Dear LastPass, Kill Yourself!

[pacman 7,355]

PSA: If you use Lastpass as a password manager, find a new password manager (info on selecting password managers), change EVERY password you stored in Lastpass, and delete your Lastpass account and information.

What’s in a PR statement: LastPass breach explained | Almost Secure (palant.info)

LastPass Data Breach: It’s Time to Ditch This Password Manager | WIRED

Recommended actions for the LastPass security breach : Lastpass (reddit.com)

Quote

I recommend a specific course of action as steps to secure your privacy and accounts in the most conservative way possible.

LastPass is disingenuous with their security notice blog post to save their own skin: SENSITIVE INFORMATION IS LEAKED. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of:

• Customer Names / Company Names

• Email Address of main LastPass account

• Billing Address

• Telephone Numbers

• IP addresses (from where customers accessed the service)

• Website URLs saved in LastPass vaults (LastPass doesn't encrypt the website URLs)

• Encrypted vaults secured by only the master password of the time of backup. Weak master passwords are probably readily crackable with current password hashing/guessing techniques. For stronger password it is only a matter of time until hardware becomes powerful enough. See /u/dschwarz's post on bruteforce time estimates for your password.

LastPass can no longer be trusted with your secrets:

• LastPass lied in their marketing about Zero Knowledge vaults: website URLs are UNENCRYPTED, this is sensitive information and exposes you to large-scale automated targeted phishing, doxing, social engineering and blackmail attacks.

• LastPass waited 5 MONTHS after the August breach to warn us. They waited the day before Christmas to announce this with obfuscating language to minimize reach of this bad news.

• LastPass will unlikely survive the litigation, class action lawsuits and customer exodus that will follow. This will result in decreased operational security as whole teams are fired during bankruptcy, processes deteriorate and disgruntled employees head for the door.

My recommended steps are very conservative but I deem it be necessary at this point:

1. Change your LastPass master password. To be clear: this will not help you with the stolen encrypted vaults which are only protected by your previous master password. This is rather to hedge against LastPass lying even more about threat actor access.

2. Setup a different password manager solution.

2.1. Some people recommend other cloud-password managers like Bitwarden and 1Password. While these apparently vouch they encrypt the whole vault INCLUDING website URLs, you are fundamentally not in control.

2.2. Keepass + Syncthing (or other cloud storage synchronization for the encrypted vault file) is a commonly recommended self-managed solution that puts you in full control. It can be finicky however to sync across platforms/devices.

3. Change all passwords and enter the new passwords in your new password manager.

This is especially urgent if you had a weak masterpassword around the time of the breach.

Prioritize your most sensitive accounts: banking, telecom/phone providers (beware SIM jacking attacks!), credit cards, payment processors, cryptobrokers/wallets, e-commerce, insurance, government portals, etc.

You can export your LastPass vault to .csv (readable in text editor or Excell). Be careful how you store this, it's all your secrets in plain text.

4. Demand deletion of all your data through GDPR, or similar request forms. This breach contained the personal and vault data of previous customers. To ensure you are not continuing to be exposed to LastPass abysmal practices into the future, force them to delete everything they have on you.

5. Join the inevitable class action lawsuit. LastPass misrepresented their service and exposed your sensitive information.

Instead of celebrating Christmas with my family, I will be changing passwords on hundreds of accounts, thanks LastPass!

Edit: thanks to /u/rouv3n's source code investigation, we can guess which vault fields were unencrypted:

of course, the URL

password creation time

last password modification time

last password access time (great to guess which accounts might be used more often!)

whether you added this account to favorites

whether or not the password was auto-generated (great to figure out which passwords might be more vulnerable!)

... and a lot more, which might contain a good amount of data about your usage habits as they concern specific sites (e.g. whether you enabled auto-logon)

To be clear, these fields are freely readable right now, they do not require masterpassword cracking/guessing. In any case, I recommend password changes on all accounts in your vault as it is only a matter of time before master passwords start getting cracked.

 

Edited December 30, 2022 by pacman

[Post Oak 20,210]

Read something last night . Just switched over to 1password this AM.  Now I'm going through and changing my pws. It's a shame because I've always had LP but I can't abide by this.

[RPM 26,318]

I use My Notebook in My Desk

[Captain Ron 12,873]

Edward Snowden said all of these places were crap.

[Trey3216 15,346]

14 minutes ago, Post Oak said:

Read something last night . Just switched over to 1password this AM.  Now I'm going through and changing my pws. It's a shame because I've always had LP but I can't abide by this.

Are all your passwords "1password!" 

