Comment on More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user

Ado@lemmy.world ⁨1⁩ ⁨year⁩ ago

• CMGX78@lemmy.world ⁨1⁩ ⁨year⁩ ago

  I dumped LastPass for Bitwarden a few years ago. So glad I did.

  source

  • PhatInferno@midwest.social ⁨1⁩ ⁨year⁩ ago

    Same! Thinking i coulda been a victim in this attack is scary!

    source
• iHUNTcriminals@lemm.ee ⁨1⁩ ⁨year⁩ ago

  Selfhosted for extra win!?

  source

  • OberonSwanson@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

    Any recommendations on how-to?

    source

    • treadful@lemmy.zip ⁨1⁩ ⁨year⁩ ago

      KeepassXC (desktop)/KeePassDX(mobile) on top of something like Syncthing or Nextcloud.

      source

      • OberonSwanson@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

        Thanks for the suggestion, I’ll try checking out both options. Unfortunately, I have an iPhone, so sadly there’s no KeepassDX. 🤔

        source

        • -> View More Comments
    • hobbit@lemm.ee ⁨1⁩ ⁨year⁩ ago

      Vaultwarden is what I use: https://github.com/dani-garcia/vaultwarden/

      Their wiki is pretty good assuming you’re comfortable with Docker.

      source

      • OberonSwanson@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

        Interesting, I’ll check it out, as it looks like it’ll cover what I need. Hopefully it’s simple enough, as always having an iPhone makes things more complicated lol.

        source

        • -> View More Comments
    • Potatos_are_not_friends@lemmy.world ⁨1⁩ ⁨year⁩ ago

      It doesn’t have to be difficult.

      1. Download keepass to your computer.

      2. Keep the save file on a USB or private cloud backup.

      3. Done!

      As you get more comfortable with it, you’ll start using it in more complex ways. Like having a phone app, connected to a self hosted network. But keep it simple for now.

      source

      • OberonSwanson@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

        This might be a good idea for my family, they definitely prefer a K.I.S.S. approach lol.

        source
    • whileloop@lemmy.world ⁨1⁩ ⁨year⁩ ago

      If you wanna use KeePass, you just have to store your database in some secure location. It can be on your local drive or in the cloud, and location you trust really.

      source

      • OberonSwanson@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

        Guessing it’s suggested to use a small flash drive and keep it hidden somewhere?

        source
      • Nighed@sffa.community ⁨1⁩ ⁨year⁩ ago

        You can set the encryption strength though, so I guess you could set it high and could even have it untrusted.

        Mine takes a while to open on my phone because of that

        source
    • linuxguy@lemmy.gregw.us ⁨1⁩ ⁨year⁩ ago

      Vaultwarden!

      source
  • Ado@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Self-hosted with yubikey 2fa. Even Santa Claus can’t see my info 😎

    source

    • iHUNTcriminals@lemm.ee ⁨1⁩ ⁨year⁩ ago

      I should get around to doing this… But it scares me haha.

      source

      • Ado@lemmy.world ⁨1⁩ ⁨year⁩ ago

        I started out with the Yubikey, which was such a relief all by itself. Even if you have my password, you need my physical USB key to plug in or NFC confirm for the 2fa. I did later move to self-hosting, but I def have a backup of a backup for that since space is cheap-ish.

        source
      • olympicyes@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Not sure about that software specifically but most yubikey 2FA implementations allow you to set up more than one key. That way you don’t lose access if you lose your key. I personally have three keys.

        source
• ramble81@lemm.ee ⁨1⁩ ⁨year⁩ ago

  So what makes Bitwarden better than LastPass if you’re using Bitwarden’s hosted option (I know you can keep it locally).

  source

  • PM_Your_Nudes_Please@lemmy.world ⁨1⁩ ⁨year⁩ ago

    From what I remember (take this with a grain of salt since it’s all from when the big LastPass breach happened,) LastPass didn’t actually encrypt your entire vault. They only encrypted the passwords. The rest of the vault, (which would be comprised of usernames and the sites that are associated with them, notes, images, etc) were unencrypted. So even without cracking any vaults, hackers got access to gigantic lists of usernames and their associated email addresses. That’s valuable in and of itself, because it allows them to spear-phish those users.

