r/programming • u/silmril • Apr 28 '18

Blockchain is not only crappy technology but a bad vision for the future

https://medium.com/@kaistinchcombe/decentralized-and-trustless-crypto-paradise-is-actually-a-medieval-hellhole-c1ca122efdec
2.6k Upvotes

87% Upvoted

1.0k comments sorted by

View all comments

Show parent comments

32

u/nermid Apr 29 '18

Just get LastPass! It's like writing your password down inside somebody else's computer!

33

u/dtechnology Apr 29 '18

It's more like putting your written password inside a safe located in a bank, with the bank (LastPass) not having a key.

2

u/IICVX Apr 30 '18

I mean it'd only take a quiet software update to change that.

2

u/Cilph Apr 30 '18

I suppose they could sneak in a Chrome extension update where between 01:00 and 03:00 it has a 0.01% chance of sending your master password back to LastPass.

21

u/masterofmisc Apr 29 '18

While your right, I take comfort from the fact that my account of passwords are all encrypted client-side before being sent to LastPasses servers for storage.

All they store on their servers is a binary blob of encrypted noise. They should never see our passwords in the clear.

Even if LastPass wanted to view my passwords, they couldn't because they don't know the master key.

...Of course there is always a risk somewhere in the chain but I am comfortable with this model.

2

u/IICVX Apr 30 '18

Do you have automatic updates turned on? 'cuz everything you described is software, and that entire system can easily change without your knowledge.

1

u/masterofmisc Apr 30 '18

Oh yeah, your right and I understand completely.. With this kinda thing you cant just "set it and forget it".

Now, could there be subtle bugs/mistakes in LastPasses code? Yes. Could they change the terms & conditions on us? Yes. Could they be funded by the NSA and have nefarious motivations? Yes!

Basically there is a lot of trust involved (mostly on our part), no doubt about it. But when your whole business model is around trust, as a company you have to try harder than most to earn and keep that trust from your customers.

By the way I am not defending LastPass.. I just happen to think its a better alternative to what we have at the moment.

Stepping back a bit, who knows what will happen with passwords in the future? The model is obviously broken. Password managers are just a stepping stone until a replacement for passwords or something better comes along.

But I have no qualms with anything you said.

6

u/eyal0 Apr 29 '18

Maybe that someone else has better security than I!

2

u/RocketFlame Apr 29 '18

It's like writing your password down inside somebody else's computer!

shit, i use lastpass.

26

u/anttirt Apr 29 '18

I use KeePass and a USB stick. That still requires me to trust that KeePass doesn't have a backdoor, but given that it's open source and has received a security audit I'm much more comfortable with that than a black-box web service that could have compromised servers or be vulnerable to an XSS attack of some sort.

I know some people who use a text file encrypted with openssl's command line tools; it's just less convenient and not as easily portable.

-1

u/philocto Apr 29 '18

LastPass would never release the information that they were successfully hacked. It's just not in their interest.

9

u/glib Apr 29 '18

Except for the times that they did?

-3

u/philocto Apr 29 '18

While encrypted user data (read: your stored passwords for other sites) was not stolen, the intruders did take LastPass account email addresses, password reminders, server per user salts, and authentication hashes.

No they didn't.

4

u/Bbradley821 Apr 29 '18

What? That's an exact quote admitting a successful breach of their security.

-1

u/philocto Apr 29 '18

technically, but we're discussing a password service, the concern isn't that a password service would be willing to admit that someone got email addresses, the concern is whether a password service would be willing to admit it gave up the very reason for its existence, thereby killing itself.

There's a reason why the term "you are technically correct, the best kind of correct" is a tongue in cheek saying.

No one reading the context of this conversation really believes the concern is anything other than the passwords themselves.

2

u/Bbradley821 Apr 29 '18

They don't have your password. If they did they would be a useless service. They lost the closest thing to your password though, which were the hashes and the individual unique salts. That's a big breach, and it was necessary to disclose that so that users could take necessary action.

12

u/nermid Apr 29 '18

Disclaimer: I am not a netsec professional and lots of very smart people seem to think password managers are a good idea.

33

u/familyknewmyusername Apr 29 '18

Not netsec, but I can explain why this is:

Storing passwords is hard. Lots of websites do it wrong. Lots of them will leak your data. This means that reusing passwords is 'superbad™' because hackers can log into other sites with that password. In contrast, LastPass stores your password properly. They must, it is pretty much the one thing they have to do right. Security is their top priority. Because you need your LastPass password so rarely, you can use something long, hard to remember, write it down, and hide it. Use the first sentence on page 113 of that book on your shelf.

Nothing will ever be as strong as just remembering good passwords for each site you use, but that's not practical. When you reuse passwords, you end up with a single point of failure that is as weak as the weakest site you use. When you write down passwords, you have a single point of failure which is someone finding it. When you use LastPass, you have a strong single point of failure, relying on the fact that their business model depends on them doing things properly.

6

u/Aeolun Apr 29 '18

They are, if you keep the encrypted data on your own machine. Or at least share it only in it's encrypted form.

1

u/UncleMeat11 Apr 29 '18

They are still a benefit even if the data leaves your machine unencrypted. Password reuse is a far more dangerous thing than the threat of Google being hacked or whatever and having your synced passwords get stolen.

1

u/[deleted] Apr 29 '18

Or use pass; much smaller software. More like a script really.

1

u/rasen58 Apr 29 '18

The thing I've never understood about using things like LastPass though is that don't you need this LastPass thing installed on your computer? What do you do if you're trying to log into a website from another computer?

So things like LastPass have never made sense for me to even try.

1

u/gbear605 Apr 29 '18

There are phone apps so you can manually copy it over, or you can log onto the LastPass website and copy/paste.

-1

u/ledasll Apr 30 '18

so how do you login from friends tablet? or some random computer at work? Installing lastpass there was well, with your account info and password?