18 ms·

LastPass user vaults stolen in recent hack

533 points by mikece 4y ago

sn0w_crash 4y ago
Again?
CommitSyn 4y ago
Welp, looks like they were able to copy vaults to crack and, worse yet, they have the unencrypted URLs to choose what to target. > The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass. The encryption and decryption of data is performed only on the local LastPass client. For more information about our Zero Knowledge architecture and encryption algorithms, please see here.
- idatum 4y ago
  LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there". Let's assume one's master password is strong. And that LastPass knows how to encrypt data. We're really down to whether 256-bit AES can be brute forced, right? And I guess understanding phishing attacks. I mean, yes, wouldn't it be great of LastPass took the measures with its development environment years ago? So put another way: Lack of operational excellence hopefully is made for in strong encryption. I hope.
  - WhatsName 4y ago
    contains both unencrypted data, such as website URLs, No I think this is the worst that could have happened short of loosing the clear-text passwords. Noone is going to stop the attackers from looking for high-value login URLs and than spear-phish the password for the offline vault. Forcing a password reset onto customers is not going to help LastPass here.
  - eastbound 4y ago
    > LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there". This is why a company’s bug bounty should be the sum of the assets protected by the data they have, for all their customers, minus $1. Sounds crazy? Don’t store all passwords at the same place.
  - cogman10 4y ago
    Unfortunately, if you like me have been a LP customer for years you are hosed. Early on, they only did 500 rounds of AES which significantly weakens you even with a strong password. So, I've had to change my master password and now I'm in the process of updating all my passwords :( By not forcing a re-encryption when they uped the number of rounds, LP has hung all their old time customers out to dry with this leak. It's not ok.
- tokenfg 4y ago
  'form-filled data' includes 'Payment cards' section I believe, which should then make securing your cards an even larger priority than having to change your passwords
- rob74 4y ago
  Hm, with all that talk about "zero knowledge architecture", I thought your vault file would be encrypted "in one piece", not just the passwords. If they have the URLs in clear text, that's not really zero knowledge, now is it? And why do they need the URLs anyway, when I can share the passwords just fine from my local PC? Statistics?!
  - sf_rob 4y ago
    Honestly, URLs are a potentially massive threat vector themselves. Are the urls associated with individual users either directly or in a bucketed fashion? Seems like no to the former but the release leaves a lot to be desired.
  - Arbortheus 4y ago
    Is anyone aware whether Bitwarden encrypts everything, or just the passwords like lastpass?
    - aiisjustanif 4y ago
      According to Bitwarden it’s all Login information (including usernames, passwords, URIs, TOTPs, etc.). [1] [1]: https://bitwarden.com/help/vault-data/ https://bitwarden.com/help/vault-data/
      - Arbortheus 4y ago
        Nice, thank you
- TechBro8615 4y ago
  Why are the sites where you have accounts not part of your encrypted vault? Can someone confirm my understanding that 1Password does in fact encrypt the entire vault, including the URL/domain associated with each login?
  - hn_throwaway_99 4y ago
    No, as stated, they don't encrypt the URL. This is likely so that, regardless of what you have entered for your "when is master password required" settings, the browser plugin can highlight when it knows that you've entered a password for a site.
    - wlonkly 4y ago
      Was your answer about what LastPass does, or what 1Password does? The person you replied to was asking about 1Password.
d2049 4y ago
Similar to “not your keys, not your crypto” is there not an analogy to be made for passwords? Genuinely interested in the reasoning of people who store their passwords in a cloud service they don’t control.
- wmf 4y ago
  This will keep going until there exists a cloud backend that you do control. People won't go back to non-cloud.
- alanfranz 4y ago
  It's your keys. The master password is yours only. Plaintext passwords don't exist in remote services; basically they're a specialized version of a storage system (Dropbox?Google Drive? S3?) optimized for password entry sharing between devices, versioning, etc.
snailmailman 4y ago
Wow. This is basically the worst case scenario. Attackers got access to the vaults themselves? While they are encrypted, it all depends on how secure your master password is now. Because the brute-forcing has almost certainly already begun. I switched away from lastpass to Bitwarden a while ago, and have changed many of my passwords since then. But I’ll probably rotate most of my passwords anyway, out of an abundance of caution.
- FatActor 4y ago
  This is not the worst case scenario. This is literally the best case hack scenario. Why? Because we already know that encrypting something using their strategy is essentially uncrackable. AES256 is quantum resistant. The worst case would be silent exfiltration from the LastPass application via malware to steal user master passwords. In the security game, the crypto is the strongest part, the crypto-system is the weakest part.
  - CookieCrisp 4y ago
    While I agree with your main point, I think confirmation that the URLs weren't encrypted and that they can all be tied to your Lastpass signup information is far from "best case"
    - FatActor 4y ago
      I missed that part. What is the problem about URL exposure? EDIT: all three replies to this comment are about sex-shaming people via their email address, ip, home address. hardly pearl clutching. go to DefCon some day, you'll see how that information is basically for sale legally, let alone on the darkweb. i don't have a horse in this race because i use my own password storage software but the amount of FUD in this thread is cray cray.
      - deleted 4y ago
        [deleted]
      - 4y ago
JackMorgan 4y ago
I switched to KeePassXC and syncthing and other than a little bump once when I accidentally caused a merge I've been really pleased with the setup.
jackson1442 4y ago
@dang, could the title be updated to indicate that this is another update to the existing blog post? Currently reads like it's a new incident, not the aug2022 incident.
- dang 4y ago
  Sure, I've added "[updated]" above.
  - lyu07282 4y ago
    tbh even "Notice of Recent Security Incident [updated]" instead of "LastPass User Vaults stolen in recent hack" or something feels like PR damage control in favor to LastPass
    - dang 4y ago
      I agree that corporate press releases usually bury the lede and, in the case of negative stories, are often outright misleading. For that reason we often change them (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=press%20release%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). I've used your suggestion above. Thanks! If anyone suggests a better title (i.e. more accurate and neutral), we can change it again, and if there's a better third-party article that covers whatever the latest news on this is, we could switch to it.
- iLoveOncall 4y ago
  It absolutely is a new incident. LastPass is in PR damage control mode and trying to make it seem like accessing those backups was inevitable after their source code theft, but it's not the fucking case. This is yet another failure on LastPass' end. The only thing in common is the attacker, that's it.
- ghostpepper 4y ago
  They updated the fifth paragraph down to mention that encrypted passwords and unencrypted metadata has been stolen - in my mind that practically qualifies as a new incident
snug 4y ago
I've tried a lot the password safes/vaults, and none of them work nearly as well as Chrome/Googles password manager You can even use it on iOS, and even use it by default. Even apples Keychain password manager works pretty well if you're all in on apple ecosystem. Only reason I see why you would not use it is if you're not using Chrome or Safari, which is most people. Yeah, yeah, google evil
- mook 4y ago
  The risk there is more you accidentally make a bad comment on YouTube and Google bans your account, I think. I have no idea if I'd still be able to access my passwords if that happens. At least, personally I feel Google deciding to disallow me from logging in is more likely than Google losing my passwords.
  - snug 4y ago
    That is only a risk for syncing, you would still still have your passwords locally saved
    - jackson1442 4y ago
      Is there a local UI to view/export your passwords? The only one I'm aware of is https://passwords.google.com https://passwords.google.com but it's been a long time since I've used a builtin browser password manager. also- does Google (or other browser devs) release information on how they keep your passwords secure? Is it even E2EE?
      - joshmn 4y ago
        > Is there a local UI to view/export your passwords? chrome://settings/passwords
      - snug 4y ago
        Yes, no need to use the web, all done from the browser. To your second question, I don't know, but thats only a concern if you export your passwords
SoftTalker 4y ago
I use a PGP encyrpted files on my local computer. https://www.passwordstore.org/ https://www.passwordstore.org/ actually. I don't trust any cloud-hosted password manager.
- drexlspivey 4y ago
  What if you want to log in from your phone?
  - SoftTalker 4y ago
    I don't do that. I have a gmail account tied to my phone (Android) and I've logged into that once and it just stays logged in. I don't use that account for anything else. I don't really do anything else on my phone that requires a login.
    - dimgl 4y ago
      > I don't do that. So your solution is unreasonable for 95% of consumers. Nice.
      - dspillett 4y ago
        But likely 100% of the 1 user they were trying to support. And given the varied needs of people, a suggestion that is reasonable to 5% of them is not bad going. And even 0.001% of them is infinity more than all the alternatives you've suggested in this thread thus far :-)
      - _Algernon_ 4y ago
        Considering they answered a question, and weren't trying to provide a solution to 100% of consumers I don't see how its a problem warranting your response.
    - larrybud 4y ago
      I’m not sure if you’re trolling or not, but let’s play this out. You really don’t use your phone for any of the following? (Web or app) Online banking Online shopping Social media Airlines, hotels, or other Tavel bookings Online news sources requiring accounts Eg hacker news, NYT, etc Medical / pharmacy
heluser 4y ago
Not surprising to see another LastPass incident but I wonder why nowadays anyone would choose LastPass over 1password
- CookieCrisp 4y ago
  I switched to 1password after this breach was first announced, but I find it a lot more annoying to use (and I found Bitwarden even worse). Granted, nowhere near as annoying as the breach. Lastpass got in my way a lot less frequently though.
- bryfb 4y ago
  I certainly wouldn't choose LastPass over 1Password, but given 1Password is deprecating local storage I wouldn't recommend 1Password anymore either.
  - heluser 4y ago
