5 ms·

This is unbelievably bad. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of: - Customer Names - Company Name

This is unbelievably bad. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of: - Customer Names - Company Names - Email Address - Billing Address - Telephone Numbers - IP addresses (from where customers accessed the service) - Website URLs saved in LastPass vaults (LastPass doesn't encrypt the website URLs) - Encrypted vaults That is a massive privacy violation and a puts every customer at risk for massive automated phishing, blackmail, and doxing. They marketed the whole vault as being encrypted in their Zero Knowledge architecture(TM). And LastPass probably knew since AUGUST and tells us the day before Christmas. Note to obfuscating, dense language in the blog notice. Specifically "unencrypted fields such as website URLs", implying other vault fields could have been unencrypted but they can't/won't say. LastPass will not survive the pending customer exodus and class action lawsuits. Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts.

nix23 4y ago
[flagged]
- gillesjacobs 4y ago
  Thanks, smartass. This wouldn't have been a problem to this degree if their product matched up to their promise and the whole vault was actually encrypted. I willingly accepted the dox risk of personal identifiable data because they were transparent they maintained this and hence this would leak. I would never have used their service if I knew website URLs were unencrypted.
  - nix23 4y ago
    Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant right?
    - gillesjacobs 4y ago
      Of course, lesson learned, I chose convenience over common sense. Self-hosted, encrypted passwords it is from now on. LastPass is luckily(?) the only counterparty I ever trusted to this degree except for maybe my banks. (Great, after I fix this password mess, I will have to start looking into trustless banking)
      - hackernewds 4y ago
        [flagged]
        gillesjacobs 4y ago
        All in good spirits with a smile and a wink ;) though I don't appreciate being language policed.
    - orcanwe 4y ago
      If you’re being so cocky, I’m sure you would never type your secrets into any piece of software that auto-updates, right? After all, you’re trusting someone else not to release a software update that leaks your secrets. And I’m sure you do a full audit of the Chrome source code every time a new version is released. And for your locally hosted password manager software too, right?
      - nix23 4y ago
        >I’m sure you would never type your secrets into any piece of software that auto-updates, right? Never all of them, with notes, urls and other stuff....what has auto-update todo with it? I don't save my passwords in a password-cloud-service....is that really so hard to understand why it is a bad idea if you do that? Well here you have it why it's a bad idea.
        dns_snek 4y ago
        Any software running on your PC can gain access to any online account on your PC. If you have auto-updates enabled, a malicious update could be pushed to your PC at any time to compromise you and tens of millions of other users, even with something as ubiquitous as uBlock Origin. At some point you have to trust someone unless you wish to live off the grid, that's just an unfortunate reality.
- mort96 4y ago
  So what do we do? Some geeks with some kinds of internet connections could set up their own server to sync passwords. But what does literally everyone else do? Re-use the same password everywhere? What is your alternative to password managers?
  - nix23 4y ago
    >What is your alternative to password managers? Its not about password-managers it's about trusting a cloud service who tells you to encrypt everything. Use pass or keepassXC..or hell an encrypted plaintextfile, do i really have to write that here?
    - mort96 4y ago
      Most people who use a password manager need to sync their passwords between devices. I need to be able to log in to things on my laptop, my desktop, my tablet and my phone. And I need to be able to save a new password into the password manager from any of those devices. Now I personally could sync those passwords in my own self-hosted Nextcloud instance that's hosted in my house from a raspberry pi. But most people don't know how to, or don't want to invest the time into, administrating their own file syncing service on their own hardware. Others don't have an Internet connection which makes it possible to host stuff. So I ask again: What is your alternative?
hackernewds 4y ago
> tells us the day before Christmas. there is probably a technical word for this similar to when news is released Friday night to suppress it. what is that called?
- gillesjacobs 4y ago
  I see it being called "The Friday Afternoon Dump" here [1]. The PR and marketing term for finding best timing is "press release timing". Weekends are a prime candidate because press and journalists are off, but social media thrives in weekends. Friday afternoon is the sweetspot if you want to avoid press and social media virality. 1. https://xenophonstrategies.com/the-friday-press-release/ https://xenophonstrategies.com/the-friday-press-release/
rosnd 4y ago
>Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts. Why didn't you just use decent passwords in the first place? You were using a password manager, what's the fucking point if your password is still "kittens1"? This is all on you.
- rolenthedeep 4y ago
  Because the password manager storing the strong, randomized passwords is now compromised, you walnut.
  - rosnd 4y ago
    Only the encrypted randomized passwords were leaked. Unless you knowingly used a bad password for your cloud-based password manager, you're fine. If you did use a bad password for the cloud based password manager, you're the walnut. The whole sales pitch is that lastpass can't fuck you as long as you have a reasonable password protecting your vault.
    - rolenthedeep 4y ago
      Your encrypted data is compromised, it is in the hands of an attacker who really wants to decrypt it. You're pinning all of your digital security on encryption holding against an active attacker. What if there is an undiscovered or undisclosed vulnerability in the encryption? What if last pass isn't using encryption as secure as they claimed? What if the attacker just gets really lucky and your password is in the first thousand bruteforce attempts? Same rationale applies when a random website gets hacked and leaks their password database. Yes, your password is salted and hashed, and hypothetically unrecoverable. But you change your password anyway. You have the option to guarantee your accounts are secure, or do nothing and hope it will be fine. There's a lot of situations where your vault might be decrypted. Sure, they're all pretty unlikely, but the risk is not zero. Changing your passwords does make that risk zero. You're already fucked. LastPass lied in their sales pitch, and they released a bunch of your data unencrypted. Having absolute trust in their encryption as your sole layer of security at this point is incredibly reckless and stupid. You don't know that your master password isn't uncompromisable, you're trusting the company's sales pitch, and they've already lied to you. There is no reason at all to assume your vault will be secure forever.
borplk 4y ago
> LastPass will not survive the pending customer exodus and class action lawsuits. Literally nothing will happen. Mark my words. Don't know where you are getting this fantasy of the company not surviving, and class action lawsuits. Every similar example in the last 10-15 years that I remember was the same (people forgot after a week and nothing happened).

