7 ms·

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's th

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

gregsadetsky 5y ago
WHAT!! Same IP range for me. How is this possible????
- deleted 5y ago
  [deleted]
- dogman123 5y ago
  not sure, but this seems pretty bad! fwiw, i haven't used lastpass in at least a year. i've been using 1password.
  - gregsadetsky 5y ago
    How old approximately was your account? I used my master password the last time in 2017... were our master passwords compromised back then... and someone held on to them for that long? That seems improbable?
    - cosmojg 5y ago
      What browser extensions do you have installed?
      - gregsadetsky 5y ago
        I don't remember which extensions I had in 2017, unfortunately...
    - dogman123 5y ago
      just checked my email. last pass account was created in 2015, not sure if the current leaked password has been in use that whole time, but it has definitely been quite a few years. moved over to 1passward in march of this year and likely have not used last pass at all since.
      - gregsadetsky 5y ago
        That's really so strange. What is the probability that you, techknight (the other user in this thread) and me used the exact same compromised software back in ~2017 and had our master passwords stolen then? And for that person/bot (in Brazil) to try all of those master passwords now? It's beginning to look like this is a LastPass issue, no..?
        dogman123 5y ago
        it certainly does look like a lastpass issue....
        techknight 5y ago
        LastPass was my first thought, but I couldn't find anyone else having the same issue and decided it couldn't possibly be them. Now I'm not sure! I've emailed you a list of the extensions I use in Chrome - if you want to share publicly any that we have in common I'm okay with that
        gregsadetsky 5y ago
        Hey, thanks -- just replied to your email. Since I haven't used this LastPass master password since 2017, I'd have to remember which extensions I had back then, which is hard to do... I may have had 1Password and Adblock Plus which you had/have too. But it's hard to say. It's a possible vector (that you, dogman123 and I had the same compromised extensions) but also... why would the hackers have sat on our master passwords for nearly 4 years (in my case)?
        sillysaurusx 5y ago
- denysvitali 5y ago
  Is the date / time exactly the same? It seems like they might have emailed _everyone_ at this point. Maybe it's just a bug.
  - Cu3PO42 5y ago
    I have a LastPass account (also not used for some time) and have not received this email.
sovietssbns 5y ago
got one at 1528EST from 23[.]236[.]213[.]5 - OSINT shows it part of BLAZING_SEO_PROXY pw was only ever used here and stored offline
- gregsadetsky 5y ago
  That's a different IP range, but the fact that it's all happening at once (i.e. these unique, never used elsewhere LastPass master passwords being used to login) is rather strange..? Or I am drawing a random line through a cloud of dots..? :-) What other IPs are part of BLAZING_SEO_PROXY?
- gregsadetsky 5y ago
  Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!
Dma54rhs 5y ago
Mine was from India, master password definetly unique and very strong. I'm still hoping for some bug that mass alerted every day login attempts instead of actually gaining access.
- q1w2 5y ago
  Can you guys list out the browser extensions you are using and/or if you're using LP on mobile? We need to find a common thread.
- gregsadetsky 5y ago
  I'm hoping for an email bug / false positive too. Also, incorrect login attempts (i.e. using the wrong password) does not send out an email. If you do attempt to login with the correct master password from a different/new IP, then you'll get the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email.
- gregsadetsky 5y ago
  Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!
johtso 5y ago
Are we sure that same email isn't sent out if someone tries to log into your account with the wrong password?
- gregsadetsky 5y ago
  No email is sent when an attempt was made to login with the wrong password. Logging in with the wrong password is logged in the Account History as "Failed Login Attempt" Logging in with the correct password (or hash? TBD) from a new IP triggers the email and that's logged in the Account History as "Login Verification Email Sent"
raverbashing 5y ago
That IP is not from Brazil. It revert-resolves to keznews.com (Looks like it's registered in Prague) If you try hitting it, it will redirect you to some website which might or might not be the same to every person
gregsadetsky 5y ago
Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!
- SV_BubbleTime 5y ago
  I feel this is like a Reddit detective moment. Almost everyone here is going to have uBlock Origin installed.
  - gregsadetsky 5y ago
    Yeah I agree. And a few users who were compromised confirmed not having uBlock. So yeah. False trail.