    I used to have a local only manager but then, obviously, syncing becomes a problem. And then it becomes a choice between syncing an encrypted blob using your own solution (potentially not very secure) vs using a provider who still treats your data as an encrypted blob with no access to the data and tries to do it securely. I think the provider is still more secure (again assuming the 1password access model not talking about LastPass-like providers) plus much more convenient. So if not 1password what would be a recommendation assuming syncing is required?
- twistedpair 4y ago
  I prefer LastPass' featureset over 1Password, when I've trial them both, but I certainly don't prefer LastPass' opsec.
- deleted 4y ago
  [deleted]
sli 4y ago
My local, managed-by-me KeyPass database has never had a security incident or even come close. That's all I'm gonna say about that.
- bagels 4y ago
  Would you actually know?
  - sodality2 4y ago
    By that logic you also wouldn't know if your keys/password database stored by Lastpass/others (in the browser extension or app) is stolen, it's all just local data.
    - bagels 4y ago
      Isn't that what this whole thread is about, it being discovered that LastPass had an actual breach?
- alanfranz 4y ago
  not yet. But there's actually a lot of surface attack area for those open source tools as well. If you're able to sneak into the supply chain and replace the _client_ with a modified, malicious version, you can make it send the master password AND the database to a remote server. No need to compromise the server. This is true for most commercial password managers as well: but I'd expect the security to be tighter there. No random maintainer should get access to the release page. My idea was like this: * Use KeepassX built from source * Use Dropbox to sync the kdb files (always encrypted) * Use a firewall to prevent any network connection to keepassx; this way even a compromised client cannot connect and send the data somewhere else. * When updating KeepassX, always build from an older git commit; I assumed that in ~15-20 days if there's a fuckup on git source, it will be announced. BUT: it was hard. Bitwarden just works better. I still build it from source on desktop computers, though, and take a look at the website before updating, just to stay sure. (And I think IOS app process will make it harder to submit malware there anyway).
alexhjones 4y ago
No need to brute force - if users re-used their master password, it will potentially cross-reference with the correct email and password combo from any number of previous data breaches and pwnage across the net.
- yasp 4y ago
  Good news for people who followed best practices. "I don't have to outrun the bear; I just have to outrun you."
  - jacquesm 4y ago
    There isn't just one bear.
  - AlexCoventry 4y ago
    This bear has the ability to spin up an AWS cluster of bears, unfortunately.
    - dijit 4y ago
      AWS is probably the most expensive way to do this. Either rent some machines from an ex-crypto miner, since AES can be decyphered on GPUs or get some old extremely cheap boxes from the hetzner auction.
      - nikau 4y ago
        People who are trying to crack these passwords are also likely to be using compromised AWS accounts.
    - yasp 4y ago
      They're still subject to economic considerations (assuming a non-state actor). If the expected value on a cracked account is less than the expected cost to crack it, a rational actor won't bother. That they may use cracked AWS accounts, or botnets, to perform this cracking does not change these economic considerations.
AdmiralAsshat 4y ago
Why in God's name would they store the URLs unencrypted? Even if they don't crack the account password, you've just given the attackers a lovely dossier of every place I've ever visited frequently enough to make an account. And this is far worse than simply doing reverse-lookups of my email address across site breaches, since I use multiple email addresses and alias-only logins. Nice. Fucking. Job.
- meroje 4y ago
  Presumably this would be to ease looking up individual items but 1password has been able to encrypt those since 2012. Nice indeed
- edsimpson 4y ago
  Does anyone know if bitwarden encrypts the URL? A quick search of their docs didn’t turn anything up.
  - sliken 4y ago
    Each unique Bitwarden account has an encryption key derived from your Master Password, according to the methods defined in Encryption. This encryption key is used to encrypt all Vault data. From: https://bitwarden.com/help/account-encryption-key/ https://bitwarden.com/help/account-encryption-key/ Seems crazy for anyone to keep using LastPass
- joenathanone 4y ago
  Not to mention some of the saved URLs may include sensitive information in the URL query string, including things like email address, physical address, etc...
- jasonhansel 4y ago
  Also: thanks to "forgot my password" features, if someone gets your email password, they can now find and access all your (non-2FA-enabled) accounts.
  - 4y ago
haunter 4y ago
Theoretically this can happen to Bitwarden Web Vault too, right? Unless I self host it of course
- sliken 4y ago
  Sure, but it's 100% encrypted, not some silly case where things like URLs are in plaintext.
- jupp0r 4y ago
  What makes you think that it couldn't happen to your self hosted vault?
  - haunter 4y ago
    It's more like I'd accept my own fault more than trust a 3rd party (Bitwarden, or LastPass) in this case
blakesterz 4y ago
It's not clear to me, does this mean EVERYONE that uses LastPass got hit or some subset of users?
- dodgerdan 4y ago
  Everyone.
dangero 4y ago
To further increase the security of your master password, LastPass utilizes a stronger-than-typical implementation of 100,100 iterations of the Password-Based Key Derivation Function (PBKDF2), a password-strengthening algorithm that makes it difficult to guess your master password. You can check the current number of PBKDF2 iterations for your LastPass account here. I just checked my account and it says 5000 not 100,100 -- there's no way I would go in and change that setting, so this is pretty disingenuous. They must have changed defaults at some point
- cogman10 4y ago
  I have an older account, it was 500 when I went to check. I'm livid that LP didn't do a reup on the encryption when they moved to 100k cycles. They've basically hosed every customer that's been with them for a while.
  - mister_tee 4y ago
    mine was set to 500 (not 5000) as well. I'd moved on from lastpass earlier this year but didn't delete my account... though I suppose in that case I'd wonder if I'd deleted in time, or if they really deleted all my info. Also frustrating that they decided to drop this update on December 22. And how do they square "Zero-knowledge security" and the diagram in https://www.lastpass.com/security/zero-knowledge-security https://www.lastpass.com/security/zero-knowledge-security with URLs and last-accessed times being plaintext? I suppose "items in your vault" is doing a lot of work there if they don't count urls as "in" the vault.
- snailmailman 4y ago
  I do think the default a long time ago used to be very low. I know I went in at account creation and set it to something way higher than it's default at the time. Looking now though, it says 100100 for me. But i also know i changed my master password at some point, so maybe i got reset to the current default.
  - hunter2_ 4y ago
shadowgovt 4y ago
I've done a lot of things wrong with OPSEC in my life... ... But I never trusted a third party to store all my passwords.
hbn 4y ago
Why do people use password managers that store all the data on their own servers? Having a centralized database filled with full login information for hundreds of thousands of accounts across all your users (and accounts users clearly care about, mind you, otherwise they wouldn't go out of their way to use a password manager) makes for such an obvious jackpot attack vector that causes situations like this. I've used Enpass for years now which lets you sync your password database to DropBox, Google Drive, iCloud, etc. So I still have to protect whichever cloud storage account I'm syncing with, but at least it's not an obvious place to find passwords for thousands of users. And if someone did have access to my Google or Apple account, they could reset a lot of my logins anyway. And I know this isn't technically as safe as the self-hosted options, but it offers the same convenience as LastPass without the obvious painting-a-target-on-your-own-back by handing all your passwords over to The Passwords Store.
- camel_Snake 4y ago
  Just chiming in to say I've been satisfied as an Enpass user as well. Felt like a good middle-ground to me and I bought the app before the restructured their pricing model so I was grandfathered in.
- clumsysmurf 4y ago
  Is Enpass an electron based app?
  - spoils19 4y ago
    This is important: please respond. I generally disallow electron apps on my personal machines as a matter of principle.
    - GrabbinD33ze69 4y ago
      Lol why? Are you completely against anything that uses chromium?
      - IIsi50MHz 4y ago
mjsweet 4y ago
I just went into my old lastpass account to try and wind down the account, delete everything, and then close the account. No option to "select all" in the list so I resorted to clicking the check box on by one down the page. I accidentally slightly clicked outside a check box... guess what? Everything gets deselected. Start over. Ok start again, maybe I want to list in alphabetical order rather than group by category to minimise mistakes. Whoops, selecting that option deselects everything in the list. 300 odd deleted in batches of 30-40. When a company's whole application is covered in anti-patterns and dark UX to make it as hard as possible to leave then companies like this deserve to die. Deleting the account is a bit tricky too. 1. Go into account settings in the top right drop down 2. In the Links area click on "My Account" which spawns a new browser window 3. Click the red "Delete or Reset Account", you can't miss all the red buttons 4. You can either reset your account or delete, choose delete 5. A modal will appear telling you stuff, enter your master pw, a reason why your leaving and then click delete 6. You will be asked twice if you really really want to do this 7. Press ok
- robszumski 4y ago
  It's become so clear that users of a SaaS deserve more control how their data is used and stored. You should absolutely be able to crypto-shred your data from such an important service. This experience sounds awful.
  - flandish 4y ago
    I had migrated away a year or so ago. Tried to log in to confirm, it did not work. Tried password reset. No reset email. So that’s good… I guess. I remember deleting my acct. not sure if I manually deleted entries before though. That said - if a data breach includes backup access… is your account ever really deleted?
- drewnick 4y ago
  I also did not have a "Select all" box but was able to check the first entry, scroll down, hold shift, and check the last box which then selected all items in between. So I removed all of 600 of my accounts in about 20 seconds. Hope this helps someone.
lbj 4y ago
Well.... Unencrypted access to all the sites each username/email has an account with could be very damaging for some individuals.
jamal-kumar 4y ago
