Comments

You must log in or register to comment.

Fit-Anything8352 t1_j1gadou wrote

Hey guys, those password faults are secured with AES-256 are we just going to pretend that attackers can break it? They can't even do it if they have fully functional quantum computers or something(they'd still be left with the impossible task of brute forcing the equivalent of an 128-bit cipher).

If your master password wasn't something absolutely stupid then you probably aren't at risk of anything; the NSA doesn't even have the ability to break properly implemented AES-256. This is the whole point of cryptography.

194

Neverending_Rain t1_j1gj6vr wrote

From what I saw in the other thread they did leak a ton of personal info and what sites the passwords were used for, which is still a huge problem.

They're not going to crack the passwords and get into the accounts, but the hackers will be able to look through all that info to find valuable targets for further phishing attacks, or blackmail targets. There is a ton that can be done just by knowing what websites someone has accounts on.

The average person will probably be fine, but this can still cause huge problems for some Lastpass users.

81

rob_zombie33 t1_j1gkg55 wrote

I agree. I believe I was a target in this manner after a different hack very shortly after the company admitted it happened. They never notified me though, so when I received a call claiming to be them and knowing detailed information of my account I believed it was them. I ended the call and didn't engage further with them but noticed a lot of repeat calls from the same number. I knew then it was a scammer and the company announcement I saw led me to contact them to confirm they were not trying to reach me in any way. Be on the lookout folks and take caution with anyone trying to reach you. If they are trying to engage you about something tell them to send you something by mail or to give you a number to callback later to see what happens.

16

QuietlyZen t1_j1hh29x wrote

Agree with all but the last. Never trust a number that they give you, or that shows on caller ID. Instead call a number you know to be good through other means

5

rob_zombie33 t1_j1hxh3h wrote

That's a good point, you are right that it could be spoofed. In my case when I asked for a number, they said I couldn't call them back and they will call me later. The number on caller id was definitely not a number the real company used as I determined with an actual company representative. It may help in this way to identify a fraud, but yes it won't help to verify that it isn't a fraud just seeing a legitimate number.

From what I gathered, this scammer was attempting to gather enough information for an account takeover. I immediately closed the account with the company, they can fuck off for not having good security measures.

3

asdaaaaaaaa t1_j1hhcpf wrote

> There is a ton that can be done just by knowing what websites someone has accounts on.

I'm waiting for that mass "oh shit" moment when the larger populace actually begins to understand how much you can do with large amounts of meta data. It's scary.

2

wren337 t1_j1gekzz wrote

Assuming they didn't do anything incorrectly. Like secretly having a second password for customer support, or for law enforcement requests. These guys have screwed the pooch at every turn. I find no comfort in them saying they had the right high level design.

59

Fit-Anything8352 t1_j1gers3 wrote

I mean they physically can't implement the cipher in a way that allows for a backdoor, it wouldn't work(unless they are simply lying about how they encrypt the data I guess, but some quick reverse engineering of their app should figure out pretty easily if they aren't actually using AES-256).

That's why it's a good idea to use open source security tools though. You can read the source code to make sure there's no funny business going on.

21

Ioncannon t1_j1udcjv wrote

I never understood this. Could they not just keep a secret branch that implements all the bad shit and they just merge the public main in from time to time?

Most people aren't compiling their own binaries.

1

Gaspar099 t1_j1i5zxy wrote

The thing that make me question is:How they can reset your Master Password if your data is encrypted? I lost my master password in the past and I was able to change it. Meaning they probably have a backdoor in there cryptographic system or a way to get the information on their side.

8

raunchyfartbomb t1_j1io28h wrote

Yea, this is a point to think on. The only thing I can think of is that it exists locally with much less security. But that doesn’t make sense, so they must have some way to decrypt it in order to apply the new password to the blob.

3

Gaspar099 t1_j1iob6i wrote

Maybe a copy of vault with another key they have.

1

hypnoticlife t1_j1i6ptn wrote

Both of the other replies here make me think that the master password isn’t the key. That it merely unlocks the key. This gives the ability to have a password reset and trivial support/law enforcement access. The only evidence is the ability for password resets. That’s a huge red flag.

