More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists

    • Anonymousllama@lemmy.world
      link
      fedilink
      English
      arrow-up
      14
      ·
      1 year ago

      I’d be worried about losing access to the entirety of your passwords if Google up and decides that one day your account is suspended. There’s been a few reports historically where someone gets their Gmail account suspended for some mistaken reason and all their associated access gets pulled (e.g. from drive, sheets, etc)

        • Tibert@compuverse.uk
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Bitwarden offers an encrypted backup…

          Google has maybe a plain text export.

          Bitwarden has run flawless for me for multiple years.

        • Terrasque@infosec.pub
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          1 year ago

          I got a Google account that was shut down after some spammer started using that email as the sender address (sometimes called a Joe job). I somehow got in contact with an employee (friend of a friend) that checked on the account and verified it wasn’t my fault and reopened it, but a week later it got closed automatically again, with no easy way to reopen it.

          The backscatter was hundreds of emails per day, so the email part of the account was useless anyway, but I used it for other things.

          So it can happen at no fault on your own, and impossible to do anything about.

        • jarfil@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          My Google account has been rock solid from the day I created it as a child

          Hopefully you were of legal age to accept the Terms of Service, otherwise it might’ve been an irregular account all this time.

            • jarfil@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              If it was, and you haven’t accepted the ToS as of legal age, then you might want to make a new one.

              Google is getting ready to purge inactive accounts starting next year, and it wouldn’t be the first time when a service purged irregular accounts many years after the fact, so… better safe than sorry.

    • Tibert@compuverse.uk
      link
      fedilink
      English
      arrow-up
      13
      ·
      1 year ago

      Google only just recently introduced encrypted passwords… Before they were stored in plain text on your computer… Tho I’m not even sure how that encryption even works.

      So… It may not have leaked yet (or maybe it has but Google suppresses everything, who knows) but I wouldn’t trust it to keep something safe.

        • Tibert@compuverse.uk
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          There nothing to fix in an OS. Windows and chrome have vulnerabilities which are unfixable by regular people. What about malware? What about other people knowing the password to your pc?

          It’s impossible to trust an OS to not get hacked, because it’s always the hackers or OS running behind the other.

          • jarfil@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            You can replace the OS with one you trust more. Can also replace the browser, and “irregular people” can fix stuff in OpenSource OSs and browsers. Malware is easy to avoid, just don’t execute random stuff. Other people knowing the password to your PC, is up to you.

            Hackers generally don’t hack OSs, users are much easier to hack.

            • Tibert@compuverse.uk
              link
              fedilink
              English
              arrow-up
              0
              ·
              1 year ago

              And what is your point?

              That everyone should change to some Linux distro? First of all Linux is not immune, it only lacks interest from hackers. The second it’s not adapted to everyone. Even I who likes open source and learning new stuff is too annoyed by Linux because of compatibility reasons (mostly gaming).

              Just don’t execute random stuff? Wake up, or I’ll use only chrome and nothing else on my pc. You want open source you must execute random stuff.

              And people cannot be at their 100% at all time. There is a possible chance that some, even trained user, slips and executes some malware. In that case, antimalware come into play, but it’s not always the case. Companies still get hacked with ransomwares and data extractors.

              And your solution to the issue is just replacing the browser, like it would make a difference? At that point just use another password manager online…

              • jarfil@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                edit-2
                1 year ago

                My point is you start by using whichever OS you trust most: there is Windows, Mac OS, Chrome OS, Android, a bunch of Linux distros, BSD… your choice.

                If you don’t trust any OS… sorry, you’re SOL. Plug the thing off and smash it with a hammer, then dump into salt water to be safe.

                You want open source you must execute random stuff

                There are large OpenSource projects with security audits and security testing. There are random open and closed source projects with zero oversight by anyone.

                Execute the former, not the latter.

                people cannot be at their 100% at all time.

                Executable signing, anti-malware systems, and people running tests to rubber-stamp stuff exist (like distro repos, or app stores). Use those.

                Companies still get hacked with ransomwares and data extractors.

                In most cases by hacking people, not software. Follow the above rules, don’t trust that your CEO’s nephew needs remote access to your PC… tell your coworkers not to trust that either… … yeah, well, that’s impossible, it takes only one to ransomware everyone… but you can keep yourself safe 🤷

                Replacing the browser is optional, goes with the same trust issues as the OS.

    • sab@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      ·
      1 year ago

      …so far.

      For those that don’t mind self-hosting, which can be as easy as just running syncthing or resilio sync on your NAS, I can really recommend keepass.

      • NevermindNoMind@lemmy.world
        link
        fedilink
        English
        arrow-up
        13
        ·
        1 year ago

        Me with interest, but no technical knowledge reading your comment:

        which can be as easy as

        :-)

        running syncthing or resilio sync on your NAS

        :-(

        I didn’t understand any of those words

        • Jerkface@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          edit - nevermind I can’t even format a comment, let alone self host a… Thingie. What the other guy said.

        • sab@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          A NAS is a home storage server, like Synology that you can use to store images, videos and backups, etc on so you can access them from any computer or device in your home. With a couple of clicks, they can easily run applications like Syncthing or Resilio Sync, which are kinda like Dropbox, except you don’t have to pay Dropbox, you’ll just be storing the files on your own service.

          If that’s too much to handle, you can still just store your Keepass file in Dropbox, so that it’s available on all your devices. But in the end you’ll still be storing your personal data on someone else’s harddisk.

          So in short, is at easy as using a prefab service? No, you’ll have to invest some time, money, and knowledge yourself. But in the end, your data is not gathered in silo together with countless other users, which makes it a lot less attractive for hackers to try and steal it.

        • diffusive@lemmy.world
          link
          fedilink
          English
          arrow-up
          9
          ·
          1 year ago

          Self hosting is less appealing for criminals, though. Especially if the protocol is “vanilla” like ssh.

          When you hack LastPass you know what you’ll find, millions of passwords. When you hack a dude ssh you have one chance over one million that there is one dude password wallet.

          It doesn’t make financial sense to hack self hosting (unless it’s specific server software)

          • ribboo@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            1 year ago

            There are plenty of use cases for going after self hosters. Bot farms are basically made up of “regular” computers infected with malware.

            While you’re at it and have access to tens of thousands computers, also grabbing their passwords is just a nice bonus.

            If anything, it doesn’t make financial sense not to do it. You’re right in that self hosters themselves are not the target per se. but they are targeted for other reasons, and that’s where it ends up becoming problematic.

            • diffusive@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              You need to aumatize any operation… It’s not conceivable that an human look at every device for stuff to steal. It would be even more expensive.

              Generally all these bit malware do is 1) using a vulnerability to replicate themselves 2) mine crypto or other kind of crap. Sometimes (1) involves also stealing ssh keys but it’s not the goal, it the mean.

              Self hosting password/code/photos/whatever niches you are almost guaranteed that no human will look at hit because the amount of IoT/Routers/etc with nothing valuable beyond themselves generally composes the majority of these compromised bots

              This is just the economic incentive

    • Rai@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      As a non-Google user, Lemmy is only “Chrome bad”. They’re “Android is the only way”

      • Tibert@compuverse.uk
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        1 year ago

        Well chrome = bad. Just look at all the anti-competition things they are implementing just because they are the leaders on the market.

        Now they are blocking cookies, it’s great isn’t it? NO! now they are targeting you through your browser history while blocking competition.

        Manifest V3 introduced by Google, that’s amazing, now ad blockers won’t be able to update their list individually. It’s amazing isn’t it? Being able to hinder the adblockers when your revenues comes from ads.