I'm sorry but if you were using this why are your passwords in the cloud? Doesn't that whole concept set off like thousands of alarm bells in your mind about how it could go wrong? I know it's convenient or whatever, device synchronization or whatnot but compromising security for convenience is a thing I thought we might have been aware of avoiding at this point.
- autoexec 4y ago
  You're not wrong. Somethings are fine to keep on someone else's server but a record of every password you have probably shouldn't be one of them.
phillipseamore 4y ago
I'd like to point out to users who have 2FA on their LP access and think they are safer, that does not protect the vault in a compromise like this, it only enhances the security of delivering the vault, the attackers here already have the vaults. Vaults are only protected by password.
rangersanger 4y ago
their marketing team needs to get their shit together and not have a newsletter signup popup on this particular page.
mhss 4y ago
When I worked at LogMeIn (previous owners of LastPass), I relocated to Budapest and worked in the same building as LastPass' engineering (I was in another division though). Getting a sneak peek of how the sausage is made gave me the hibbie jibbies and I switched to 1Password there and then. It appears like I dodged a bullet.
- __turbobrew__ 4y ago
  What did you see?
  - mhss 4y ago
    I cannot talk about specifics obviously since I was an employee. I can only say I did not see the sw engineering and infrastructure rigour I'd expect from a service that is managing very sensitive information.
    - semicolon_storm 4y ago
      Sounds about right. Awhile back I noticed the LastPass password generator was not in fact outputting a random password but that at least a few characters of the password followed a predictable pattern. I reported it and it was fixed, but it's beyond me how a supposedly security focused company can let such a severe bug in such an important yet simple feature get to production.
  - intelVISA 4y ago
    Zero Knowledge Architecture(tm)
    - Obscurity4340 4y ago
      ™
  - EspadaV9 4y ago
    How sausages were made, apparently.
jcadam 4y ago
Looks like I'm out $36. My LastPass subscription auto-renewed TODAY. But I obviously can't trust it, so I'm in the process of changing passwords and emptying my vault :(
- phillipseamore 4y ago
  Look at it this way: you just bought your self a ticket for the class-action lawsuit.
  - jcadam 4y ago
    Ooooh, there may be a year of free credit monitoring and maybe even a check for $36 in my future.
civopsec 4y ago
I use a password database (a file, local) which is unlocked with a passphrase/word. It takes about five seconds to unlock. This works for me since I almost only use accounts on laptops/desktops.
userbinator 4y ago
"Pay us and give us all of your most important secrets, and we promise we'll keep them safe." In any sane world that would be an unbelievable thing to say, yet entire companies exist with just that intention. Behold the power of marketing.
smcleod 4y ago
To quote the verge: > "...The announcement doesn’t get to the part about the vaults being copied until /five paragraphs/ in. And while some of the information is bolded, I think it’s fair to expect that such a major announcement would be at the very top."
jhanschoo 4y ago
I use a secret algorithm + common salt that I can perform mentally to derive more-or-less unique passwords from service provider names. I don't trust any password manager, and this gives me the convenience of knowing my password across devices.
- edent 4y ago
  What happens when a service asks you to change your password? How do you remember that it is F4c3b00k$2 rather than F4c3b00k$1? What happens to your algorithm if the password requirements reject special characters?
  - KyleJune 4y ago
    Not the person you were asking but I have a mental algorithm I use that produces unique salt for each website. When I run into issues about special characters not being accepted, I replace them with the number equivalent. For example 5 instead of %. It can be a pain to forget but there aren't many sites I use that are like that. I still use a password manager I can reference if my algorithm isn't working for some reason.
ramraj07 4y ago
I was and am continuing to be a LastPass user. I’ll probably start looking into migrating but not with any great hurry because I never trusted any password manager that much to begin with - never stored my primary account passwords or financial account passwords with them for this reason. Password fatigue is real but not all passwords are the same so why treat them as such?
WiggleGuy 4y ago
Note to folks who are migrating away from LastPass now: https://news.ycombinator.com/item?id=33810084 https://news.ycombinator.com/item?id=33810084
- javawizard 4y ago
  Oof, that aged well: > Too much work. At that point, it’s easier to just hack the LastPass servers.
deleted 4y ago
[deleted]
chunk_waffle 4y ago
Are URLs the only thing that's unencrypted? That's bad enough, but what about other fields? I know I've accidentally saved passwords in the username field before, stored sensitive info in the note field as well. I guess moving off of LastPass is how I'll be spending my Xmas...
- weaksauce 4y ago
  I don't think the other fields would be unencrypted. url makes some sense for an extension that doesn't need to unlock the vault to know if there is a password available for a site. it's not the end of the world but it certainly isn't a great look. look at bitwarden. the hn famous security guy tpatek or however you spell his handle recommended that a while ago and it's open source and pretty good. the ui kinda is not amazing but i guess that's alright. (it's 2022 almost 2023 how are they not letting you sort by recently created/used/etc?)
  - nequo 4y ago
    The notice uses language that implies that other fields were unencrypted too: contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data “Such as website URLs” reads like it’s giving one example among multiple other fields that are unencrypted. Now I wonder if the notes are not in fact encrypted either since if the user wanted those to be secure too, they would’ve written them in a “secure note.”
    - pcthrowaway 4y ago
      If notes are unencrypted then I'm absolutely fucked. I really hope this isn't the case. I assumed they were, I thought I read they were even. But now I can't find anything confirming this. Lastpass, please advise
      - wlonkly 4y ago
        A description of Lastpass's vault structure[1] suggests that notes inside entries were encrypted (index 4). I have no additional information about the veracity of that description though. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md#structures-of-some-types-of-composite-data-blocks https://github.com/cfbao/lastpass-vault-parser/blob/master/l...
lofaszvanitt 4y ago
The biggest bummer is that it was said back in August that some shitty info was obtained by the hackers... few months later... sorry something else was also obtained. This is the worst. They should've scrubbed everything clean the dev had access to. As a client, when your instincts kicked in alerting you that your passwords are in danger, you might've been patting yourself in the back saying to yourself: ok, my passes are safe, phew. Well...
systematical 4y ago
Ugh gonna need to reset some shit. Luckily I don't keep financial or my email pass in there. Those few I remember.
mac-chaffee 4y ago
They talk about how the federated version is safer due to the long random master password, but... Federated LastPass is tied to your company's SSO, which means your real master password is technically a login.microsoftonline.com (or equivalent) cookie stored in plain text on your hard drive that is valid for 8+ hours. One bad "pip install" typo and your teams' passwords are toast. That was true even before the breach.
locusofself 4y ago
Switched to Bitwarden a couple years ago. It works well for me. Mostly use the Chrome extension and I don't host it myself. Works pretty well with my iPhone as well. and I'm using the free tier.
x86hacker1010 4y ago
for (item of document.getElementsByClassName('vault-item-displayname')) { item.click() }
LastTrain 4y ago
The amazing thing about this is, if at my company we had a project to migrate that much data, it’d take a month. There would be multiple layers of security to move through. How’d these ‘actors’ sneak in and get it all? I think they’ve had access longer than LP is letting on…
jason-phillips 4y ago
To add more data to the other comments, some federal agencies started pushing employees to use lastpass for work-related accounts a couple of years ago.
singularity2001 4y ago
Is it easier to guess the master keyword if some of the encrypted passwords are known to the attacker? Because on dozens of (previously hacked?) "unimportant" sites I still used a very week common password.
- hamilton987 4y ago
  [dead]
pushedx 4y ago
> “The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both _unencrypted data, such as website URLs_ …” Other threads here have discussed the potential for this collection of sign-up information and URLs to be used for blackmail and to discover hidden services. There is another major problem: mapping these URLs to existing breach dumps. The attacker now has a list of email addresses and associated URLs. From existing breach dumps (haveibeenpwned.com), they can now try all known passwords associated with these email addresses on all of these URLs. Many passwords stored in LastPass are repeat passwords, and they will gain access to many services without any brute force needed. There will be a class action lawsuit for this gross negligence in security and false and misleading documentation and marketing materials. My hope is that LastPass is forced to liquidate all assets and distribute them to their former customers, in addition to being liable for damages and wasted time related to migration to another password managememt solution, not to mention suffering related to any potential blackmail or disclosure of proprietary information.
zmmmmm 4y ago
Unless I missed it they have left out the critical information about the timing of when the password database backup was taken. This makes enormous difference ... it could be that the attackers have had months to brute force this already if it occurred shortly after the August incident vs if it happened yesterday it is very unlikely they have brute forced many accounts. If they don't know they should say they don't know, if they do know they should absolutely be telling people this!
- alzaeem 4y ago
  I am also looking for this information. I largely switched away from lastpass over the last 12 months, and only a few low-value credentials remain in it. But if this is an old backup, then it is more concerning for me.
macrolime 4y ago
Every time you use lastpass to autofill a form. The log your ip adresses, a timestamp and the site you were logging into. Kinda sounds like the attacker got this data.
- ThePowerOfFuet 4y ago
  > Every time you use lastpass to autofill a form. The log your ip adresses, a timestamp and the site you were logging into. [citation needed]
  - macrolime 4y ago
    In lastpass teams at least these logs are available in the control panel.
ThePowerOfFuet 4y ago
>unencrypted data, such as website URLs Why the fsck are they storing these unencrypted? This is data mining _and_ phishing gold. What a clown show.