7

wren337 t1_j1ke1j2 wrote

Agree that's how you do multiple passwords. There is a random encryption key for the actual data, and then multiple copies of that key are encrypted with your password and one or more of their passwords. So the question is, did their passwords get lost? If support can recover your vault, everything they've said is a lie.

1

nicuramar t1_j1irrv4 wrote

> Assuming they didn’t do anything incorrectly. Like secretly having a second password for customer support, or for law enforcement requests.

But if that’s secret and not leaked, an attacker wouldn’t be better off.

1

Packabowl09 t1_j1gp2bl wrote

The bigger issue is this breach showed how much info was not encrypted

21

what-the-puck t1_j1i21l7 wrote

Absolutely.

Every saved website URL is unencrypted.

Now the attackers have the owner's LastPass email address, all IP addresses used to log in (which for most people is an accurate geographic region), and for everyone who paid their full billing info including name, address and phone number.

And with URLs the attackers can tie all of that to every single service the person has a password for.

That's a goldmine in and of itself. Their utility bills tell you where they live with certainty. Their financial accounts tell you who their bank is, their mortgage company, their insurance company, their health insurance company, etc. Their company accounts tell you who they work for, even if they just have webmail or timesheets saved. Many people now have accounts for their doctor's office, and for different services that offer medical tests (scheduling).

Political affiliations. Hobbies. Clubs. What languages they speak. Deep dark secrets. There's a reason the backup was stolen.

Knowing all that, and previous password leaks, the attackers can (and already are undoubtedly) do Password Spraying attacks against the backup and will gain access to some accounts. It's inevitable, AES256 is too weak and stolen accounts too valuable.

15

Sarduci t1_j1gdzmh wrote

This is exactly the reason why you use something like this. Anyone can copy the data but only you have the key. As long as your key is reasonably strong, they’re never going to decrypt it in my lifetime.

9

billsonbobq2q t1_j1gz7xc wrote

Encryption is meaningless without a strong master password in this case. And LastPass was permitting some shockingly short master passes in their protocols.

Attackers can now take the file and run infinite offline brute force attacks on each vault until they unlock everything via the cracked encryption key.

Additionally because the files exposed URLs of each PW entry attackers can gain quite a bit of knowledge about the user of each vault, making it easier to guess and crack potential passwords.

So yeah, for most users there's not a ton of risk, but for anyone with PWs of less than 11ish characters and/or a low degree of entropy, everything they stored is at risk.

9

sometimesome t1_j1h8nyu wrote

Oh man i feel so stupid right now. I have so many questions. I had a few reset emails come at me while reading about this. Already moved to a different cloud based one that doesn’t get hacked every year. At first i thought ok they got hacked a few years back now they will double down on security- so they will be safer than the ones that didnt get hacked. 🙃

Alright my 2 questions to help me take better action. Hope someone can help, this may help others going through this right now too

  1. Silly obvious question but i need to ask it to be super sure: when you say they have the vault offline does this mean my new masterpassword online and some important ones that i have now deleted from my online vault, will not stop them from from accessing my old offline vault with the old password with the now deleted entries as well?

  2. Within a password file i would keep important private notes, not a secure note, but the field within a password entry, i cant find if this field was encrypted or was it fully visible too in the hack?

4

HanaBothWays t1_j1hkhwk wrote

> Already moved to a different cloud based one that doesn’t get hacked every year.

Respectfully, you don’t know how often they get hacked, they probably just Don’t disclose it the same way. But any password vault provider is gonna be an attractive target for hackers.

5

sometimesome t1_j1hlyhf wrote

Yes youre absolutely right, just know a few people that use 1password service with apple watch 2fa, and dont have time today of all days to figure out which self service to choose, how to setup and keep secure etc. but long term definitely need to do so

1

Gaspar099 t1_j1i6td7 wrote

>Within a password file i would keep important private notes, not a secure note, but the field within a password entry, i cant find if this field was encrypted or was it fully visible too in the hack?

On Last pass website, they are telling:
"LastPass Secure Notes is your personal Fort Knox notes app. Just like your Password Vault, Secure Notes is encrypted at the device-level, meaning personal data – Wi-Fi passcode, credit card info, password hints, and more – is protected from anyone who isn't you."

