Jump to content

Dear LastPass, Kill Yourself!


pacman

Recommended Posts

PSA: If you use Lastpass as a password manager, find a new password manager (info on selecting password managers), change EVERY password you stored in Lastpass, and delete your Lastpass account and information.

What’s in a PR statement: LastPass breach explained | Almost Secure (palant.info)

LastPass Data Breach: It’s Time to Ditch This Password Manager | WIRED

Recommended actions for the LastPass security breach : Lastpass (reddit.com)

Quote

I recommend a specific course of action as steps to secure your privacy and accounts in the most conservative way possible.

LastPass is disingenuous with their security notice blog post to save their own skin: SENSITIVE INFORMATION IS LEAKED. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of:

  • Customer Names / Company Names

  • Email Address of main LastPass account

  • Billing Address

  • Telephone Numbers

  • IP addresses (from where customers accessed the service)

  • Website URLs saved in LastPass vaults (LastPass doesn't encrypt the website URLs)

  • Encrypted vaults secured by only the master password of the time of backup. Weak master passwords are probably readily crackable with current password hashing/guessing techniques. For stronger password it is only a matter of time until hardware becomes powerful enough. See /u/dschwarz's post on bruteforce time estimates for your password.

LastPass can no longer be trusted with your secrets:

  • LastPass lied in their marketing about Zero Knowledge vaults: website URLs are UNENCRYPTED, this is sensitive information and exposes you to large-scale automated targeted phishing, doxing, social engineering and blackmail attacks.

  • LastPass waited 5 MONTHS after the August breach to warn us. They waited the day before Christmas to announce this with obfuscating language to minimize reach of this bad news.

  • LastPass will unlikely survive the litigation, class action lawsuits and customer exodus that will follow. This will result in decreased operational security as whole teams are fired during bankruptcy, processes deteriorate and disgruntled employees head for the door.

My recommended steps are very conservative but I deem it be necessary at this point:

  1. Change your LastPass master password. To be clear: this will not help you with the stolen encrypted vaults which are only protected by your previous master password. This is rather to hedge against LastPass lying even more about threat actor access.

  2. Setup a different password manager solution.

2.1. Some people recommend other cloud-password managers like Bitwarden and 1Password. While these apparently vouch they encrypt the whole vault INCLUDING website URLs, you are fundamentally not in control.

2.2. Keepass + Syncthing (or other cloud storage synchronization for the encrypted vault file) is a commonly recommended self-managed solution that puts you in full control. It can be finicky however to sync across platforms/devices.

3. Change all passwords and enter the new passwords in your new password manager.

This is especially urgent if you had a weak masterpassword around the time of the breach.

Prioritize your most sensitive accounts: banking, telecom/phone providers (beware SIM jacking attacks!), credit cards, payment processors, cryptobrokers/wallets, e-commerce, insurance, government portals, etc.

You can export your LastPass vault to .csv (readable in text editor or Excell). Be careful how you store this, it's all your secrets in plain text.

4. Demand deletion of all your data through GDPR, or similar request forms. This breach contained the personal and vault data of previous customers. To ensure you are not continuing to be exposed to LastPass abysmal practices into the future, force them to delete everything they have on you.

5. Join the inevitable class action lawsuit. LastPass misrepresented their service and exposed your sensitive information.

Instead of celebrating Christmas with my family, I will be changing passwords on hundreds of accounts, thanks LastPass!

Edit: thanks to /u/rouv3n's source code investigation, we can guess which vault fields were unencrypted:

of course, the URL

password creation time

last password modification time

last password access time (great to guess which accounts might be used more often!)

whether you added this account to favorites

whether or not the password was auto-generated (great to figure out which passwords might be more vulnerable!)

... and a lot more, which might contain a good amount of data about your usage habits as they concern specific sites (e.g. whether you enabled auto-logon)

To be clear, these fields are freely readable right now, they do not require masterpassword cracking/guessing. In any case, I recommend password changes on all accounts in your vault as it is only a matter of time before master passwords start getting cracked.

 

Edited by pacman
  • Hook 'Em 3
Link to comment
Share on other sites

I've been trying, successfully 'til now, to bury my head in the sand on this. I knew it was bad, but I didn't consider LP's release of info right before xmas detail. That puts LP's behavior squarely in the nefarious category. I can't imagine how exhausting it's going to be to change all my damn passwords. Although the only sites I self-generate a pw for are basically netflix and other streaming sites, and I have a strong master pw on Last Pass. However, I about keeled over from a heart attack when I asked my wife what her master pw is on LP. The only silver lining is, probably, thank goodness she doesn't do any of our online banking. Although I'd guess her email is relatively vulnerable.

Based on wirecutter's review it looks like I'm going to be switching to 1password. 

  • Hook 'Em 1
Link to comment
Share on other sites

  • 4 weeks later...
7 minutes ago, tbone_ said:

Do people really think there’s a password manager concept that won’t get hacked or exposed eventually?

There are always potential hacks with systems if you also need to retrieve data. My biggest concern is whether the password company is accurately communicating the risks. They tell you that they don't have access to your stored and master passwords but is that accurate?