mwaitjmp 4y ago
Can anyone explain how shared folders work with lastpass? How is the data encrypted at rest? Who’s master password is used to store that data?
domlebo70 4y ago
Noob here. How bad is this? AES256 is essentially uncrackable no? I think I want to move off LastPass anyway to 1password. What's best way? I assumes steps are to: 1. Import lastpass stuff into 1password. Rotate all passwords?
- rencrisa 4y ago
  AES256 is still secure, assuming the encryption key has ~256 bits of entropy (32 random bytes). Assuming your master password is reasonably complex, hopefully the encryption key derived from your password has enough entropy. Despite this, I recommend rotating all passwords (if you don't have the time, prioritize rotating passwords on important accounts / putting MFA on them). For all we know, lastpass might have had a full compromise (i.e. access to unencrypted vaults from malicious source code commits).
dark-star 4y ago
I wonder why people moved away from a (local) KeePass database that is optionally synced through GDrive, OneDrive or NextCloud between their devices. That works perfectly fine and relies only on your KeePass master PW strength, not on some 3rd parties' security
- baal80spam 4y ago
  From the top of my head: laziness, marketing...
- hacker_newz 4y ago
  The KeePass Ui is terrible.
  - dark-star 4y ago
    how so?
_dain_ 4y ago
Maybe now I can convince my employer to move away Lastpass. I hated it on sight because of the GUI. Look at this thing, it's like Attack of the Fifty Foot Whitespace: https://files.catbox.moe/d81urx.jpg https://files.catbox.moe/d81urx.jpg
- voidee 4y ago
  What are you going to recommend? I’m leery of just moving to another cloud provider.
koreth1 4y ago
From what I can tell from reading about this, it seems like people are mainly worried about brute-force password-guessing attacks. Lots of people pick lousy master passwords so there is the possibility of some real damage being done. What I am trying to suss out is how worried I should be. My master password is a ~20-character mixed-case nonsense passphrase with spelling errors and digits thrown in. Am I being clueless about the threat level if I conclude that there’s a vanishingly small chance my stuff will get decrypted? Ironically, “switch away from LastPass” was on my to-do list for the holiday week anyway, but now, just to be on the safe side, I guess it will be that plus “change all the passwords on accounts I care about.”
kerng 4y ago
Does Lastpass have a requirement on the length of the master password? Documentation says they recommend 12 characters as minimum, which seems short. Wondering if its enforced or if it's possible to have "password123" as master password? Also, sounds like URL leaked in clear text - so targeted attacks will be very likely. This is quite bad with long running implications.
Vishalthevaxus 4y ago
If you're a LastPass user, you need to be alarmed (and maybe even a little intimidated) by the recent security breach update revealing that threat actor was able to access and copy a BACKUP OF CUSTOMER VAULT DATA, including fully-encrypted sensitive fields like website usernames and passwords, secure notes, and form-filled data.
- Fire-Dragon-DoL 4y ago
  I wish it was just that. Apparently URLs are not encrypted, and they also have non encrypted fields about "password breached" and "password poor quality"
- SV_BubbleTime 4y ago
  Didn’t everyone anticipate this? It’s still not a problem if you used a good passphrase, and haven’t reused it anywhere else. It’s not ideal, but losing the encrypted blob isn’t that big of a deal if all the other parts were working correctly. Lastpass claims user local decryption so they never had your key. This isn’t that much different than logging in on a foreign computer, or storing your keepass on Dropbox, or losing a USB with the encrypted blob on it. I’m not defending them, just being practical that this still won’t effect most users.
  - nixgeek 4y ago
    “all the other parts are working correctly”, is IMHO the issue here, because LastPass doesn’t consider the URL to be sensitive material. What I think that means is in this breach the bad actor has your account information like emails and IP addresses used to access the vault, but can WITHOUT any brute force also determine every site the vault has an entry to access. The consequences of that could be severe for some. Did you tell your wife about that account on Hinge or Grindr? Perhaps you live somewhere where being out isn’t an option and could get you killed? Do you have an account on some site or other which primarily exists to leak to journalists?
  - FatActor 4y ago
    If you read any topic on password managers on HN, there is very little technical discussion, its emotional and grandstanding. A majority of the comments tell people why their password manager sucks and your scheme is the best. It's any tech religious war basically, with more sides. But yes, that's the point: the devs start with the presumption that the blob will eventually be stolen and how to protect that. That's the initial value proposition. (Storing URLs in plaintext was dumb, but any browser extension knows every URL you visit, same with your ISP, so there's that.)
selivanovp 4y ago
I quit Lastpass about a year ago and at this point I really hope they actually deleted all my credentials and not just pretended to and hid it somewhere else.
- nixgeek 4y ago
  I think if you’re moving between password managers, probably best to assume they did retain a backup, that said backup was leaked, and given LastPass does NOT encrypt all aspects of the vault, that you need to go ahead and roll almost all the stored credentials.
- kosh2 4y ago
  I switched over a few years ago as well but for some reason forgot to delete my old account. Sigh :( I never reuse passwords of course but it's still annoying having to go through everything and change a whole bunch of passwords.
sebazzz 4y ago
If you want be into control, host your password database on your device only. Use applications like Keepass(XC) and Keepassium. Optionally sync via a generic cloud provider which is protected by a strong password and two factor authentication.
- Fire-Dragon-DoL 4y ago
  This doesn't work for any person with a life partner, that will need access to many shared passwords.
  - anonuser123456 4y ago
    It can work quite well. I use Strongbox, a standalone database password manager. My wife and I share a database in iCloud. The database supports concurrent access/syncing and works quite well to share passwords between us. I trust in crypto to keep me safe. My key is derived from a pass phrase + HMAC-SHA1 digest of a shared secret stored in write only memory (Yubikey, Secure Enclave). My wife’s phone has the same. Our shared mac also has the same. I could probably host my database on a public AWS bucket and still be safe (120 bits of entropy in the password).
    - Fire-Dragon-DoL 4y ago
      What about limiting password access to SOME shared folders, for those with children?
      - sebazzz 4y ago
        You need a separate database for that. But on those SaaS services those separate folders are also not necessarily safe of encrypted with the same master key. Also, happy and safe 2023!
        Fire-Dragon-DoL 4y ago
        You could use separate databases, but then how's the experience in moving from one database to the other?
kthejoker2 4y ago
Many of the URLs I have stored in LastPass included query parameters, no idea which ones are sensitive or specific to me, but my email, tokens, plenty of plaintext as part of form submissions, etc. I spent time last night updating passwords, adding MFA to some of my lesser used financial accounts, and (importantly) replacing the URLs with simple top level domains.
phonebucket 4y ago
I'm pretty disappointed with how this has been handled. Mainly in two ways: - The scale of the breach (leaking of PII and encrypted vaults, that URLs are not encrypted) has only come almost 4 months after the initial investigation. When was such a breach suspected in the first place? I would expect extremely timely reponses for this stuff. - They suggest no recommended actions? Surely rotating credentials should be advised? Feels like they are putting business before security. It's not just the leak that makes me lose complete faith in Lastpass. It's how they've handled the leak.
- rhtgrg 4y ago
  > It's not just the leak that makes me lose complete faith in Lastpass. It's how they've handled the leak. Absolutely. I'm switching to 1Password, and though the critics are correct that it isn't a great solution (being practically the same solution), at least they haven't stabbed me in the back or weasel worded me...yet. I was a premium subscriber for the 2FA, for all the good that did me.
  - wlonkly 4y ago
    I'm no cryptoanalyst, but it seems to me that 1password's addition of the Secret Key, and encrypting all vault data, put them in a much better position than LastPass was. [1] https://blog.1password.com/what-the-secret-key-does/ https://blog.1password.com/what-the-secret-key-does/
sufficient 4y ago
This is a wake up to call to not build your security model on a user chosen master password! Since the vaults have been stolen, an offline brute force attack can be executed. This attack is no longer slowed down by online protection mechanisms, such as blocking IP addresses. Rather, security now depends solely on the cryptography and thus on the master password chosen by the user. In the end, it is a single factor that separates the attacker from the encrypted data. If less IT-savvy employees are not adequately trained and supported in choosing the master password, the result is fatal. The extent of this will become clear in the coming months when the attacker has cracked the first master passwords and compromises accounts. At heylogin, we believe that this security model of traditional password managers has come to an end. That's why we built a new solution that uses the secure element of smartphones to implement end-to-end encryption that is 2-factor secure by default and works without a master password.If our users' encrypted databases were stolen, the attacker would not be able to perform a brute force attack. I just wrote a post on our company blog about the problems of LastPass and how to fix these: https://www.heylogin.com/en-post/lastpass-incident-2022 https://www.heylogin.com/en-post/lastpass-incident-2022
hmontazeri 4y ago
That’s the reason why passwordless is the way to go…
Friedduck 4y ago
I’m on day two of converting from LastPass to another service (Keeper in my case.) Canceled auto-renewal, deleted the account, and exported/imported within a half-hour. That part was painless. Resetting passwords, however, is something that’s going to take days. Too, you need to track what’s been changed or not, what’s no longer needed and so on. Further if you’re being prudent you need to notify corporate partners of any credentials they own that may need to change. It’s an enormous waste of time. The lesson: choose your vendors carefully. Take the extra time to make sure you never need to go through this.
CHB0403085482 4y ago
Has you been pawned? https://arstechnica.com/information-technology/2022/12/lastpass-says-hackers-have-obtained-vault-data-and-a-wealth-of-customer-info/ https://arstechnica.com/information-technology/2022/12/lastp...