Meaning they are encrypted as well.

2

billsonbobq2q t1_j1jbze9 wrote

>will not stop them from from accessing my old offline vault with the old password with the now deleted entries as well?

Correct. They have a backup from months ago. While changing your master pw is a good idea, it doesn't remove what's already been taken.

>Within a password file i would keep important private notes, not a secure note, but the field within a password entry,

Everything I've read says the notes fields were encrypted. The URL field was exposed, as well as your name and email attached to your specific vault file.

2

Fit-Anything8352 t1_j1hq4pp wrote

> So yeah, for most users there's not a ton of risk, but for anyone with PWs of less than 11ish characters and/or a low degree of entropy, everything they stored is at risk.

They were always at risk though, it was always incredibly stupid to use short master passwords, it's not like we didn't know that. People who ignored the warnings and did it anyway knew exactly what they were signing up for in the event or a breach.

2

__s10e t1_j1h0o5j wrote

>Hey guys, those password faults are secured with

a passphrase chosen by the user.

We have to assume that most of them can be brute-force guessed.

8

Fit-Anything8352 t1_j1hqnxr wrote

I mean I mentioned "if your master password wasn't absolutely stupid." If you ignore all the warnings and set an 8 character master password you were always at risk in the event of a hypothetical breach, so this isn't really a surprise.

5

[deleted] t1_j1gmivx wrote

Agreed but the bigger issue is that people reuse their master password for other things and if they have been breached in the past the cracking may not need a quantum computer, but just a database of breached passwords.

3

Fit-Anything8352 t1_j1gn6fd wrote

I mean that's what I meant when I said "master password isn't something absolutely stupid."

That said, hopefully LastPass wasn't dumb enough to not use a key derivation function to derive the master key. The whole point of key derivation function is to make brute forcing passwords impractical by using an deliberately slow, computationally expensive hashing algorithm to derive the key from the password(say it takes like 100ms to compute on a very powerful computer). This effectively thwarts dictionary attacks, forcing the attacker back to "side step the key derivation function and just brute force the 256-bit key directly, without the database" which is again, impossible, even on future computers that don't exist.

Unless somebody discovers an effective, practical attack on full-round AES-256, which would be very impressive. But then you would have much bigger problems than your stupid passwords :)

5

RandoScando t1_j1gzybq wrote

Thanks! I was saying the same thing to a coworker, and they didn’t seem to understand the strength of AES 256. RSA, sure. But symmetric block rotation encryption is not vulnerable, even in this case.

1

tinny123 t1_j1hjr26 wrote

Tech novice here. Dont use lastpass. Dont trust it.

But if the hackers have all this data, are current users who attempt to sign in with their master password at risk because the vaults were hacked and stolen.?

1

VellDarksbane t1_j1hphea wrote

Assuming everything is implemented in the way Lastpass says it is, only if the attackers were still in the network, and had setup a system to scrape passwords. From what they’re saying, the attackers grabbed the encrypted vaults, which are useless without the master password, so anyone with a strong master password that hadn’t been reused anywhere will be fine.

There are options for password managers if you don’t trust lastpass, such as keepass, which stores the database locally, so no third party has any ability to view them. You then have to worry about backing up the database itself to avoid a hard drive going bad wiping out your password vault, but it is free iirc.

2

GlitteringAccident31 t1_j1htsf1 wrote

I think serving this locally for 99pct of users is much more error prone.

Backing up to the cloud, serving from an instance for availability across devices, backups on a bucket somewhere. so many possible attack vectors.

Bitwarden is free as well

3

VellDarksbane t1_j1jkgmp wrote

I agree, but being more error prone, and having to reset passwords more often, is better than password reuse for most users too. Lastpass, bitwarden, etc, all require you to trust the team you’re purchasing it from to some degree. Keepass is fully offline, with no ability to sync, except what you do to keep the file synced.

For most end users personal use, which is going to be many people in this thread, their backup is going to be a personal onedrive/icloud, a flash drive, or something like backblaze if they’re being fancy. They aren’t going to be configuring S3 buckets to keep their 50-100 password database backed up, if they back it up at all.

