14 ms·

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was

by bryan0 5y ago

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after clicking the "Delete" button. Is there anything more infuriating than this type of error message?

iso1631 5y ago
Ones which say "something went wrong" with a "funny" gif of someone scratching his head?
- hetspookjee 5y ago
  Add a recaptcha that barrely solves in the mix before being able to click on continue, or after logging in.
mNovak 5y ago
Just tried deleting my account--got exactly that error. That's not reassuring
- scrapcode 5y ago
  Same here. It appears(?) that my account got deleted.
  - vinnymac 5y ago
    Confirmed. I deleted my account, received the error above. Then when attempting to login again, I was told my email was mistyped. I stopped using LastPass a long time ago, but this has definitely put them on thin ice for me, I won't be recommending them going forward.
    - scrapcode 5y ago
      Ditto - I recently switched to BitWarden and kind of forgot that I was still giving it a self determined "trail period." This certainly kicked that trail period into my new current password manager.
- tuwtuwtuwtuw 5y ago
  If you Google for the error message you'll find that this behavior has been there for several years. I guess they just don't care about the usability in his part of the process. I tried deleting an account with dev tools installed and the web server gave HTTP error 500 (internal server error). I think the JavaScript just bails out at that point. From 2019: https://www.reddit.com/r/Lastpass/comments/afmfop/cant_delete_lastpass_account/ https://www.reddit.com/r/Lastpass/comments/afmfop/cant_delet... From 2020: https://twitter.com/jowouters/status/1222438393981886464 https://twitter.com/jowouters/status/1222438393981886464 There's a ton of those posts. Some in the official LastPass forum as well, and the response from LogMeIn was basically that the account was deleted. (It's of course crappy, just saying that this behavior is nothing new and probably just something they don't care about enough to fix..)
- deadbunny 5y ago
  I had the same when deleting my account 3 years ago. LastPass is hot garbage and LogMeIm are the perfect home for it being a dumpster fire of a company.
ksec 5y ago
>Must be a compromised browser extension at this point. The previous thread had password never typed, copied or used for years. Unless we are talking about multiple vector, otherwise browser extension doesn't fit most of the reported scenario.
- robbedpeter 5y ago
  Maybe hashes got snarfed somehow, possibly multiple times, and some passwords shook out of a rainbow table? Impending company changes also raises the possibility of an insider attack.
- hda111 5y ago
  Agreed. If it was a compromised extension it would steal all the passwords when you unlock and upload it somewhere like pastebin.
foxfluff 5y ago
"Something went wrong" > Is there anything more infuriating than this type of error message? Well the other classic move by webshits is to have you stare at a spinner indefinitely.
tyingq 5y ago
>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount of the size as arrays of localized text, error messages, lists of numbers, etc. But it is still a lot of JS.
- yawaworht1978 5y ago
  Wow, how can this amount of files be justified? And how did this breached exactly happen?
  - samtho 5y ago
    > Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.
    - hetspookjee 5y ago
      I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.
      - feoren 5y ago
        Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".
        deleted 5y ago
        [deleted]
shakna 5y ago
> Must be a compromised browser extension at this point. In their 2019 breach, JS on arbitrary pages was able to access the contents of LastPass' own extension to obtain the last used username/password combinations. [0] As, today, the extension now contains 25Mb of JS, making it difficult to audit, I wouldn't say that it has to be someone else's fault until proven. [0] https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
smitop 5y ago
For me I was able to reset my account (which removes all data) but not delete it. It appears to be an issue with their WAF blocking requests to the account deletion endpoint.
mvolfik 5y ago
I did not get any email about login attempt, but deleted my old Lastpass account as a precaution anyways, and also received this error. No confirmation of deletion via email. However, I'm not able to log in anymore, and attempts to get master pwd hint via email don't work either, so I believe it's more or less deleted.

by bryan0 5y ago

iso1631 5y ago

Ones which say "something went wrong" with a "funny" gif of someone scratching his head?

hetspookjee 5y ago
Add a recaptcha that barrely solves in the mix before being able to click on continue, or after logging in.

mNovak 5y ago

Just tried deleting my account--got exactly that error. That's not reassuring

scrapcode 5y ago
Same here. It appears(?) that my account got deleted.
- vinnymac 5y ago
  Confirmed. I deleted my account, received the error above. Then when attempting to login again, I was told my email was mistyped. I stopped using LastPass a long time ago, but this has definitely put them on thin ice for me, I won't be recommending them going forward.
  - scrapcode 5y ago
    Ditto - I recently switched to BitWarden and kind of forgot that I was still giving it a self determined "trail period." This certainly kicked that trail period into my new current password manager.
tuwtuwtuwtuw 5y ago
If you Google for the error message you'll find that this behavior has been there for several years. I guess they just don't care about the usability in his part of the process. I tried deleting an account with dev tools installed and the web server gave HTTP error 500 (internal server error). I think the JavaScript just bails out at that point. From 2019: https://www.reddit.com/r/Lastpass/comments/afmfop/cant_delete_lastpass_account/ https://www.reddit.com/r/Lastpass/comments/afmfop/cant_delet... From 2020: https://twitter.com/jowouters/status/1222438393981886464 https://twitter.com/jowouters/status/1222438393981886464 There's a ton of those posts. Some in the official LastPass forum as well, and the response from LogMeIn was basically that the account was deleted. (It's of course crappy, just saying that this behavior is nothing new and probably just something they don't care about enough to fix..)
deadbunny 5y ago
I had the same when deleting my account 3 years ago. LastPass is hot garbage and LogMeIm are the perfect home for it being a dumpster fire of a company.

ksec 5y ago

>Must be a compromised browser extension at this point. The previous thread had password never typed, copied or used for years. Unless we are talking about multiple vector, otherwise browser extension doesn't fit most of the reported scenario.

robbedpeter 5y ago
Maybe hashes got snarfed somehow, possibly multiple times, and some passwords shook out of a rainbow table? Impending company changes also raises the possibility of an insider attack.
hda111 5y ago
Agreed. If it was a compromised extension it would steal all the passwords when you unlock and upload it somewhere like pastebin.

foxfluff 5y ago

"Something went wrong" > Is there anything more infuriating than this type of error message? Well the other classic move by webshits is to have you stare at a spinner indefinitely.

tyingq 5y ago

>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount of the size as arrays of localized text, error messages, lists of numbers, etc. But it is still a lot of JS.

yawaworht1978 5y ago
Wow, how can this amount of files be justified? And how did this breached exactly happen?
- samtho 5y ago
  > Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.
  - hetspookjee 5y ago
    I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.
    - feoren 5y ago
      Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".
      - deleted 5y ago
        [deleted]

shakna 5y ago

> Must be a compromised browser extension at this point. In their 2019 breach, JS on arbitrary pages was able to access the contents of LastPass' own extension to obtain the last used username/password combinations. [0] As, today, the extension now contains 25Mb of JS, making it difficult to audit, I wouldn't say that it has to be someone else's fault until proven. [0] https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

smitop 5y ago

For me I was able to reset my account (which removes all data) but not delete it. It appears to be an issue with their WAF blocking requests to the account deletion endpoint.

mvolfik 5y ago

I did not get any email about login attempt, but deleted my old Lastpass account as a precaution anyways, and also received this error. No confirmation of deletion via email. However, I'm not able to log in anymore, and attempts to get master pwd hint via email don't work either, so I believe it's more or less deleted.