533 points by mikece 4y ago

Again?

Welp, looks like they were able to copy vaults to crack and, worse yet, they have the unencrypted URLs to choose what to target. > The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass. The encryption and decryption of data is performed only on the local LastPass client. For more information about our Zero Knowledge architecture and encryption algorithms, please see here.

idatum 4y ago
LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there". Let's assume one's master password is strong. And that LastPass knows how to encrypt data. We're really down to whether 256-bit AES can be brute forced, right? And I guess understanding phishing attacks. I mean, yes, wouldn't it be great of LastPass took the measures with its development environment years ago? So put another way: Lack of operational excellence hopefully is made for in strong encryption. I hope.
- WhatsName 4y ago
  contains both unencrypted data, such as website URLs, No I think this is the worst that could have happened short of loosing the clear-text passwords. Noone is going to stop the attackers from looking for high-value login URLs and than spear-phish the password for the offline vault. Forcing a password reset onto customers is not going to help LastPass here.
- eastbound 4y ago
  > LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there". This is why a company’s bug bounty should be the sum of the assets protected by the data they have, for all their customers, minus $1. Sounds crazy? Don’t store all passwords at the same place.
- cogman10 4y ago
  Unfortunately, if you like me have been a LP customer for years you are hosed. Early on, they only did 500 rounds of AES which significantly weakens you even with a strong password. So, I've had to change my master password and now I'm in the process of updating all my passwords :( By not forcing a re-encryption when they uped the number of rounds, LP has hung all their old time customers out to dry with this leak. It's not ok.
tokenfg 4y ago
'form-filled data' includes 'Payment cards' section I believe, which should then make securing your cards an even larger priority than having to change your passwords
rob74 4y ago
Hm, with all that talk about "zero knowledge architecture", I thought your vault file would be encrypted "in one piece", not just the passwords. If they have the URLs in clear text, that's not really zero knowledge, now is it? And why do they need the URLs anyway, when I can share the passwords just fine from my local PC? Statistics?!
- sf_rob 4y ago
  Honestly, URLs are a potentially massive threat vector themselves. Are the urls associated with individual users either directly or in a bucketed fashion? Seems like no to the former but the release leaves a lot to be desired.
- Arbortheus 4y ago
  Is anyone aware whether Bitwarden encrypts everything, or just the passwords like lastpass?
  - aiisjustanif 4y ago
    According to Bitwarden it’s all Login information (including usernames, passwords, URIs, TOTPs, etc.). [1] [1]: https://bitwarden.com/help/vault-data/ https://bitwarden.com/help/vault-data/
    - Arbortheus 4y ago
      Nice, thank you
TechBro8615 4y ago
Why are the sites where you have accounts not part of your encrypted vault? Can someone confirm my understanding that 1Password does in fact encrypt the entire vault, including the URL/domain associated with each login?
- hn_throwaway_99 4y ago
  No, as stated, they don't encrypt the URL. This is likely so that, regardless of what you have entered for your "when is master password required" settings, the browser plugin can highlight when it knows that you've entered a password for a site.
  - wlonkly 4y ago
    Was your answer about what LastPass does, or what 1Password does? The person you replied to was asking about 1Password.

d2049 4y ago

Similar to “not your keys, not your crypto” is there not an analogy to be made for passwords? Genuinely interested in the reasoning of people who store their passwords in a cloud service they don’t control.

wmf 4y ago
This will keep going until there exists a cloud backend that you do control. People won't go back to non-cloud.
alanfranz 4y ago
It's your keys. The master password is yours only. Plaintext passwords don't exist in remote services; basically they're a specialized version of a storage system (Dropbox?Google Drive? S3?) optimized for password entry sharing between devices, versioning, etc.

snailmailman 4y ago

Wow. This is basically the worst case scenario. Attackers got access to the vaults themselves? While they are encrypted, it all depends on how secure your master password is now. Because the brute-forcing has almost certainly already begun. I switched away from lastpass to Bitwarden a while ago, and have changed many of my passwords since then. But I’ll probably rotate most of my passwords anyway, out of an abundance of caution.

FatActor 4y ago
This is not the worst case scenario. This is literally the best case hack scenario. Why? Because we already know that encrypting something using their strategy is essentially uncrackable. AES256 is quantum resistant. The worst case would be silent exfiltration from the LastPass application via malware to steal user master passwords. In the security game, the crypto is the strongest part, the crypto-system is the weakest part.
- CookieCrisp 4y ago
  While I agree with your main point, I think confirmation that the URLs weren't encrypted and that they can all be tied to your Lastpass signup information is far from "best case"
  - FatActor 4y ago
    I missed that part. What is the problem about URL exposure? EDIT: all three replies to this comment are about sex-shaming people via their email address, ip, home address. hardly pearl clutching. go to DefCon some day, you'll see how that information is basically for sale legally, let alone on the darkweb. i don't have a horse in this race because i use my own password storage software but the amount of FUD in this thread is cray cray.
    - deleted 4y ago
      [deleted]
    - 4y ago

JackMorgan 4y ago

I switched to KeePassXC and syncthing and other than a little bump once when I accidentally caused a merge I've been really pleased with the setup.

jackson1442 4y ago

@dang, could the title be updated to indicate that this is another update to the existing blog post? Currently reads like it's a new incident, not the aug2022 incident.

dang 4y ago
Sure, I've added "[updated]" above.
- lyu07282 4y ago
  tbh even "Notice of Recent Security Incident [updated]" instead of "LastPass User Vaults stolen in recent hack" or something feels like PR damage control in favor to LastPass
  - dang 4y ago
    I agree that corporate press releases usually bury the lede and, in the case of negative stories, are often outright misleading. For that reason we often change them (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=press%20release%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). I've used your suggestion above. Thanks! If anyone suggests a better title (i.e. more accurate and neutral), we can change it again, and if there's a better third-party article that covers whatever the latest news on this is, we could switch to it.
iLoveOncall 4y ago
It absolutely is a new incident. LastPass is in PR damage control mode and trying to make it seem like accessing those backups was inevitable after their source code theft, but it's not the fucking case. This is yet another failure on LastPass' end. The only thing in common is the attacker, that's it.
ghostpepper 4y ago
They updated the fifth paragraph down to mention that encrypted passwords and unencrypted metadata has been stolen - in my mind that practically qualifies as a new incident

snug 4y ago

I've tried a lot the password safes/vaults, and none of them work nearly as well as Chrome/Googles password manager You can even use it on iOS, and even use it by default. Even apples Keychain password manager works pretty well if you're all in on apple ecosystem. Only reason I see why you would not use it is if you're not using Chrome or Safari, which is most people. Yeah, yeah, google evil

mook 4y ago
The risk there is more you accidentally make a bad comment on YouTube and Google bans your account, I think. I have no idea if I'd still be able to access my passwords if that happens. At least, personally I feel Google deciding to disallow me from logging in is more likely than Google losing my passwords.
- snug 4y ago
  That is only a risk for syncing, you would still still have your passwords locally saved
  - jackson1442 4y ago
    Is there a local UI to view/export your passwords? The only one I'm aware of is https://passwords.google.com https://passwords.google.com but it's been a long time since I've used a builtin browser password manager. also- does Google (or other browser devs) release information on how they keep your passwords secure? Is it even E2EE?
    - joshmn 4y ago
      > Is there a local UI to view/export your passwords? chrome://settings/passwords
    - snug 4y ago
      Yes, no need to use the web, all done from the browser. To your second question, I don't know, but thats only a concern if you export your passwords

SoftTalker 4y ago

I use a PGP encyrpted files on my local computer. https://www.passwordstore.org/ https://www.passwordstore.org/ actually. I don't trust any cloud-hosted password manager.

drexlspivey 4y ago
What if you want to log in from your phone?
- SoftTalker 4y ago
  I don't do that. I have a gmail account tied to my phone (Android) and I've logged into that once and it just stays logged in. I don't use that account for anything else. I don't really do anything else on my phone that requires a login.
  - dimgl 4y ago
    > I don't do that. So your solution is unreasonable for 95% of consumers. Nice.
    - dspillett 4y ago
      But likely 100% of the 1 user they were trying to support. And given the varied needs of people, a suggestion that is reasonable to 5% of them is not bad going. And even 0.001% of them is infinity more than all the alternatives you've suggested in this thread thus far :-)
    - _Algernon_ 4y ago
      Considering they answered a question, and weren't trying to provide a solution to 100% of consumers I don't see how its a problem warranting your response.
  - larrybud 4y ago
    I’m not sure if you’re trolling or not, but let’s play this out. You really don’t use your phone for any of the following? (Web or app) Online banking Online shopping Social media Airlines, hotels, or other Tavel bookings Online news sources requiring accounts Eg hacker news, NYT, etc Medical / pharmacy

heluser 4y ago

Not surprising to see another LastPass incident but I wonder why nowadays anyone would choose LastPass over 1password

