I-LastPass iyimenenja yephasiwedi ye-freemium egcina amaphasiwedi abethelwe efwini, eyasungulwa yinkampani iMarvasol, Inc.
Abathuthukisi be-password manager LastPass , esetshenziswa abantu abangaphezu kwezigidi ezingu-33 kanye namabhizinisi angaphezu kuka-100.000, bazise abasebenzisi ngesigameko lapho abahlaseli bathola ukufinyelela kuma-backups esitoreji esiqukethe idatha yomsebenzisi yesevisi.
Idatha ifake phakathi ulwazi olufana negama lomsebenzisi, ikheli, i-imeyili, ifoni, namakheli e-IP lapho isevisi ifinyelelwe khona, kanye namagama esayithi angabhaliwe agcinwe kusiphathi sephasiwedi nokungena, amaphasiwedi, idatha yefomu, namanothi abethelwe agcinwe kulawa masayithi. .
Ukuze kuvikelwe ukungena ngemvume kwesayithi namaphasiwedi , ukubethela kwe-AES kusetshenziswe ngokhiye ongu-256-bit okhiqizwe umsebenzi we-PBKDF2 ngokusekelwe kuphasiwedi eyinhloko eyaziwa ngumsebenzisi kuphela, enosayizi omncane wezinhlamvu ezingu-12. Ukubethela nokususa ukubethela kokungena ngemvume namaphasiwedi ku-LastPass kwenziwa kuphela ohlangothini lomsebenzisi, futhi ukuqagela iphasiwedi eyinhloko kubhekwa njengokungenangqondo kwihadiwe yesimanje, uma kubhekwa usayizi wephasiwedi eyinhloko kanye nenani lokuphindaphinda kwe-PBKDF2 okusetshenzisiwe.
Ukuze benze lokhu kuhlasela, basebenzisa idatha etholwe abahlaseli ngesikhathi sokuhlasela kokugcina okwenzeka ngo-Agasti futhi kwenziwa ngokufaka engozini i-akhawunti yomunye wabathuthukisi besevisi.
Ukuhlasela kuka-Agasti kwaholela ekutheni abahlaseli bathole ukufinyelela endaweni yokuthuthukiswa , ikhodi yohlelo lokusebenza, kanye nolwazi lobuchwepheshe. Kamuva kwatholakala ukuthi abahlaseli basebenzise idatha evela endaweni yokuthuthukiswa ukuze bahlose omunye unjiniyela, ngaleyo ndlela bathola okhiye bokufinyelela kwisitoreji samafu kanye nokhiye bokuqaqa idatha evela ezitsheni ezigcinwe lapho. Amaseva amafu asengozini abambe izipele ezigcwele zedatha yesevisi yesisebenzi.
Lokhu kudalulwa kumelela isibuyekezo esimangalisayo sokwephulwa kwemithetho okwadalulwa yi-LastPass ngo-Agasti. Umshicileli uvumile ukuthi abaduni “bathathe izingxenye zekhodi yomthombo ye-LastPass kanye nolwazi oluthile lobuchwepheshe oluyimfihlo.” Inkampani yathi ngaleso sikhathi amaphasiwedi ayinhloko amakhasimende, amaphasiwedi abethelwe, ulwazi lomuntu siqu, kanye nolunye ulwazi olugcinwe kuma-akhawunti amakhasimende akuthintekile.
256-bit AES futhi ingasuswa ukubethela ngokhiye oyingqayizivele wokususa ukubethela osuselwe kuphasiwedi eyinhloko yomsebenzisi ngamunye kusetshenziswa ukwakheka kwethu kweZero Knowledge,” kuchaza i-CEO ye-LastPass u-Karim Toubba, ebhekise kuSikimu Sokubethela Esithuthukile. I-Zero Knowledge isho amasistimu okugcina angakwazi ukuthi umhlinzeki wesevisi akwazi ukuqhekeka. I-CEO iqhubekile yathi:
Iphinde yabala izixazululo eziningana ezathathwa yi-LastPass ukuqinisa ukuphepha kwayo ngemva kokuphulwa. Izinyathelo zihlanganisa ukuhoxiswa kwemvelo yokuthuthukisa entshontshiwe kanye nokwakha kabusha kusukela ekuqaleni, ukugcinwa kwensizakalo yokutholwa kwendawo yokugcina ephethwe kanye nokuphendula, nokuzungezisa zonke iziqinisekiso nezitifiketi ezifanele okungenzeka zibe sengozini.
Njengoba kunikezwe imfihlo yedatha egcinwe yi-LastPass, kuyashaqisa ukuthi kutholwe idatha yomuntu siqu ebanzi kangaka. Nakuba ukukhwabanisa kwe-password hashes kungaba yinsiza ejulile, akuphumi embuzweni, ikakhulukazi uma kubhekwa indlela nobuhlakani babahlaseli.
Amakhasimende e-LastPass kufanele aqinisekise ukuthi ashintshe iphasiwedi yawo eyinhloko kanye nawo wonke amaphasiwedi agcinwe endaweni yawo yokugcina idatha. Kufanele futhi aqinisekise ukuthi asebenzisa izilungiselelo ezidlula ukucushwa okuzenzakalelayo kwe-LastPass.
Lokhu kulungiselelwa kuxova amagama ayimfihlo agciniwe kusetshenziswa ukuphindaphinda okungu-100100 kwe-Password Based Key Derivation Function (PBKDF2), isikimu se-hashing esingenza kungenzeki ukudalula amaphasiwedi ayinhloko amade, ahlukile, futhi ukuphindaphinda okukhiqizwa ngokungahleliwe okungu-100100 kudabukisayo ngaphansi komkhawulo otuswa yi-OWASP ka-310, ukuphindaphinda kwe-PBKDF000 kuhlanganiswe ne-algorithm ye-SHA2 hashi esetshenziswa yi-LastPass.
Amakhasimende e-LastPass kufanele futhi aqaphele ama-imeyili obugebengu bokweba imininingwane ebucayi kanye nezingcingo ezithi zivela ku-LastPass noma ezinye izinsizakalo ezifuna idatha ebucayi kanye neminye imikhonyovu esebenzisa ulwazi lomuntu siqu olucekelwe phansi. Le nkampani iphinde inikeze isiqondiso esithile kumakhasimende ebhizinisi asebenzise izinsizakalo zokungena ngemvume ze-LastPass Federated.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.