4 ms·

There was some speculation over at /r/sysadmins that this was a dump of passwords that came from the compromise five years ago. I have no way to confirm/deny th

• londons_explore 5y ago
  Lastpass used to run a phpBB forum where the login system used your lastpass master password to log in. phpBB is notorious for security flaws. It doesn't seem unlikely that someone hacked the forum and modded it to leak user master passwords. More info: https://news.ycombinator.com/item?id=29706579 https://news.ycombinator.com/item?id=29706579
• foxfluff 5y ago
  That speculation is in direct contradiction with everyone here who claimed their much more recent passwords had also been compromised.
  • cout 5y ago
    Not necessarily. The 5 year old master password could have granted access to a service that made it possible to intercept the password change.
    • foxfluff 5y ago
      This was also happening to accounts that did not exist 5 years ago.
      • robbedpeter 5y ago
        It might be that the previous leak completely or partially exposed the algorithm of LastPass's password generator, or some other commonly used tool, and people being targeted show up on other lists. Credential stuffing with a targeted list of generated passwords. If passwords from other breaches fit the characteristics of a weak or compromised generator, that could also be used for targeting.