CookieCrisp 4y ago
I switched to 1password after this breach was first announced, but I find it a lot more annoying to use (and I found Bitwarden even worse). Granted, nowhere near as annoying as the breach. Lastpass got in my way a lot less frequently though.
bryfb 4y ago
I certainly wouldn't choose LastPass over 1Password, but given 1Password is deprecating local storage I wouldn't recommend 1Password anymore either.
- heluser 4y ago
  I used to have a local only manager but then, obviously, syncing becomes a problem. And then it becomes a choice between syncing an encrypted blob using your own solution (potentially not very secure) vs using a provider who still treats your data as an encrypted blob with no access to the data and tries to do it securely. I think the provider is still more secure (again assuming the 1password access model not talking about LastPass-like providers) plus much more convenient. So if not 1password what would be a recommendation assuming syncing is required?
twistedpair 4y ago
I prefer LastPass' featureset over 1Password, when I've trial them both, but I certainly don't prefer LastPass' opsec.
deleted 4y ago
[deleted]

sli 4y ago

My local, managed-by-me KeyPass database has never had a security incident or even come close. That's all I'm gonna say about that.

bagels 4y ago
Would you actually know?
- sodality2 4y ago
  By that logic you also wouldn't know if your keys/password database stored by Lastpass/others (in the browser extension or app) is stolen, it's all just local data.
  - bagels 4y ago
    Isn't that what this whole thread is about, it being discovered that LastPass had an actual breach?
alanfranz 4y ago
not yet. But there's actually a lot of surface attack area for those open source tools as well. If you're able to sneak into the supply chain and replace the _client_ with a modified, malicious version, you can make it send the master password AND the database to a remote server. No need to compromise the server. This is true for most commercial password managers as well: but I'd expect the security to be tighter there. No random maintainer should get access to the release page. My idea was like this: * Use KeepassX built from source * Use Dropbox to sync the kdb files (always encrypted) * Use a firewall to prevent any network connection to keepassx; this way even a compromised client cannot connect and send the data somewhere else. * When updating KeepassX, always build from an older git commit; I assumed that in ~15-20 days if there's a fuckup on git source, it will be announced. BUT: it was hard. Bitwarden just works better. I still build it from source on desktop computers, though, and take a look at the website before updating, just to stay sure. (And I think IOS app process will make it harder to submit malware there anyway).

alexhjones 4y ago

No need to brute force - if users re-used their master password, it will potentially cross-reference with the correct email and password combo from any number of previous data breaches and pwnage across the net.

yasp 4y ago
Good news for people who followed best practices. "I don't have to outrun the bear; I just have to outrun you."
- jacquesm 4y ago
  There isn't just one bear.
- AlexCoventry 4y ago
  This bear has the ability to spin up an AWS cluster of bears, unfortunately.
  - dijit 4y ago
    AWS is probably the most expensive way to do this. Either rent some machines from an ex-crypto miner, since AES can be decyphered on GPUs or get some old extremely cheap boxes from the hetzner auction.
    - nikau 4y ago
      People who are trying to crack these passwords are also likely to be using compromised AWS accounts.
  - yasp 4y ago
    They're still subject to economic considerations (assuming a non-state actor). If the expected value on a cracked account is less than the expected cost to crack it, a rational actor won't bother. That they may use cracked AWS accounts, or botnets, to perform this cracking does not change these economic considerations.

AdmiralAsshat 4y ago

Why in God's name would they store the URLs unencrypted? Even if they don't crack the account password, you've just given the attackers a lovely dossier of every place I've ever visited frequently enough to make an account. And this is far worse than simply doing reverse-lookups of my email address across site breaches, since I use multiple email addresses and alias-only logins. Nice. Fucking. Job.

meroje 4y ago
Presumably this would be to ease looking up individual items but 1password has been able to encrypt those since 2012. Nice indeed
edsimpson 4y ago
Does anyone know if bitwarden encrypts the URL? A quick search of their docs didn’t turn anything up.
- sliken 4y ago
  Each unique Bitwarden account has an encryption key derived from your Master Password, according to the methods defined in Encryption. This encryption key is used to encrypt all Vault data. From: https://bitwarden.com/help/account-encryption-key/ https://bitwarden.com/help/account-encryption-key/ Seems crazy for anyone to keep using LastPass
joenathanone 4y ago
Not to mention some of the saved URLs may include sensitive information in the URL query string, including things like email address, physical address, etc...
jasonhansel 4y ago
Also: thanks to "forgot my password" features, if someone gets your email password, they can now find and access all your (non-2FA-enabled) accounts.
- 4y ago

haunter 4y ago

Theoretically this can happen to Bitwarden Web Vault too, right? Unless I self host it of course

sliken 4y ago
Sure, but it's 100% encrypted, not some silly case where things like URLs are in plaintext.
jupp0r 4y ago
What makes you think that it couldn't happen to your self hosted vault?
- haunter 4y ago
  It's more like I'd accept my own fault more than trust a 3rd party (Bitwarden, or LastPass) in this case

blakesterz 4y ago

It's not clear to me, does this mean EVERYONE that uses LastPass got hit or some subset of users?

dodgerdan 4y ago
Everyone.

dangero 4y ago

To further increase the security of your master password, LastPass utilizes a stronger-than-typical implementation of 100,100 iterations of the Password-Based Key Derivation Function (PBKDF2), a password-strengthening algorithm that makes it difficult to guess your master password. You can check the current number of PBKDF2 iterations for your LastPass account here. I just checked my account and it says 5000 not 100,100 -- there's no way I would go in and change that setting, so this is pretty disingenuous. They must have changed defaults at some point

cogman10 4y ago
I have an older account, it was 500 when I went to check. I'm livid that LP didn't do a reup on the encryption when they moved to 100k cycles. They've basically hosed every customer that's been with them for a while.
- mister_tee 4y ago
  mine was set to 500 (not 5000) as well. I'd moved on from lastpass earlier this year but didn't delete my account... though I suppose in that case I'd wonder if I'd deleted in time, or if they really deleted all my info. Also frustrating that they decided to drop this update on December 22. And how do they square "Zero-knowledge security" and the diagram in https://www.lastpass.com/security/zero-knowledge-security https://www.lastpass.com/security/zero-knowledge-security with URLs and last-accessed times being plaintext? I suppose "items in your vault" is doing a lot of work there if they don't count urls as "in" the vault.
snailmailman 4y ago
I do think the default a long time ago used to be very low. I know I went in at account creation and set it to something way higher than it's default at the time. Looking now though, it says 100100 for me. But i also know i changed my master password at some point, so maybe i got reset to the current default.
- hunter2_ 4y ago

shadowgovt 4y ago

I've done a lot of things wrong with OPSEC in my life... ... But I never trusted a third party to store all my passwords.

hbn 4y ago

Why do people use password managers that store all the data on their own servers? Having a centralized database filled with full login information for hundreds of thousands of accounts across all your users (and accounts users clearly care about, mind you, otherwise they wouldn't go out of their way to use a password manager) makes for such an obvious jackpot attack vector that causes situations like this. I've used Enpass for years now which lets you sync your password database to DropBox, Google Drive, iCloud, etc. So I still have to protect whichever cloud storage account I'm syncing with, but at least it's not an obvious place to find passwords for thousands of users. And if someone did have access to my Google or Apple account, they could reset a lot of my logins anyway. And I know this isn't technically as safe as the self-hosted options, but it offers the same convenience as LastPass without the obvious painting-a-target-on-your-own-back by handing all your passwords over to The Passwords Store.

camel_Snake 4y ago
Just chiming in to say I've been satisfied as an Enpass user as well. Felt like a good middle-ground to me and I bought the app before the restructured their pricing model so I was grandfathered in.
clumsysmurf 4y ago
Is Enpass an electron based app?
- spoils19 4y ago
  This is important: please respond. I generally disallow electron apps on my personal machines as a matter of principle.
  - GrabbinD33ze69 4y ago
    Lol why? Are you completely against anything that uses chromium?
    - IIsi50MHz 4y ago

mjsweet 4y ago

I just went into my old lastpass account to try and wind down the account, delete everything, and then close the account. No option to "select all" in the list so I resorted to clicking the check box on by one down the page. I accidentally slightly clicked outside a check box... guess what? Everything gets deselected. Start over. Ok start again, maybe I want to list in alphabetical order rather than group by category to minimise mistakes. Whoops, selecting that option deselects everything in the list. 300 odd deleted in batches of 30-40. When a company's whole application is covered in anti-patterns and dark UX to make it as hard as possible to leave then companies like this deserve to die. Deleting the account is a bit tricky too. 1. Go into account settings in the top right drop down 2. In the Links area click on "My Account" which spawns a new browser window 3. Click the red "Delete or Reset Account", you can't miss all the red buttons 4. You can either reset your account or delete, choose delete 5. A modal will appear telling you stuff, enter your master pw, a reason why your leaving and then click delete 6. You will be asked twice if you really really want to do this 7. Press ok

robszumski 4y ago
It's become so clear that users of a SaaS deserve more control how their data is used and stored. You should absolutely be able to crypto-shred your data from such an important service. This experience sounds awful.
- flandish 4y ago
  I had migrated away a year or so ago. Tried to log in to confirm, it did not work. Tried password reset. No reset email. So that’s good… I guess. I remember deleting my acct. not sure if I manually deleted entries before though. That said - if a data breach includes backup access… is your account ever really deleted?
drewnick 4y ago
I also did not have a "Select all" box but was able to check the first entry, scroll down, hold shift, and check the last box which then selected all items in between. So I removed all of 600 of my accounts in about 20 seconds. Hope this helps someone.

lbj 4y ago

Well.... Unencrypted access to all the sites each username/email has an account with could be very damaging for some individuals.

jamal-kumar 4y ago

I'm sorry but if you were using this why are your passwords in the cloud? Doesn't that whole concept set off like thousands of alarm bells in your mind about how it could go wrong? I know it's convenient or whatever, device synchronization or whatnot but compromising security for convenience is a thing I thought we might have been aware of avoiding at this point.

autoexec 4y ago
You're not wrong. Somethings are fine to keep on someone else's server but a record of every password you have probably shouldn't be one of them.

phillipseamore 4y ago

I'd like to point out to users who have 2FA on their LP access and think they are safer, that does not protect the vault in a compromise like this, it only enhances the security of delivering the vault, the attackers here already have the vaults. Vaults are only protected by password.

rangersanger 4y ago

their marketing team needs to get their shit together and not have a newsletter signup popup on this particular page.

mhss 4y ago

When I worked at LogMeIn (previous owners of LastPass), I relocated to Budapest and worked in the same building as LastPass' engineering (I was in another division though). Getting a sneak peek of how the sausage is made gave me the hibbie jibbies and I switched to 1Password there and then. It appears like I dodged a bullet.

