5 ms·
LastPass says employee’s home computer was hacked and corporate vault taken
- alexnewman 4y agoThey should declare bankruptcy
- olkingcole 4y agoDoes this mean they got access to unencrypted vaults? I have had a few beers and cannot comprehend from the article or lastpass's statement.
- verteu 4y agoI don't think so. Per Lastpass's description of their architecture, their server never sees your unencrypted passwords. (Though substantial metadata, such as the website URLs, are not encrypted.) To get unencrypted vaults, they'd need to change the client-side code. But we haven't been told that this happened. (As a best practice, it's probably best to assume everything in LastPass vault was compromised at this point.)
- naetius 4y ago> Among other things, the vault gave access to a shared cloud-storage environment that contained the encryption keys for customer vault backups stored in Amazon S3 buckets. Wow. So those backups - which I hope and assume are encrypted with users’ credentials and were supposed to have one more layer of “LastPass” corp encryption - now seem to be lacking the latter. This sounds equivalent to stealing the encrypted blobs from each and every LP user. (Hoping to be wrong here) If one workstation getting hacked led to something like this I wonder what other mess is hiding in the crypto details…
- Yhippa 4y agoHow bad is this?
- chris11 4y agoAccess control isn't great if an engineer was able to transfer vaults to a personal plex server.
- object-a 4y agoCurious what the “vulnerable third party media software” that the hacker exploited was Edit: NVM, the article says it was Plex
- donutshop 4y agoSenior DevOops Engineer
- 60fps 4y agostop using password managers