LastPass Says It Didn't Leak Your Password 25
Did LastPass get hacked? Gizmodo: Some users of the popular password manager recently received emails from the company warning them of suspicious login attempts that were utilizing their master password -- definitely never a great sign. Speculation soon spread that LastPass may have suffered a data breach that exposed users' credentials, thus allowing for the malicious activity to take place.
According to LastPass itself, the answer is: We don't think so. When reached for comment by Gizmodo, the company provided us with a statement blaming the irregular activity on "credential stuffing" attempts by some unknown threat actor: "LastPass investigated recent reports of blocked login attempts and we believe the activity is related to attempted 'credential stuffing' activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services.
According to LastPass itself, the answer is: We don't think so. When reached for comment by Gizmodo, the company provided us with a statement blaming the irregular activity on "credential stuffing" attempts by some unknown threat actor: "LastPass investigated recent reports of blocked login attempts and we believe the activity is related to attempted 'credential stuffing' activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services.
session cookies (Score:3)
For LastPass I'd bet capturing session cookies from a browser is the best bet for access.
Re: session cookies (Score:1)
Why would anyone use a cloud based manager? (Score:5, Interesting)
The only pain in the ass is when I update the
Re: (Score:2)
Your second-to-last sentences is exactly why people want a cloud-based solution. With password rotation policies, and needing to create logins for systems several times a week, something that doesn't require manual syncing is necessary for most people. Personally, I also use Keypass, but keep the file on a cloud service.
Lucky you that can get away with only needing to update once every 6 months. Your use-case is rare.
Re: (Score:2)
Lucky you that can get away with only needing to update once every 6 months. Your use-case is rare.
No kidding. I’m adding things to my password manager (Bitwarden) every few days - secure notes, most often.
And every so often I dump the whole thing into a JSON file that’s kept on an encrypted disk image. So as long as I have access to that, I can recover all my passwords and secure notes - no cloud needed.
Re: Why would anyone use a cloud based manager? (Score:3)
This is the answer: KeePass, with a strong password, stored on a cloud service. Those of us who are especially paranoid put it on a service that we manage, but really, something like Dropbox is fine.
I don't trust browser-based solutions, because browsers present a big attack surface. I also don't trust any service that has its own cloud integration, because you cannot be certain that they cannot see the unencrypted data.
Re: (Score:1)
This is the answer: KeePass, with a strong password, stored on a cloud service. Those of us who are especially paranoid put it on a service that we manage, but really, something like Dropbox is fine.
An improvement would be: KeePass, with a password and a local key file.
The key file functions as an additional pre-shared key (PSK) that is automatically combined with your passphrase and without which your KeePass database file cannot be decrypted.
Once you securely copy the key file to all your devices, you can freely share your KeePass database file on cloud storage without worry, even if you have a weak password or don't trust the storage provider.
Re: Why would anyone use a cloud based manager? (Score:1)
Re: (Score:1)
The only pain in the ass is when I update the .kpx file, then I have to copy the damned thing around. Which happens maybe every 6 months tops now that I rely on it.
You could have the .kpx file on OwnCloud then it would replicate to all devices.
Re: Why would anyone use a cloud based manager? (Score:2)
Re: (Score:2)
The only pain in the ass is when I update the .kpx file, then I have to copy the damned thing around. Which happens maybe every 6 months tops now that I rely on it.
That's your answer. Sooner or later someone forgets to update the .kpx file and then loses access to a critical system. I used Keepass and LastPass both. Although they are password managers, in reality, they are very different tools. Each tool is for a job, and it is neither safe nor secure to think one can replace the other in the general case.
You have to be insane to use lastpass (Score:5, Informative)
Re: You have to be insane to use lastpass (Score:1)
Re: (Score:2)
Do you mean you would be insane to use a weak master password? If I have a huge master password that is not ever used for anything else, how am I vulnerable?
Reusing a password for your LastPass master? (Score:1)
Security (Score:1)
You fools do not know how to make a password. I mean, look at my password, which is Sl%ashD0tSuxx9000, notice how I use multiple special characters, a mix of upper and lower case, and digits. It also has no spelling that matches a Websterâ(TM)s dictionary word, and consists of a phrase that nobody would ever think of saying. I am certain my password will not be cracked for a while.
I believe them (Score:2)
From the early reports I read, the accounts that were compromised were mostly old, seldom-used accounts, with passwords that hadn't been changed in (maybe) years. All of this suggests to me that the breaches were the result of plain old hacking attempts -- brute force attacks, rainbow tables, etc. If there really was a way to "hack" LastPass and get plaintext passwords, I would suggest everybody get off that service immediately. But I doubt there is a way to do that. I doubt LastPass even stores anybody's p
Re: (Score:3)
When you are a big corporation with a single task: to secure other peoples' information; you are incentivized to do that task correctly. And as your reputation grows, the incentive grows stronger.
I have more important things to worry about. LastPass has been valuable and convenient to me and I'm inclined to trust them until I see strong evidence otherwise. My schedule allows only so much time for paranoia so I direct it elsewhere.
Re: (Score:2)
I tend to agree. Especially as credential stuffing with data from breaches is a standard, low-skill attack. Sounds like some users re-used their passwords and one of the uses got compromised.
Re: (Score:3)
All of this suggests to me that the breaches were the result of plain old hacking attempts -- brute force attacks, rainbow tables
You do know that you can only use rainbow tables if you have the hashed passwords, right? So for an attack using rainbow tables you would need the hashes from the LastPass database. Ergo a successful attack on LastPass would have to have taken place.
I know they didn't because... (Score:3)
Re: (Score:2)
What alternative did you propose that wasn't a single source of failure? Is it something that your average user could implement across their devices?
On a side note, if I'm being pedantic, any system that allows you to independently access your data has a single point of failure when exposed to a little rubber hose cryptanalysis [xkcd.com].
Reminder - not private (Score:2)