Link to comment
Share on other sites

31 minutes ago, Fudge Nuggets said:

One password for all sites, post-it note with said password written on it hanging from the side of the monitor.

This is the way.

Until a single database gets hacked and then you have to change every password manually.  I don't think there's really a way to avoid data getting stolen, but this method definitely will create the biggest headache once a problem arises.

Link to comment
Share on other sites

On 12/30/2022 at 2:13 PM, Rimbo said:

That was what the Security Guru at the last place I worked recommended. It's... not a very polished user experience. But it works everywhere.

longtime LP user.  love that works on PC and mobile (within most apps).

does Bit Warden work on phones (android if it matters).  FML, i have soooo much shit stored on LP but each new press release makes it seems like they are proper fucked and users would be stupid not too switch.  Have also heard good things about Dashlane

Link to comment
Share on other sites

24 minutes ago, gyroprotagonist said:

longtime LP user.  love that works on PC and mobile (within most apps).

does Bit Warden work on phones (android if it matters).  FML, i have soooo much shit stored on LP but each new press release makes it seems like they are proper fucked and users would be stupid not too switch.  Have also heard good things about Dashlane

I'm using it on Android right now. So, yes. 

Link to comment
Share on other sites

I switched from LP to 1password and it was really easy for me and thats saying something. The transfer part was painless. I spent a couple of hours updating my important passwords. 

The 1P interface is pretty similar and it was easy to get used to it. Works on Android.

Link to comment
Share on other sites

Lines from movies with correct capitalization, spacing, and punctuation make pretty solid passwords and are easy to remember.  I'm talking about a complete sentence such as, "On your deathbed, you'll receive total consciousness."  First one of you to email me the name of your bank and your username can have that one.

 

I'm old and distrusting.  I don't use an online password manager.

Edited by dcbc
  • Haha 1
Link to comment
Share on other sites

On 1/24/2023 at 12:19 PM, Fudge Nuggets said:

One password for all sites, post-it note with said password written on it hanging from the side of the monitor.

This is the way.

 

On 1/24/2023 at 12:51 PM, Samson's Wig said:

Until a single database gets hacked and then you have to change every password manually.  I don't think there's really a way to avoid data getting stolen, but this method definitely will create the biggest headache once a problem arises.

This is more or less my system and if the worst happens, I’d rather just quit the internet than figure out how to change hundreds of passwords. 

  • Like 1
Link to comment
Share on other sites

On 1/24/2023 at 12:07 PM, tbone_ said:

Do people really think there’s a password manager concept that won’t get hacked or exposed eventually?

 

On 1/24/2023 at 1:19 PM, tbone_ said:

I may just be old. But I don’t trust a password manager. At. All.

right there with you.

my password is pretty good. but the key to a good password is the length, not the fucking confusing ass special characters. those worked when we were limited to x number of characters for a password. 

if i write four random words that occur to me as i look around my office:

paper battery godfather barometer

crack that password, shitheads. xkcd hipped me to this years back:

password_strength.png

  • Hook 'Em 2
Link to comment
Share on other sites

Former Lastpass user. Now with 1password. Switching and changing the pw's I gaf about was not a big deal.

I gave up trying to remember individual passwords maybe 7 years ago, once it became obvious that re-using the same or similar passwords was no bueno. Thinking your one reused phrase or password is somehow safer than an encrypted password saved on a multi-authenticated pw management program seems crazy and inconvenient af to me but ymmv. 1password works in concert with Microsoft Authenticator and the fingerprint on my cell phone to stay and remain locked and encrypted. All my pw's are different from one another, are generally a minimum of 20 characters long, and use random capitalization, numbers and special characters. If one random website with unencrypted pw's gets hacked the hackers wouldn't be able to use my account details to spring anywhere else.

I also keep my email segregated. All my bank and investment emails go to one email address. All other commercial email else goes to a different email address. Not even the domain is the same.

The lastpass hack could be dangerous to someone with an easy master password and who didn't use multi-authentication. It also could be problematic if you were using it to store information, like notes, outside of their pw encryption. But pw's were the only thing I ever used it for, so that's not me. I have no doubt that, used properly, a pw management system is much, much safer and convenient than either remembering your own, or writing them down somewhere.

 

Link to comment
Share on other sites

17 minutes ago, Biff Tannen said:

Two factor authentication should solve all password problems.  As long as hacker doesn't have my phone, should be fine, no?

As long a it's an actual authenticator app and not your phone number or email address 

Link to comment
Share on other sites

1 hour ago, hayden_horn said:

 

if i write four random words that occur to me as i look around my office:

paper battery godfather barometer

crack that password, shitheads. xkcd hipped me to this years back:

Hold on!  Heading over to Mar a lago to see what happens when I put in Person. Woman. Man. Camera.

  • Hook 'Em 1
  • Haha 1
Link to comment
Share on other sites

25 minutes ago, Biff Tannen said:

Two factor authentication should solve all password problems.  As long as hacker doesn't have my phone, should be fine, no?

Mutifactor authentication is an option on 1password but not required. To do it you have to use either microsoft authenticator app or perhaps one other.

Link to comment
Share on other sites

  • 4 weeks later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...