4 ms·

OP, the direction of this is totally based on these questions: - have you reused your LP master password as a password anywhere besides LP. - have you entered

OP, the direction of this is totally based on these questions: - have you reused your LP master password as a password anywhere besides LP. - have you entered your LP master password into anything besides a LP login window. (edit: nvm, ya it went into the other PW manager. Without investigating that, not worth pointing the finger at LP and causing enterprise LP account usage chaos). - Do you enter the LP password into only the browser extension from LP, your phone's LP app, and any other LP-official services when you log into it. If you can do a yes/no answers, totally clears this up or totally escalates it.

gregsadetsky 5y ago
> - have you reused your LP master password as a password anywhere besides LP. No. I computer generated this password to use it for this LastPass account only. The password was secure (mixed alpha case + numbers, longer than 12 characters), and stored in an encrypted KeePass file. > - have you entered your LP master password into anything besides a LP login window. (edit: nvm, ya it went into the other PW manager. Without investigating that, not worth pointing the finger at LP and causing enterprise LP account usage chaos). I have probably logged into lastpass.com's web ui directly i.e. without using their extension. So a compromised extension (back in 2017 when I last used this account/password) could have sniffed it. Or a malware monitoring my clipboard. > - Do you enter the LP password into only the browser extension from LP, your phone's LP app, and any other LP-official services when you log into it. As above, I most probably have used the password while logging into lastpass.com in Chrome with other extensions active.
- YPCrumble 5y ago
  Because it was stored in KeePass it sounds very likely that you’re copy pasting it into LastPass, which could have been intercepted by any malware that accessed the clipboard. Especially if you allow clipboard access to your phone from your computer.
  - gregsadetsky 5y ago
    I agree, that's a possibility. What's harder to understand: - with so many independent reports, including reports from accounts created as recently as Nov 2021, does it mean that we were all compromised by the same malware (across different devices, operating systems, etc.) - even stranger things like: https://twitter.com/Valcristerra/status/1475734357805572098 https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday and then someone just tried it again a few hours ago after I changed it. What the hell is going on?"

gregsadetsky 5y ago

> - have you reused your LP master password as a password anywhere besides LP. No. I computer generated this password to use it for this LastPass account only. The password was secure (mixed alpha case + numbers, longer than 12 characters), and stored in an encrypted KeePass file. > - have you entered your LP master password into anything besides a LP login window. (edit: nvm, ya it went into the other PW manager. Without investigating that, not worth pointing the finger at LP and causing enterprise LP account usage chaos). I have probably logged into lastpass.com's web ui directly i.e. without using their extension. So a compromised extension (back in 2017 when I last used this account/password) could have sniffed it. Or a malware monitoring my clipboard. > - Do you enter the LP password into only the browser extension from LP, your phone's LP app, and any other LP-official services when you log into it. As above, I most probably have used the password while logging into lastpass.com in Chrome with other extensions active.

YPCrumble 5y ago
Because it was stored in KeePass it sounds very likely that you’re copy pasting it into LastPass, which could have been intercepted by any malware that accessed the clipboard. Especially if you allow clipboard access to your phone from your computer.
- gregsadetsky 5y ago
  I agree, that's a possibility. What's harder to understand: - with so many independent reports, including reports from accounts created as recently as Nov 2021, does it mean that we were all compromised by the same malware (across different devices, operating systems, etc.) - even stranger things like: https://twitter.com/Valcristerra/status/1475734357805572098 https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday and then someone just tried it again a few hours ago after I changed it. What the hell is going on?"