1

quettil t1_j1hxw6k wrote

> (they'd still be left with the impossible task of brute forcing the equivalent of an 128-bit cipher).

https://pbs.twimg.com/media/FksX2y8XoAIRr7b?format=jpg&name=small

Not necessarily impossible.

1

Fit-Anything8352 t1_j1imutz wrote

It is impossible if they implemented the key derivation function correctly. If they used salt and used a slow enough KDF then you can't do dictionary or rainbow table attacks on the password, so you have to brute force the key. Which means the impossible task of brute forcing the equivalent of an 128-bit cipher

1

prjindigo t1_j1i2faw wrote

"tHe nSa dOeSn"t eVeN HaVe ThE AbIlItY To bReAk pRoPeRlY ImPlEmEnTeD AES-256"

right... because it's "good enough" still and we've been told that for two decades and they sauce it daily. It was good enough for documents of the "secret" level... which is the level immediately above "given to the NYT for publishing"... in 2003.

also, quantum can't manipulate binary information in any meaningful way imagine helen keller playing cricket as a batter

(meme typing for the meme of it)

1

Fit-Anything8352 t1_j1im8js wrote

There is a quantum search algorithm called Grovers algorithm that lets you do a search with O(sqrt(N)) complexity which in other words means you an brute force an n-bit cipher in 2^n/2 operations. It requires way more sophisticated quantum computers than we have today though, with many more quibits and actual, working error correction.

> right... because it's "good enough" still and we've been told that for two decades and they sauce it daily. It was good enough for documents of the "secret" level... which is the level immediately above "given to the NYT for publishing"... in 2003.

It is good enough. Edward Snowden told us that in 2014 even the NSA didn't have any effective cryptanalysis on AES, and even on unrealistic future computers it would still take longer than the heat death of the universe to brute force it.

3

alsopranos t1_j1helya wrote

What if there is no master password and using federated login instead?

0

The_Countess t1_j1gbu5t wrote

Despite the headline, the hackers still can't access any passwords. lastpass doesn't have any users master passwords to leak, so even if they made off with your encrypted password data, they are still encrypted with 256-bit AES encryption, with a key unique to and known only by each user. (and it is designed this way for exactly this eventuality)

The hackers would need to brute force each user individually to get at any passwords, and 256bit AES would take until the heat death of the universe crack that way. for one user.

Unless you are very interesting and have a master password that's vulnerable to rainbow table attacks, you probably still have very little if anything to worry about.

And as all cloud based password manager work roughly the same way switching password manager might not gain you much either.

48

ColtonProvias t1_j1gpfkc wrote

The large issue with the LastPass leak is that URLs were stored unencrypted. An attacker can use that with other related data (such as email addresses and contact information) to conduct spear phishing attacks.

You don't need to brute force a vault password to get a password, you just have to get enough information to claim to be the user or the service.

23

quettil t1_j1hxus7 wrote

> The hackers would need to brute force each user individually to get at any passwords, and 256bit AES would take until the heat death of the universe crack that way. for one user.

https://pbs.twimg.com/media/FksX2y8XoAIRr7b?format=jpg&name=small

Depends on how good the password is.

3

The_Countess t1_j1kahph wrote

They have a 12 character minimum length for the masterpassword, and i already mentioned a password being vulnerable to rainbow table attacks.

1

marumari t1_j1hh673 wrote

That’s only true if the keys are chosen randomly from all the possible key space, but they aren’t. A modern GPU can iterate through millions of passphrases with 100k rounds of PBKDF2-SHA256 per minute.

1

HanaBothWays t1_j1fux82 wrote

Typically they have handled hacks well in the past but they really screwed the pooch this time. If you are a LastPass user change both your master password and all your other passwords as well, starting with your most sensitive ones (email and finance).

If you haven’t used a password manager this shouldn’t put you off the idea, though. You’re still better off using one than not. But use BitWarden or something instead.

23

warchamp7 t1_j1gbthr wrote

How does BitWarden stack up against 1Pass?

