4 ms·

For me, the behavior is: * Connecting from my own IP with wrong password: It tells me to "Check my master password and try again." * Connecting from another I

For me, the behavior is: * Connecting from my own IP with wrong password: It tells me to "Check my master password and try again." * Connecting from another IP with wrong password: It tells me to "Check your inbox for an email from LastPass: <myemail**@gmail.com>" and also to check my login info. It's a bit odd that it tells me to check my email even though the master password I provided was incorrect.

gregsadetsky 5y ago
Yeah, it's as if the error message (when using a wrong password on a new IP) was trying to not say that the password is wrong. It's just saying "check your email", just as if you had typed in the correct password (from a new IP). But when you did attempt to login with a wrong password, you never received a "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email, correct?
- jagstangxl 5y ago
  Correct, at 10:20 eastern I did receive the verify device/location email using an invalid password but it is no longer sending the email.
  - gregsadetsky 5y ago
    That would truly be the best outcome possible -- that LastPass sent out "Someone just used your master password" emails incorrectly i.e. those were false positives.
    - jagstangxl 5y ago
      They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.
      - gregsadetsky 5y ago
        But if your master passphrase is only used for LastPass (as is exactly my case -- I've never used it elsewhere), how can it can be credential stuffing? Or was the password breached from LastPass itself in the past? That's possible, but then it doesn't jell with people having this same issue with accounts created in November 2021. As far as I can tell, the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email we all received was only sent when a correct password was used. Incorrect passwords did not trigger that email. But yes, it would be great to learn that those emails were sent incorrectly i.e. it was a false positive (i.e. someone tried to login with a wrong password, but the email above was sent anyway). It's still not great that the wrong kind of email was sent, but that would be a low level bug.
        jagstangxl 5y ago
        I was just able to trigger the email again on a bad password. Going to figure out the exact 123’s and screen record.
        jagstangxl 5y ago
        I was never able to successfully trigger the false positive last night but I believe the most recent explanation from LastPass is in line with what I have been seeing. Intermittent false positive emails. https://www.techradar.com/au/news/lastpass-accidentally-scared-users-witless-with-false-breach-alerts https://www.techradar.com/au/news/lastpass-accidentally-scar...
        gregsadetsky 5y ago
        Yeah, just saw their new announcement (thanks for doing those tests yesterday by the way!) I don't know how much to read into their use of "some" and "likely" i.e. "some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error" I would want to know whether they can demonstrate that wrong passwords were used in this attack. And have an explanation for those users who received the email a 2nd time after changing their passwords.

gregsadetsky 5y ago

Yeah, it's as if the error message (when using a wrong password on a new IP) was trying to not say that the password is wrong. It's just saying "check your email", just as if you had typed in the correct password (from a new IP). But when you did attempt to login with a wrong password, you never received a "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email, correct?

jagstangxl 5y ago
Correct, at 10:20 eastern I did receive the verify device/location email using an invalid password but it is no longer sending the email.
- gregsadetsky 5y ago
  That would truly be the best outcome possible -- that LastPass sent out "Someone just used your master password" emails incorrectly i.e. those were false positives.
  - jagstangxl 5y ago
    They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.
    - gregsadetsky 5y ago
      But if your master passphrase is only used for LastPass (as is exactly my case -- I've never used it elsewhere), how can it can be credential stuffing? Or was the password breached from LastPass itself in the past? That's possible, but then it doesn't jell with people having this same issue with accounts created in November 2021. As far as I can tell, the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email we all received was only sent when a correct password was used. Incorrect passwords did not trigger that email. But yes, it would be great to learn that those emails were sent incorrectly i.e. it was a false positive (i.e. someone tried to login with a wrong password, but the email above was sent anyway). It's still not great that the wrong kind of email was sent, but that would be a low level bug.
      - jagstangxl 5y ago
        I was just able to trigger the email again on a bad password. Going to figure out the exact 123’s and screen record.
      - jagstangxl 5y ago
        I was never able to successfully trigger the false positive last night but I believe the most recent explanation from LastPass is in line with what I have been seeing. Intermittent false positive emails. https://www.techradar.com/au/news/lastpass-accidentally-scared-users-witless-with-false-breach-alerts https://www.techradar.com/au/news/lastpass-accidentally-scar...
        gregsadetsky 5y ago
        Yeah, just saw their new announcement (thanks for doing those tests yesterday by the way!) I don't know how much to read into their use of "some" and "likely" i.e. "some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error" I would want to know whether they can demonstrate that wrong passwords were used in this attack. And have an explanation for those users who received the email a 2nd time after changing their passwords.