nix23 4y ago

[flagged]

gillesjacobs 4y ago
Thanks, smartass. This wouldn't have been a problem to this degree if their product matched up to their promise and the whole vault was actually encrypted. I willingly accepted the dox risk of personal identifiable data because they were transparent they maintained this and hence this would leak. I would never have used their service if I knew website URLs were unencrypted.
- nix23 4y ago
  Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant right?
  - gillesjacobs 4y ago
    Of course, lesson learned, I chose convenience over common sense. Self-hosted, encrypted passwords it is from now on. LastPass is luckily(?) the only counterparty I ever trusted to this degree except for maybe my banks. (Great, after I fix this password mess, I will have to start looking into trustless banking)
    - hackernewds 4y ago
      [flagged]
      - gillesjacobs 4y ago
        All in good spirits with a smile and a wink ;) though I don't appreciate being language policed.
  - orcanwe 4y ago
    If you’re being so cocky, I’m sure you would never type your secrets into any piece of software that auto-updates, right? After all, you’re trusting someone else not to release a software update that leaks your secrets. And I’m sure you do a full audit of the Chrome source code every time a new version is released. And for your locally hosted password manager software too, right?
    - nix23 4y ago
      >I’m sure you would never type your secrets into any piece of software that auto-updates, right? Never all of them, with notes, urls and other stuff....what has auto-update todo with it? I don't save my passwords in a password-cloud-service....is that really so hard to understand why it is a bad idea if you do that? Well here you have it why it's a bad idea.
      - dns_snek 4y ago
        Any software running on your PC can gain access to any online account on your PC. If you have auto-updates enabled, a malicious update could be pushed to your PC at any time to compromise you and tens of millions of other users, even with something as ubiquitous as uBlock Origin. At some point you have to trust someone unless you wish to live off the grid, that's just an unfortunate reality.
mort96 4y ago
So what do we do? Some geeks with some kinds of internet connections could set up their own server to sync passwords. But what does literally everyone else do? Re-use the same password everywhere? What is your alternative to password managers?
- nix23 4y ago
  >What is your alternative to password managers? Its not about password-managers it's about trusting a cloud service who tells you to encrypt everything. Use pass or keepassXC..or hell an encrypted plaintextfile, do i really have to write that here?
  - mort96 4y ago
    Most people who use a password manager need to sync their passwords between devices. I need to be able to log in to things on my laptop, my desktop, my tablet and my phone. And I need to be able to save a new password into the password manager from any of those devices. Now I personally could sync those passwords in my own self-hosted Nextcloud instance that's hosted in my house from a raspberry pi. But most people don't know how to, or don't want to invest the time into, administrating their own file syncing service on their own hardware. Others don't have an Internet connection which makes it possible to host stuff. So I ask again: What is your alternative?

hackernewds 4y ago

> tells us the day before Christmas. there is probably a technical word for this similar to when news is released Friday night to suppress it. what is that called?

gillesjacobs 4y ago
I see it being called "The Friday Afternoon Dump" here [1]. The PR and marketing term for finding best timing is "press release timing". Weekends are a prime candidate because press and journalists are off, but social media thrives in weekends. Friday afternoon is the sweetspot if you want to avoid press and social media virality. 1. https://xenophonstrategies.com/the-friday-press-release/ https://xenophonstrategies.com/the-friday-press-release/

rosnd 4y ago

>Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts. Why didn't you just use decent passwords in the first place? You were using a password manager, what's the fucking point if your password is still "kittens1"? This is all on you.

rolenthedeep 4y ago
Because the password manager storing the strong, randomized passwords is now compromised, you walnut.
- rosnd 4y ago
  Only the encrypted randomized passwords were leaked. Unless you knowingly used a bad password for your cloud-based password manager, you're fine. If you did use a bad password for the cloud based password manager, you're the walnut. The whole sales pitch is that lastpass can't fuck you as long as you have a reasonable password protecting your vault.
  - rolenthedeep 4y ago
    Your encrypted data is compromised, it is in the hands of an attacker who really wants to decrypt it. You're pinning all of your digital security on encryption holding against an active attacker. What if there is an undiscovered or undisclosed vulnerability in the encryption? What if last pass isn't using encryption as secure as they claimed? What if the attacker just gets really lucky and your password is in the first thousand bruteforce attempts? Same rationale applies when a random website gets hacked and leaks their password database. Yes, your password is salted and hashed, and hypothetically unrecoverable. But you change your password anyway. You have the option to guarantee your accounts are secure, or do nothing and hope it will be fine. There's a lot of situations where your vault might be decrypted. Sure, they're all pretty unlikely, but the risk is not zero. Changing your passwords does make that risk zero. You're already fucked. LastPass lied in their sales pitch, and they released a bunch of your data unencrypted. Having absolute trust in their encryption as your sole layer of security at this point is incredibly reckless and stupid. You don't know that your master password isn't uncompromisable, you're trusting the company's sales pitch, and they've already lied to you. There is no reason at all to assume your vault will be secure forever.

borplk 4y ago

> LastPass will not survive the pending customer exodus and class action lawsuits. Literally nothing will happen. Mark my words. Don't know where you are getting this fantasy of the company not surviving, and class action lawsuits. Every similar example in the last 10-15 years that I remember was the same (people forgot after a week and nothing happened).