[Post Oak 20,210]

15 minutes ago, Trey3216 said:

Are all your passwords "1password!" 

Damnit. Welp I guess I've got to switch them again.

[swraith 346]

My IT guy has been bitching about this for a while.  He is switching everyone over to https://bitwarden.com/

[Viper 12,108]

I switched to bitwarden a few years ago and deleted my lastpass account. It's been the same or better than lastpass (and doesn't charge)

[Chopper 17,230]

I've been trying, successfully 'til now, to bury my head in the sand on this. I knew it was bad, but I didn't consider LP's release of info right before xmas detail. That puts LP's behavior squarely in the nefarious category. I can't imagine how exhausting it's going to be to change all my damn passwords. Although the only sites I self-generate a pw for are basically netflix and other streaming sites, and I have a strong master pw on Last Pass. However, I about keeled over from a heart attack when I asked my wife what her master pw is on LP. The only silver lining is, probably, thank goodness she doesn't do any of our online banking. Although I'd guess her email is relatively vulnerable.

Based on wirecutter's review it looks like I'm going to be switching to 1password. 

[Rimbo 25,921]

1 hour ago, swraith said:

My IT guy has been bitching about this for a while.  He is switching everyone over to https://bitwarden.com/

That was what the Security Guru at the last place I worked recommended. It's... not a very polished user experience. But it works everywhere.

[RollLeft 5,044]

damn, thx.

[tbone_ 14,115]

Do people really think there’s a password manager concept that won’t get hacked or exposed eventually?

[Nice Guy Eddie 13,511]

7 minutes ago, tbone_ said:

Do people really think there’s a password manager concept that won’t get hacked or exposed eventually?

There are always potential hacks with systems if you also need to retrieve data. My biggest concern is whether the password company is accurately communicating the risks. They tell you that they don't have access to your stored and master passwords but is that accurate?

[Fudge Nuggets 19,190]

One password for all sites, post-it note with said password written on it hanging from the side of the monitor.

This is the way.

[Samson's Wig 3,191]

31 minutes ago, Fudge Nuggets said:

One password for all sites, post-it note with said password written on it hanging from the side of the monitor.

This is the way.

Until a single database gets hacked and then you have to change every password manually.  I don't think there's really a way to avoid data getting stolen, but this method definitely will create the biggest headache once a problem arises.

[tbone_ 14,115]

I may just be old. But I don’t trust a password manager. At. All.

[Samson's Wig 3,191]

1 minute ago, tbone_ said:

I may just be old. But I don’t trust a password manager. At. All.

I'm with you there.  Still seeking a solution that makes sense.

[Rockwell Torrey 1,280]

32 minutes ago, Samson's Wig said:

I'm with you there.  Still seeking a solution that makes sense.

tattoos 

[Brisketexan 105,095]

[gyroprotagonist 2,592]

On 12/30/2022 at 2:13 PM, Rimbo said:

That was what the Security Guru at the last place I worked recommended. It's... not a very polished user experience. But it works everywhere.

longtime LP user.  love that works on PC and mobile (within most apps).

does Bit Warden work on phones (android if it matters).  FML, i have soooo much shit stored on LP but each new press release makes it seems like they are proper fucked and users would be stupid not too switch.  Have also heard good things about Dashlane

[Rimbo 25,921]

24 minutes ago, gyroprotagonist said:

longtime LP user.  love that works on PC and mobile (within most apps).

does Bit Warden work on phones (android if it matters).  FML, i have soooo much shit stored on LP but each new press release makes it seems like they are proper fucked and users would be stupid not too switch.  Have also heard good things about Dashlane

I'm using it on Android right now. So, yes. 

[Post Oak 20,210]

I switched from LP to 1password and it was really easy for me and thats saying something. The transfer part was painless. I spent a couple of hours updating my important passwords. 

The 1P interface is pretty similar and it was easy to get used to it. Works on Android.

[HiggyBaby 2,529]

The key to successful password management is to keep adopting dogs.

[dcbc 14,471]

Lines from movies with correct capitalization, spacing, and punctuation make pretty solid passwords and are easy to remember.  I'm talking about a complete sentence such as, "On your deathbed, you'll receive total consciousness."  First one of you to email me the name of your bank and your username can have that one.

 

I'm old and distrusting.  I don't use an online password manager.

Edited January 25, 2023 by dcbc

[Biff Tannen 45,674]

On 1/24/2023 at 12:19 PM, Fudge Nuggets said:

One password for all sites, post-it note with said password written on it hanging from the side of the monitor.

This is the way.