__turbobrew__ 4y ago
What did you see?
- mhss 4y ago
  I cannot talk about specifics obviously since I was an employee. I can only say I did not see the sw engineering and infrastructure rigour I'd expect from a service that is managing very sensitive information.
  - semicolon_storm 4y ago
    Sounds about right. Awhile back I noticed the LastPass password generator was not in fact outputting a random password but that at least a few characters of the password followed a predictable pattern. I reported it and it was fixed, but it's beyond me how a supposedly security focused company can let such a severe bug in such an important yet simple feature get to production.
- intelVISA 4y ago
  Zero Knowledge Architecture(tm)
  - Obscurity4340 4y ago
    ™
- EspadaV9 4y ago
  How sausages were made, apparently.

jcadam 4y ago

Looks like I'm out $36. My LastPass subscription auto-renewed TODAY. But I obviously can't trust it, so I'm in the process of changing passwords and emptying my vault :(

phillipseamore 4y ago
Look at it this way: you just bought your self a ticket for the class-action lawsuit.
- jcadam 4y ago
  Ooooh, there may be a year of free credit monitoring and maybe even a check for $36 in my future.

civopsec 4y ago

I use a password database (a file, local) which is unlocked with a passphrase/word. It takes about five seconds to unlock. This works for me since I almost only use accounts on laptops/desktops.

userbinator 4y ago

"Pay us and give us all of your most important secrets, and we promise we'll keep them safe." In any sane world that would be an unbelievable thing to say, yet entire companies exist with just that intention. Behold the power of marketing.

smcleod 4y ago

To quote the verge: > "...The announcement doesn’t get to the part about the vaults being copied until /five paragraphs/ in. And while some of the information is bolded, I think it’s fair to expect that such a major announcement would be at the very top."

jhanschoo 4y ago

I use a secret algorithm + common salt that I can perform mentally to derive more-or-less unique passwords from service provider names. I don't trust any password manager, and this gives me the convenience of knowing my password across devices.

edent 4y ago
What happens when a service asks you to change your password? How do you remember that it is F4c3b00k$2 rather than F4c3b00k$1? What happens to your algorithm if the password requirements reject special characters?
- KyleJune 4y ago
  Not the person you were asking but I have a mental algorithm I use that produces unique salt for each website. When I run into issues about special characters not being accepted, I replace them with the number equivalent. For example 5 instead of %. It can be a pain to forget but there aren't many sites I use that are like that. I still use a password manager I can reference if my algorithm isn't working for some reason.

ramraj07 4y ago

I was and am continuing to be a LastPass user. I’ll probably start looking into migrating but not with any great hurry because I never trusted any password manager that much to begin with - never stored my primary account passwords or financial account passwords with them for this reason. Password fatigue is real but not all passwords are the same so why treat them as such?

WiggleGuy 4y ago

Note to folks who are migrating away from LastPass now: https://news.ycombinator.com/item?id=33810084 https://news.ycombinator.com/item?id=33810084

javawizard 4y ago
Oof, that aged well: > Too much work. At that point, it’s easier to just hack the LastPass servers.

deleted 4y ago

[deleted]

chunk_waffle 4y ago

Are URLs the only thing that's unencrypted? That's bad enough, but what about other fields? I know I've accidentally saved passwords in the username field before, stored sensitive info in the note field as well. I guess moving off of LastPass is how I'll be spending my Xmas...

weaksauce 4y ago
I don't think the other fields would be unencrypted. url makes some sense for an extension that doesn't need to unlock the vault to know if there is a password available for a site. it's not the end of the world but it certainly isn't a great look. look at bitwarden. the hn famous security guy tpatek or however you spell his handle recommended that a while ago and it's open source and pretty good. the ui kinda is not amazing but i guess that's alright. (it's 2022 almost 2023 how are they not letting you sort by recently created/used/etc?)
- nequo 4y ago
  The notice uses language that implies that other fields were unencrypted too: contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data “Such as website URLs” reads like it’s giving one example among multiple other fields that are unencrypted. Now I wonder if the notes are not in fact encrypted either since if the user wanted those to be secure too, they would’ve written them in a “secure note.”
  - pcthrowaway 4y ago
    If notes are unencrypted then I'm absolutely fucked. I really hope this isn't the case. I assumed they were, I thought I read they were even. But now I can't find anything confirming this. Lastpass, please advise
    - wlonkly 4y ago
      A description of Lastpass's vault structure[1] suggests that notes inside entries were encrypted (index 4). I have no additional information about the veracity of that description though. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md#structures-of-some-types-of-composite-data-blocks https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

lofaszvanitt 4y ago

The biggest bummer is that it was said back in August that some shitty info was obtained by the hackers... few months later... sorry something else was also obtained. This is the worst. They should've scrubbed everything clean the dev had access to. As a client, when your instincts kicked in alerting you that your passwords are in danger, you might've been patting yourself in the back saying to yourself: ok, my passes are safe, phew. Well...

systematical 4y ago

Ugh gonna need to reset some shit. Luckily I don't keep financial or my email pass in there. Those few I remember.

mac-chaffee 4y ago

They talk about how the federated version is safer due to the long random master password, but... Federated LastPass is tied to your company's SSO, which means your real master password is technically a login.microsoftonline.com (or equivalent) cookie stored in plain text on your hard drive that is valid for 8+ hours. One bad "pip install" typo and your teams' passwords are toast. That was true even before the breach.

locusofself 4y ago

Switched to Bitwarden a couple years ago. It works well for me. Mostly use the Chrome extension and I don't host it myself. Works pretty well with my iPhone as well. and I'm using the free tier.

x86hacker1010 4y ago

for (item of document.getElementsByClassName('vault-item-displayname')) { item.click() }

LastTrain 4y ago

The amazing thing about this is, if at my company we had a project to migrate that much data, it’d take a month. There would be multiple layers of security to move through. How’d these ‘actors’ sneak in and get it all? I think they’ve had access longer than LP is letting on…

jason-phillips 4y ago

To add more data to the other comments, some federal agencies started pushing employees to use lastpass for work-related accounts a couple of years ago.

singularity2001 4y ago

Is it easier to guess the master keyword if some of the encrypted passwords are known to the attacker? Because on dozens of (previously hacked?) "unimportant" sites I still used a very week common password.

hamilton987 4y ago
[dead]

pushedx 4y ago

> “The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both _unencrypted data, such as website URLs_ …” Other threads here have discussed the potential for this collection of sign-up information and URLs to be used for blackmail and to discover hidden services. There is another major problem: mapping these URLs to existing breach dumps. The attacker now has a list of email addresses and associated URLs. From existing breach dumps (haveibeenpwned.com), they can now try all known passwords associated with these email addresses on all of these URLs. Many passwords stored in LastPass are repeat passwords, and they will gain access to many services without any brute force needed. There will be a class action lawsuit for this gross negligence in security and false and misleading documentation and marketing materials. My hope is that LastPass is forced to liquidate all assets and distribute them to their former customers, in addition to being liable for damages and wasted time related to migration to another password managememt solution, not to mention suffering related to any potential blackmail or disclosure of proprietary information.

zmmmmm 4y ago

Unless I missed it they have left out the critical information about the timing of when the password database backup was taken. This makes enormous difference ... it could be that the attackers have had months to brute force this already if it occurred shortly after the August incident vs if it happened yesterday it is very unlikely they have brute forced many accounts. If they don't know they should say they don't know, if they do know they should absolutely be telling people this!

alzaeem 4y ago
I am also looking for this information. I largely switched away from lastpass over the last 12 months, and only a few low-value credentials remain in it. But if this is an old backup, then it is more concerning for me.

macrolime 4y ago

Every time you use lastpass to autofill a form. The log your ip adresses, a timestamp and the site you were logging into. Kinda sounds like the attacker got this data.

ThePowerOfFuet 4y ago
> Every time you use lastpass to autofill a form. The log your ip adresses, a timestamp and the site you were logging into. [citation needed]
- macrolime 4y ago
  In lastpass teams at least these logs are available in the control panel.

