4 ms·

I received the alert of a blocked login attempt yesterday from 168.81.33.157 (Mumbai, India). I don’t use LastPass often and wasn’t 100% on my master so I tri

I received the alert of a blocked login attempt yesterday from 168.81.33.157 (Mumbai, India). I don’t use LastPass often and wasn’t 100% on my master so I tried logging in and also received the block login alter from my attempt. I verified the new location/device and then tried again and it told me the password was invalid. Tried again and got in fine. Could it be that master passwords are not actually compromised but they are sending the unrecognized device/location on any login attempt regardless of correct master? Can someone else verify blocked login from unknown device/location using a wrong master password?

gregsadetsky 5y ago
Hey, I tested it here a few times, logging in with a wrong password does not generate an email, while logging in with the correct password from a new IP does generate that "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email. Could you try again logging in with a completely wrong password (to see if you get a email) and then logging in with the correct password from a new IP? Also, you can verify that those kinds of events (wrong password and correct password from new IP) are logged in the LastPass Account History. Instructions to get the Account History are here https://news.ycombinator.com/item?id=29708122 https://news.ycombinator.com/item?id=29708122
- jagstangxl 5y ago
  Interesting. I tested twice before with the wrong password and vpn and it generated the email but was not able to get in. I assume it would still show in account history because that event is the login verification email event. It isn’t sending that email for me at this point so maybe something has been corrected and LastPass will acknowledge something soon.
  - wutwutwutwut 5y ago
    For me, the behavior is: * Connecting from my own IP with wrong password: It tells me to "Check my master password and try again." * Connecting from another IP with wrong password: It tells me to "Check your inbox for an email from LastPass: <myemail**@gmail.com>" and also to check my login info. It's a bit odd that it tells me to check my email even though the master password I provided was incorrect.
    - gregsadetsky 5y ago
      Yeah, it's as if the error message (when using a wrong password on a new IP) was trying to not say that the password is wrong. It's just saying "check your email", just as if you had typed in the correct password (from a new IP). But when you did attempt to login with a wrong password, you never received a "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email, correct?
      - jagstangxl 5y ago
        Correct, at 10:20 eastern I did receive the verify device/location email using an invalid password but it is no longer sending the email.
        gregsadetsky 5y ago
        That would truly be the best outcome possible -- that LastPass sent out "Someone just used your master password" emails incorrectly i.e. those were false positives.
        jagstangxl 5y ago
        They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.
        gregsadetsky 5y ago
        But if your master passphrase is only used for LastPass (as is exactly my case -- I've never used it elsewhere), how can it can be credential stuffing? Or was the password breached from LastPass itself in the past? That's possible, but then it doesn't jell with people having this same issue with accounts created in November 2021. As far as I can tell, the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email we all received was only sent when a correct password was used. Incorrect passwords did not trigger that email. But yes, it would be great to learn that those emails were sent incorrectly i.e. it was a false positive (i.e. someone tried to login with a wrong password, but the email above was sent anyway). It's still not great that the wrong kind of email was sent, but that would be a low level bug.
  - gregsadetsky 5y ago
    Just making sure, when you say wrong password, was the password completely wrong, or you changed the lower/upper case? There's a separate conversation on this topic here https://news.ycombinator.com/item?id=29708869 https://news.ycombinator.com/item?id=29708869 And again, to confirm, you used the wrong password and received an email saying "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" ? Thanks!

gregsadetsky 5y ago

Hey, I tested it here a few times, logging in with a wrong password does not generate an email, while logging in with the correct password from a new IP does generate that "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email. Could you try again logging in with a completely wrong password (to see if you get a email) and then logging in with the correct password from a new IP? Also, you can verify that those kinds of events (wrong password and correct password from new IP) are logged in the LastPass Account History. Instructions to get the Account History are here https://news.ycombinator.com/item?id=29708122 https://news.ycombinator.com/item?id=29708122

jagstangxl 5y ago
Interesting. I tested twice before with the wrong password and vpn and it generated the email but was not able to get in. I assume it would still show in account history because that event is the login verification email event. It isn’t sending that email for me at this point so maybe something has been corrected and LastPass will acknowledge something soon.
- wutwutwutwut 5y ago
  For me, the behavior is: * Connecting from my own IP with wrong password: It tells me to "Check my master password and try again." * Connecting from another IP with wrong password: It tells me to "Check your inbox for an email from LastPass: <myemail**@gmail.com>" and also to check my login info. It's a bit odd that it tells me to check my email even though the master password I provided was incorrect.
  - gregsadetsky 5y ago
    Yeah, it's as if the error message (when using a wrong password on a new IP) was trying to not say that the password is wrong. It's just saying "check your email", just as if you had typed in the correct password (from a new IP). But when you did attempt to login with a wrong password, you never received a "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email, correct?
    - jagstangxl 5y ago
      Correct, at 10:20 eastern I did receive the verify device/location email using an invalid password but it is no longer sending the email.
      - gregsadetsky 5y ago
        That would truly be the best outcome possible -- that LastPass sent out "Someone just used your master password" emails incorrectly i.e. those were false positives.
        jagstangxl 5y ago
        They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.
        gregsadetsky 5y ago
        But if your master passphrase is only used for LastPass (as is exactly my case -- I've never used it elsewhere), how can it can be credential stuffing? Or was the password breached from LastPass itself in the past? That's possible, but then it doesn't jell with people having this same issue with accounts created in November 2021. As far as I can tell, the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email we all received was only sent when a correct password was used. Incorrect passwords did not trigger that email. But yes, it would be great to learn that those emails were sent incorrectly i.e. it was a false positive (i.e. someone tried to login with a wrong password, but the email above was sent anyway). It's still not great that the wrong kind of email was sent, but that would be a low level bug.
- gregsadetsky 5y ago
  Just making sure, when you say wrong password, was the password completely wrong, or you changed the lower/upper case? There's a separate conversation on this topic here https://news.ycombinator.com/item?id=29708869 https://news.ycombinator.com/item?id=29708869 And again, to confirm, you used the wrong password and received an email saying "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" ? Thanks!