 

On 1/24/2023 at 12:51 PM, Samson's Wig said:

Until a single database gets hacked and then you have to change every password manually.  I don't think there's really a way to avoid data getting stolen, but this method definitely will create the biggest headache once a problem arises.

This is more or less my system and if the worst happens, I’d rather just quit the internet than figure out how to change hundreds of passwords. 

[dcbc 14,471]

1 minute ago, Biff Tannen said:

hundreds of passwords. 

Wow.  That's a lot of porn sites.

[Viper 12,108]

28 minutes ago, Biff Tannen said:

hundreds of passwords. 

 

26 minutes ago, dcbc said:

Wow.  That's a lot of porn sites.

[hayden_horn 11,362]

On 1/24/2023 at 12:07 PM, tbone_ said:

Do people really think there’s a password manager concept that won’t get hacked or exposed eventually?

 

On 1/24/2023 at 1:19 PM, tbone_ said:

I may just be old. But I don’t trust a password manager. At. All.

right there with you.

my password is pretty good. but the key to a good password is the length, not the fucking confusing ass special characters. those worked when we were limited to x number of characters for a password. 

if i write four random words that occur to me as i look around my office:

paper battery godfather barometer

crack that password, shitheads. xkcd hipped me to this years back:

[Chopper 17,230]

Former Lastpass user. Now with 1password. Switching and changing the pw's I gaf about was not a big deal.

I gave up trying to remember individual passwords maybe 7 years ago, once it became obvious that re-using the same or similar passwords was no bueno. Thinking your one reused phrase or password is somehow safer than an encrypted password saved on a multi-authenticated pw management program seems crazy and inconvenient af to me but ymmv. 1password works in concert with Microsoft Authenticator and the fingerprint on my cell phone to stay and remain locked and encrypted. All my pw's are different from one another, are generally a minimum of 20 characters long, and use random capitalization, numbers and special characters. If one random website with unencrypted pw's gets hacked the hackers wouldn't be able to use my account details to spring anywhere else.

I also keep my email segregated. All my bank and investment emails go to one email address. All other commercial email else goes to a different email address. Not even the domain is the same.

The lastpass hack could be dangerous to someone with an easy master password and who didn't use multi-authentication. It also could be problematic if you were using it to store information, like notes, outside of their pw encryption. But pw's were the only thing I ever used it for, so that's not me. I have no doubt that, used properly, a pw management system is much, much safer and convenient than either remembering your own, or writing them down somewhere.

 

[Biff Tannen 45,674]

10 minutes ago, Chopper said:

The lastpass hack could be dangerous to someone with an easy master password and who didn't use multi-authentication.

Two factor authentication should solve all password problems.  As long as hacker doesn't have my phone, should be fine, no?

[Viper 12,108]

17 minutes ago, Biff Tannen said:

Two factor authentication should solve all password problems.  As long as hacker doesn't have my phone, should be fine, no?

As long a it's an actual authenticator app and not your phone number or email address 

[Gatorubet 30,212]

1 hour ago, hayden_horn said:

 

if i write four random words that occur to me as i look around my office:

paper battery godfather barometer

crack that password, shitheads. xkcd hipped me to this years back:

Hold on!  Heading over to Mar a lago to see what happens when I put in Person. Woman. Man. Camera.

[Biff Tannen 45,674]

8 minutes ago, Viper said:

As long a it's an actual authenticator app and not your phone number or email address 

Why not phone number?  Can they clone it or something?  Email I get.

[Chopper 17,230]

25 minutes ago, Biff Tannen said:

Two factor authentication should solve all password problems.  As long as hacker doesn't have my phone, should be fine, no?

Mutifactor authentication is an option on 1password but not required. To do it you have to use either microsoft authenticator app or perhaps one other.

[Samson's Wig 3,191]

Does 1password play nice for Apple users?

[Chopper 17,230]

14 hours ago, Samson's Wig said:

Does 1password play nice for Apple users?

The tomsguide review says yes.

Quote

Best for Mac users, and maybe for everyone else too

https://www.tomsguide.com/reviews/1password

[Viper 12,108]

bitwarden offers an upgraded encryption now. instructions for switching to it.

[The Ace of Aces 5,181]

Use a Keepass database and client. Easy peasy. I use Strongbox (moved from 1Password a year ago). .kbx file stored in iCloud files and backed up with a Yubikey for 2FA. 

[Samson's Wig 3,191]

Just now, The Ace of Aces said:

Use a Keepass database and client. Easy peasy. I use Strongbox (moved from 1Password a year ago). .kbx file stored in iCloud files and backed up with a Yubikey for 2FA.