6

HanaBothWays t1_j1gcbjd wrote

Do you mean 1Password? It’s free and open-source unlike 1Password although there’s nothing wrong with 1Password as such IMO. If you are using that keep on using it.

8

sleepybrett t1_j1ghqpu wrote

Any password manager that makes you use THEIR SaaS Cloud bullshit to store your vault is a risk. I dropped one password when they dropped support for local vaults.

4

HanaBothWays t1_j1hidqx wrote

I do like being able to sync over the cloud but one should have options.

1

betweentourns t1_j1fxfgf wrote

>change both your master password and

Is it as effective to just deactivate your account? And then change your passwords of course

1

HanaBothWays t1_j1g0heq wrote

You have to go change them because the hackers might have accessed local copies and if you deactivate your account first it is a lot harder to keep track of what you changed when.

Also I don’t know if you can still look up your passwords/have access to anything from your vault if you deactivate the account! I suspect you can’t. I use a different password manager.

8

moekakiryu t1_j1h1fl5 wrote

>Typically they have handled hacks well in the past but they really screwed the pooch this time.

Yeah that (and ease of use) was one of the reasons I actually went with Lastpass - they actually have a known history of being open, and disclosing risks with customers. Even with a breach as big as this I would be a lot more forgiving if they hadn't already sent 2 alerts already, both with the conclusion of 'its not a big deal, they haven't accessed user data'. If there was even a risk (in hindsight there probably was) I would have liked to been told about that.

>If you haven’t used a password manager this shouldn’t put you off the idea, though.

Agreed. As I've told a couple friends already, even with this breach where there's a risk that the hackers literally have a physical copy of my encrypted passwords, I'm STILL in a more secure position than if I hadn't used one at all. Its probably extremely difficult to impossible to get the passwords and even if they do, it only takes me an hour or two to fix that by rotating all of the passwords I have, thanks to to having a giant list of what I need to change.

1

colonel_beeeees t1_j1fxi3j wrote

When these things came out I was like ok so instead of hoping I don't get hacked, I just have to worry about this giant repository not getting hacked? Should I trust any of these password managers and why?

10

DrQuantum t1_j1g1sy3 wrote

Security is about mitigation. Every company is a target. They will be hacked. Its about mitigating risk of those hacks. So zero knowledge architecture is what Last Pass uses. All of your data is encrypted, by your master password key. Even with encryption, they can brute force into your account. The longer and more complex your password the harder this is.

This hack happened in August. Depending on your password complexity for example, they could still be trying to get in today on just your password.

So password managers still work and as long as you prioritize best practice passwords or hopefully pass phrases you should mitigate most of the risk to your accounts.

But, you don’t want to take chances and again you mitigate risk by still resetting your password.

Generally, you can trust password managers with zero trust architecture. Last Pass has become unreputabme over time due to its practices but that doesn’t mean that if implemented correctly you wouldn’t mitigate a lot of your risk.

Its still way better to have your passwords there than sitting plain text on your PC as an example.

18

iLikeFunToo t1_j1gon05 wrote

Building on this, if your password is 16-18 long and has all character types to brute force your password could take like billions of years (or trillions) with current computing. A good password make a lot of difference in these cases.

3

OppositeCode t1_j1g29qx wrote

Well I personally trust my current password manager (Bitwarden). When you save your account to that password manager. It is supposed to be fully encrypted and uploaded to the cloud. This is that if there is a breach, the hackers only have your encrypted information (essentially useless).

In the case of this LastPass hack, the URLs of accounts weren't encrypted while the rest of the usernames and passwords were. This can lead to phishing attacks attempting to gain access to that website's account.

There are also local password managers, however I decided against them, as it is not convenient for my personal situation. I started with LastPass but switched to Bitwarden after they implemented their single device policy. As of now Bitwarden has not been breached. With the code being open source, the ability to self host, and the developers responsive & open to suggestions; it has earned my trust.

6

scruffles360 t1_j1gs5fw wrote

I presume bitwarden doesn’t have any browser integration until the user logs in and asks for credentials?