ThePowerOfFuet 4y ago

>unencrypted data, such as website URLs Why the fsck are they storing these unencrypted? This is data mining _and_ phishing gold. What a clown show.

mwaitjmp 4y ago

Can anyone explain how shared folders work with lastpass? How is the data encrypted at rest? Who’s master password is used to store that data?

domlebo70 4y ago

Noob here. How bad is this? AES256 is essentially uncrackable no? I think I want to move off LastPass anyway to 1password. What's best way? I assumes steps are to: 1. Import lastpass stuff into 1password. Rotate all passwords?

rencrisa 4y ago
AES256 is still secure, assuming the encryption key has ~256 bits of entropy (32 random bytes). Assuming your master password is reasonably complex, hopefully the encryption key derived from your password has enough entropy. Despite this, I recommend rotating all passwords (if you don't have the time, prioritize rotating passwords on important accounts / putting MFA on them). For all we know, lastpass might have had a full compromise (i.e. access to unencrypted vaults from malicious source code commits).

dark-star 4y ago

I wonder why people moved away from a (local) KeePass database that is optionally synced through GDrive, OneDrive or NextCloud between their devices. That works perfectly fine and relies only on your KeePass master PW strength, not on some 3rd parties' security

baal80spam 4y ago
From the top of my head: laziness, marketing...
hacker_newz 4y ago
The KeePass Ui is terrible.
- dark-star 4y ago
  how so?

_dain_ 4y ago

Maybe now I can convince my employer to move away Lastpass. I hated it on sight because of the GUI. Look at this thing, it's like Attack of the Fifty Foot Whitespace: https://files.catbox.moe/d81urx.jpg https://files.catbox.moe/d81urx.jpg

voidee 4y ago
What are you going to recommend? I’m leery of just moving to another cloud provider.

koreth1 4y ago

From what I can tell from reading about this, it seems like people are mainly worried about brute-force password-guessing attacks. Lots of people pick lousy master passwords so there is the possibility of some real damage being done. What I am trying to suss out is how worried I should be. My master password is a ~20-character mixed-case nonsense passphrase with spelling errors and digits thrown in. Am I being clueless about the threat level if I conclude that there’s a vanishingly small chance my stuff will get decrypted? Ironically, “switch away from LastPass” was on my to-do list for the holiday week anyway, but now, just to be on the safe side, I guess it will be that plus “change all the passwords on accounts I care about.”

kerng 4y ago

Does Lastpass have a requirement on the length of the master password? Documentation says they recommend 12 characters as minimum, which seems short. Wondering if its enforced or if it's possible to have "password123" as master password? Also, sounds like URL leaked in clear text - so targeted attacks will be very likely. This is quite bad with long running implications.

Vishalthevaxus 4y ago

If you're a LastPass user, you need to be alarmed (and maybe even a little intimidated) by the recent security breach update revealing that threat actor was able to access and copy a BACKUP OF CUSTOMER VAULT DATA, including fully-encrypted sensitive fields like website usernames and passwords, secure notes, and form-filled data.

Fire-Dragon-DoL 4y ago
I wish it was just that. Apparently URLs are not encrypted, and they also have non encrypted fields about "password breached" and "password poor quality"
SV_BubbleTime 4y ago
Didn’t everyone anticipate this? It’s still not a problem if you used a good passphrase, and haven’t reused it anywhere else. It’s not ideal, but losing the encrypted blob isn’t that big of a deal if all the other parts were working correctly. Lastpass claims user local decryption so they never had your key. This isn’t that much different than logging in on a foreign computer, or storing your keepass on Dropbox, or losing a USB with the encrypted blob on it. I’m not defending them, just being practical that this still won’t effect most users.
- nixgeek 4y ago
  “all the other parts are working correctly”, is IMHO the issue here, because LastPass doesn’t consider the URL to be sensitive material. What I think that means is in this breach the bad actor has your account information like emails and IP addresses used to access the vault, but can WITHOUT any brute force also determine every site the vault has an entry to access. The consequences of that could be severe for some. Did you tell your wife about that account on Hinge or Grindr? Perhaps you live somewhere where being out isn’t an option and could get you killed? Do you have an account on some site or other which primarily exists to leak to journalists?
- FatActor 4y ago
  If you read any topic on password managers on HN, there is very little technical discussion, its emotional and grandstanding. A majority of the comments tell people why their password manager sucks and your scheme is the best. It's any tech religious war basically, with more sides. But yes, that's the point: the devs start with the presumption that the blob will eventually be stolen and how to protect that. That's the initial value proposition. (Storing URLs in plaintext was dumb, but any browser extension knows every URL you visit, same with your ISP, so there's that.)

selivanovp 4y ago

I quit Lastpass about a year ago and at this point I really hope they actually deleted all my credentials and not just pretended to and hid it somewhere else.

nixgeek 4y ago
I think if you’re moving between password managers, probably best to assume they did retain a backup, that said backup was leaked, and given LastPass does NOT encrypt all aspects of the vault, that you need to go ahead and roll almost all the stored credentials.
kosh2 4y ago
I switched over a few years ago as well but for some reason forgot to delete my old account. Sigh :( I never reuse passwords of course but it's still annoying having to go through everything and change a whole bunch of passwords.

sebazzz 4y ago

If you want be into control, host your password database on your device only. Use applications like Keepass(XC) and Keepassium. Optionally sync via a generic cloud provider which is protected by a strong password and two factor authentication.

Fire-Dragon-DoL 4y ago
This doesn't work for any person with a life partner, that will need access to many shared passwords.
- anonuser123456 4y ago
  It can work quite well. I use Strongbox, a standalone database password manager. My wife and I share a database in iCloud. The database supports concurrent access/syncing and works quite well to share passwords between us. I trust in crypto to keep me safe. My key is derived from a pass phrase + HMAC-SHA1 digest of a shared secret stored in write only memory (Yubikey, Secure Enclave). My wife’s phone has the same. Our shared mac also has the same. I could probably host my database on a public AWS bucket and still be safe (120 bits of entropy in the password).
  - Fire-Dragon-DoL 4y ago
    What about limiting password access to SOME shared folders, for those with children?
    - sebazzz 4y ago
      You need a separate database for that. But on those SaaS services those separate folders are also not necessarily safe of encrypted with the same master key. Also, happy and safe 2023!
      - Fire-Dragon-DoL 4y ago
        You could use separate databases, but then how's the experience in moving from one database to the other?

kthejoker2 4y ago

Many of the URLs I have stored in LastPass included query parameters, no idea which ones are sensitive or specific to me, but my email, tokens, plenty of plaintext as part of form submissions, etc. I spent time last night updating passwords, adding MFA to some of my lesser used financial accounts, and (importantly) replacing the URLs with simple top level domains.

phonebucket 4y ago

I'm pretty disappointed with how this has been handled. Mainly in two ways: - The scale of the breach (leaking of PII and encrypted vaults, that URLs are not encrypted) has only come almost 4 months after the initial investigation. When was such a breach suspected in the first place? I would expect extremely timely reponses for this stuff. - They suggest no recommended actions? Surely rotating credentials should be advised? Feels like they are putting business before security. It's not just the leak that makes me lose complete faith in Lastpass. It's how they've handled the leak.

rhtgrg 4y ago
> It's not just the leak that makes me lose complete faith in Lastpass. It's how they've handled the leak. Absolutely. I'm switching to 1Password, and though the critics are correct that it isn't a great solution (being practically the same solution), at least they haven't stabbed me in the back or weasel worded me...yet. I was a premium subscriber for the 2FA, for all the good that did me.
- wlonkly 4y ago
  I'm no cryptoanalyst, but it seems to me that 1password's addition of the Secret Key, and encrypting all vault data, put them in a much better position than LastPass was. [1] https://blog.1password.com/what-the-secret-key-does/ https://blog.1password.com/what-the-secret-key-does/

sufficient 4y ago

This is a wake up to call to not build your security model on a user chosen master password! Since the vaults have been stolen, an offline brute force attack can be executed. This attack is no longer slowed down by online protection mechanisms, such as blocking IP addresses. Rather, security now depends solely on the cryptography and thus on the master password chosen by the user. In the end, it is a single factor that separates the attacker from the encrypted data. If less IT-savvy employees are not adequately trained and supported in choosing the master password, the result is fatal. The extent of this will become clear in the coming months when the attacker has cracked the first master passwords and compromises accounts. At heylogin, we believe that this security model of traditional password managers has come to an end. That's why we built a new solution that uses the secure element of smartphones to implement end-to-end encryption that is 2-factor secure by default and works without a master password.If our users' encrypted databases were stolen, the attacker would not be able to perform a brute force attack. I just wrote a post on our company blog about the problems of LastPass and how to fix these: https://www.heylogin.com/en-post/lastpass-incident-2022 https://www.heylogin.com/en-post/lastpass-incident-2022

hmontazeri 4y ago

That’s the reason why passwordless is the way to go…

Friedduck 4y ago

I’m on day two of converting from LastPass to another service (Keeper in my case.) Canceled auto-renewal, deleted the account, and exported/imported within a half-hour. That part was painless. Resetting passwords, however, is something that’s going to take days. Too, you need to track what’s been changed or not, what’s no longer needed and so on. Further if you’re being prudent you need to notify corporate partners of any credentials they own that may need to change. It’s an enormous waste of time. The lesson: choose your vendors carefully. Take the extra time to make sure you never need to go through this.

CHB0403085482 4y ago

Has you been pawned? https://arstechnica.com/information-technology/2022/12/lastpass-says-hackers-have-obtained-vault-data-and-a-wealth-of-customer-info/ https://arstechnica.com/information-technology/2022/12/lastp...