5 ms·

So, if my lastpass master password is actually secure (~30 characters and contains capital, lowercase, symbols, and a long string of randomly-generated numbers

So, if my lastpass master password is actually secure (~30 characters and contains capital, lowercase, symbols, and a long string of randomly-generated numbers that I memorized as part of it, and no part of this is reused anywhere else), do I have to worry? It does seem like a good idea to switch, but do I have to switch urgently?

xvector 4y ago
You probably don't have to worry. The main concern is whether LastPass has also faced a supply chain attack that will expose you to a malicious client that will leak your passwords post-decryption.
- Proven 4y ago
  [dead]
- isthisthingon99 4y ago
  I'm surprised this isn't being discussed more.
  - prettyStandard 4y ago
    There was some discussion about this with the original report of the hack, less so now. I suppose because we didn't get extra details suggesting that.
snowwrestler 4y ago
Switching to a different password manager now would do nothing to address the concern that someone has an older copy of your password database and has cracked it. The way to address that particular concern is to change the passwords of all your services themselves. If you do that, it would a good time to change password managers too—just save the new passwords in the new manager. Another approach would be to turn on MFA for your services, if you have not yet. Then even a cracked password will not be enough for a bad guy to get in. All that said, if you have been using a long and complex master password, it’s unlikely that it could be successfully decrypted in the first place.
- RheingoldRiver 4y ago
  Thanks for the answer - I'm hoping to slowly change passwords and switch to a new manager over the next year, which sounds fine to do as long as I don't need to worry about the security of my current vault. The major blocker is that now I need a new master password - it was effort to memorize this one, given its security, so I need to generate & memorize a new long string of digits, etc.

xvector 4y ago

You probably don't have to worry. The main concern is whether LastPass has also faced a supply chain attack that will expose you to a malicious client that will leak your passwords post-decryption.

Proven 4y ago
[dead]
isthisthingon99 4y ago
I'm surprised this isn't being discussed more.
- prettyStandard 4y ago
  There was some discussion about this with the original report of the hack, less so now. I suppose because we didn't get extra details suggesting that.

snowwrestler 4y ago

Switching to a different password manager now would do nothing to address the concern that someone has an older copy of your password database and has cracked it. The way to address that particular concern is to change the passwords of all your services themselves. If you do that, it would a good time to change password managers too—just save the new passwords in the new manager. Another approach would be to turn on MFA for your services, if you have not yet. Then even a cracked password will not be enough for a bad guy to get in. All that said, if you have been using a long and complex master password, it’s unlikely that it could be successfully decrypted in the first place.

RheingoldRiver 4y ago
Thanks for the answer - I'm hoping to slowly change passwords and switch to a new manager over the next year, which sounds fine to do as long as I don't need to worry about the security of my current vault. The major blocker is that now I need a new master password - it was effort to memorize this one, given its security, so I need to generate & memorize a new long string of digits, etc.