gregsadetsky 5y ago

WHAT!! Same IP range for me. How is this possible????

deleted 5y ago
[deleted]
dogman123 5y ago
not sure, but this seems pretty bad! fwiw, i haven't used lastpass in at least a year. i've been using 1password.
- gregsadetsky 5y ago
  How old approximately was your account? I used my master password the last time in 2017... were our master passwords compromised back then... and someone held on to them for that long? That seems improbable?
  - cosmojg 5y ago
    What browser extensions do you have installed?
    - gregsadetsky 5y ago
      I don't remember which extensions I had in 2017, unfortunately...
  - dogman123 5y ago
    just checked my email. last pass account was created in 2015, not sure if the current leaked password has been in use that whole time, but it has definitely been quite a few years. moved over to 1passward in march of this year and likely have not used last pass at all since.
    - gregsadetsky 5y ago
      That's really so strange. What is the probability that you, techknight (the other user in this thread) and me used the exact same compromised software back in ~2017 and had our master passwords stolen then? And for that person/bot (in Brazil) to try all of those master passwords now? It's beginning to look like this is a LastPass issue, no..?
      - dogman123 5y ago
        it certainly does look like a lastpass issue....
      - techknight 5y ago
        LastPass was my first thought, but I couldn't find anyone else having the same issue and decided it couldn't possibly be them. Now I'm not sure! I've emailed you a list of the extensions I use in Chrome - if you want to share publicly any that we have in common I'm okay with that
        gregsadetsky 5y ago
        Hey, thanks -- just replied to your email. Since I haven't used this LastPass master password since 2017, I'd have to remember which extensions I had back then, which is hard to do... I may have had 1Password and Adblock Plus which you had/have too. But it's hard to say. It's a possible vector (that you, dogman123 and I had the same compromised extensions) but also... why would the hackers have sat on our master passwords for nearly 4 years (in my case)?
        sillysaurusx 5y ago
denysvitali 5y ago
Is the date / time exactly the same? It seems like they might have emailed _everyone_ at this point. Maybe it's just a bug.
- Cu3PO42 5y ago
  I have a LastPass account (also not used for some time) and have not received this email.

sovietssbns 5y ago

got one at 1528EST from 23[.]236[.]213[.]5 - OSINT shows it part of BLAZING_SEO_PROXY pw was only ever used here and stored offline

gregsadetsky 5y ago
That's a different IP range, but the fact that it's all happening at once (i.e. these unique, never used elsewhere LastPass master passwords being used to login) is rather strange..? Or I am drawing a random line through a cloud of dots..? :-) What other IPs are part of BLAZING_SEO_PROXY?
gregsadetsky 5y ago
Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!

Dma54rhs 5y ago

Mine was from India, master password definetly unique and very strong. I'm still hoping for some bug that mass alerted every day login attempts instead of actually gaining access.

q1w2 5y ago
Can you guys list out the browser extensions you are using and/or if you're using LP on mobile? We need to find a common thread.
gregsadetsky 5y ago
I'm hoping for an email bug / false positive too. Also, incorrect login attempts (i.e. using the wrong password) does not send out an email. If you do attempt to login with the correct master password from a different/new IP, then you'll get the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email.
gregsadetsky 5y ago
Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!

johtso 5y ago

Are we sure that same email isn't sent out if someone tries to log into your account with the wrong password?

gregsadetsky 5y ago
No email is sent when an attempt was made to login with the wrong password. Logging in with the wrong password is logged in the Account History as "Failed Login Attempt" Logging in with the correct password (or hash? TBD) from a new IP triggers the email and that's logged in the Account History as "Login Verification Email Sent"

raverbashing 5y ago

That IP is not from Brazil. It revert-resolves to keznews.com (Looks like it's registered in Prague) If you try hitting it, it will redirect you to some website which might or might not be the same to every person

gregsadetsky 5y ago

Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!

SV_BubbleTime 5y ago
I feel this is like a Reddit detective moment. Almost everyone here is going to have uBlock Origin installed.
- gregsadetsky 5y ago
  Yeah I agree. And a few users who were compromised confirmed not having uBlock. So yeah. False trail.