    For example, you may not fall for a regular phishing scam. But you may fall for it if the email has your username and recovery info in it. Because they know every email you’ve used to sign up for something and all of your different usernames that you used on that site, so they can craft convincing phishing emails that are specifically tailored to you.

    It also allows them to search for specific users. Maybe there is a user on a crypto forum who is particularly noteworthy. Their username is already known on the site, and hackers are able to cross-reference that with the list of known usernames/emails and see if that user’s vault was part of the breach. If it was, they can focus on breaching that one user’s vault, instead of aimlessly trying random vaults.

    source

    • can@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      That’s valuable in and of itself, because it allows them to spear-phish those users.

      I’m sorry, this is the first time I’m hearing the term spear-phish and I love it. It’s hilarious.

      source

      • PM_Your_Nudes_Please@lemmy.world ⁨1⁩ ⁨year⁩ ago

        It refers to targeting phishing attacks. With traditional phishing, scammers simply cast an ultra wide net and catch whichever one’s happen to respond. They don’t really care who it is, because they’re playing a numbers game. Even if only 0.1% of people respond, sending out a thousand phishing emails means you still got a response.

        But with spear phishing, it’s a targeted attack. They’ll call you at your desk with a spoofed work number, and pretend to be the CEO’s assistant. The CEO needs you to go buy gift cards for a big sales event coming up. Don’t worry, it can all be expensed later, but he needs the cards now and doesn’t have time to deal with vendors and purchase orders. And now you’re reading gift card numbers to a scammer, because they knew enough about your workplace to be able to reasonably impersonate the CEO’s assistant.

        It can also be used to refer to targeted attacks against company leaders or notable figures. Maybe someone has a fat crypto wallet, so someone targets them. Or maybe they try to trick the CEO into giving away a trade secret. Regardless of the reasons, the attack is still the same basic principle; Find a target, meticulously research them enough to be able to fool them, then attack. Most people will be good at avoiding regular phishing. But very few people are prepared for a coordinated and laser-guided spear phishing attack.

        source

        • -> View More Comments
    • jarfil@lemmy.world ⁨1⁩ ⁨year⁩ ago

      LastPass didn’t actually encrypt your entire vault. They only encrypted the passwords. The rest of the vault, (which would be comprised of usernames and the sites that are associated with them, notes

      Wait a moment… now I wonder how many people kept their crypto wallet recovery word lists as notes instead of as passwords.

      source

      • olympicyes@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Geez I do this in 1 password.

        source
  • DrCake@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I’m not 100% but I think Bitwarden actual encrypt the entire ‘password object’. So the url, username, password, and any notes. Lastpass didn’t/doesn’t encrypt the url so if anyone gets access to the vault, they have a list of websites where the person will have an account and can more accurately send phishing emails.

    source

    • fushuan@lemm.ee ⁨1⁩ ⁨year⁩ ago

      It encrypts the entire vault iirc, not the objects themselves. The only thing a breach cound gain access to is the encrypted vault, the hashed master password and the master email.

      source
• Lucidlethargy@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

  There’s no such thing as an impenetrable password manager. I keep my most secure passwords in my head, and so should everyone.

  Even if the software were perfect, people aren’t. Anyone can be fooled under the right circumstances. It’s better to expose one service than all of them at once.

  source

  • PlexSheep@feddit.de ⁨1⁩ ⁨year⁩ ago

    Your head cannot be securely backed up, and you are not resistant to major thread actors (torture, and so on)

    source
  • Ozymati@lemmy.nz ⁨1⁩ ⁨year⁩ ago

    2fA is an important element too.

    source
  • Ado@lemmy.world ⁨1⁩ ⁨year⁩ ago

    How would someone steal my password and my physical yubikey for 2fa?

    source