for the share

I use a local password manager for years, but none informations saved for online payment or Bank access / transactions.

Spoiler: This is how I managed online bank / payment / transaction

KTS online protection / virtual keyboard for Bank website & Online payment

Bank :
Login : id entered with virtual keyboard
Password : entered using a special website bank tool : digits from 0 to 9 are put at a random position

Payment:
(1) Paypal => almost every time ( I receive a mail after each transaction)
(2) VISA card (rarely)
after HTTPS and website security verifications :
- I enter the digits with virtual Kaspersky keyboard( not saved)
- sms received from my bank : with a very temporary code
- code entered on a secure edit box linked to my bank, to validate the payment.
- redirected on the online website

That's very "Secret Service" of you .....Is the phone that receives the SMS a "burner" that self destructs once the message has been read?
I think perhaps that you are a "Directorate General for External Security" employee that masquerades as a bird of the southern hemisphere on computer security forums

 

[hjlbx]

LOL... deranged penguin in a funnyman's bat-suit.

My man has a sense of humor...

 

[DardiM]

That's very "Secret Service" of you .....Is the phone that receives the SMS a "burner" that self destructs once the message has been read?
I think perhaps that you are a "Directorate General for External Security" employee that masquerades as a bird of the southern hemisphere on computer security forums

lol
Dear @Logethica , You know that I can't confirm all the secrets - er - all the real details - er - I mean all the details ... you wrote
[AFK]
[AFK]
Sorry I just received a call and my phone exploded - er - my phone batteries fail ...

LOL... deranged penguin in a funnyman's bat-suit.
My man has a sense of humor...

The most funny => I really make things like I wrote
=> the only time I'm serious, You don't see it ...