I ask because that’s likely why LastPass doesn’t encrypt urls. When you go to a site, it knows it has a password and can prompt you to fill it. It’s a compromise in security for the convenience of browser integration. Whether or not it’s a good compromise is debatable but a lot of people are making it sound like laziness or a flaw. It’s most likely a usability choice.

3

OppositeCode t1_j1gxe32 wrote

Yes, unless you are logged in your vault won't be decrypted. I assume you mean something similar to this? https://bitwarden.com/help/uri-match-detection/ https://bitwarden.com/help/website-icons/

Correct me if I'm wrong, but I assume the website match should be done locally otherwise it would be encrypted. https://bitwarden.com/help/what-encryption-is-used/

Browser extensions are a weak point but it also prevents everyday people from getting phished. As if the domain is not matching, you won't be able to fill your information (since it won't show).

As always, if you don't trust cloud you can either self host or use a local password manager.

4

scruffles360 t1_j1gymq9 wrote

That may be similar. When you go to a login page and LastPass tells you you have 4 accounts on that site.. it gets that information using the unencrypted URLs. It doesn’t log you into your vault unless you try to use one of them. (There are settings to leave you logged in, but they discourage that).

I’m going to have to do some research and see what’s out there.

1

OppositeCode t1_j1gz5yx wrote

I'm not a developer so it would be your best bet to ask in different subreddits such as: r/privacy r/PrivacyGuides r/Bitwarden

1

coolfarmer t1_j1i9egc wrote

I LOVE Bitwarden! I switched from LastPass 6 months ago, best move ever :)

1

The_Countess t1_j1gaaex wrote

The hackers don't actually have access to any passwords though.

Each account is still encrypted with a unique key that lastpass doesn't even know so can't expose when getting hacked. The hackers would still need to brute force each account individually to get at the passwords.

Unless you are extremely interesting, or your master key is vulnerable to rainbow table attacks (meaning it consists mostly of words, making it much easier to guess), you probably still have nothing to worry about.

1

sleepybrett t1_j1ghju1 wrote

if you trust lastpass... they've been hacked like half a dozen times at this point. If they can't secure their network, what makes me think they secure my passwords any better.

1

justanemptyvoice t1_j1g86se wrote

I just migrated to 1Password and started changing all my PWs. Most sensitive ones are done. A 3 hour process. To hell with LP, that’s a colossal mess up.

10

sleepybrett t1_j1gh01r wrote

why is 1password any better? Any password manager that make you use their 'cloud' can get fucked IMO.

I used 1password until they mandated their cloud product and stopped supporting local vaults. At least with a local vault if they got hacked, and a flaw was found then someone would have to get my vault as well. Nice defense in depth. But with my vault in their cloud it's a one stop fucking shop... fuck all of that.

10

maumay t1_j1hpzu3 wrote

Ultimately there is negligible risk if an attacker gets their hands on your encrypted data if it was encrypted correctly. Using something like bitwarden which is open source and regularly audited by external parties give you a pretty strong guarantee this is the case. Storing the vault in the cloud is much more convenient when needing to access passwords from multiple devices.

2

sleepybrett t1_j1i7o37 wrote

'if it was encrypted correctly.'

For me, there are just some things that I will trust a company to do for me by proxy, and some things I don't. Keeping my identity (if someone has all your passwords they can become, effectively you) secure is one of those things that I'd rather do myself.

Convince is the enemy of security.

2

maumay t1_j1n0kv2 wrote

Do you trust the correct implementation of TLS encryption when your credentials are sent over the internet? What difference is there with trusting the correct implementation of password encryption?

1

sleepybrett t1_j1n61mr wrote

I can verify the TLS implimentation in my browser. I do not have access to 1passwords client and server apps source code.

1

maumay t1_j1nc0xy wrote

Ok, like I mentioned there are open source password manager like bitwarden whose source code is regularly audited and which can be verified by anyone.

1

sleepybrett t1_j1ndo7s wrote

I currently use bitwarden because I can host my own backend for it.

1

Rudy69 t1_j1gl0l6 wrote

I was going to say they used to support Dropbox syncing when I used it. But admittedly it's been a while....and boy am I glad I don't use it anymore wow

> I used 1password until they mandated their cloud product and stopped supporting local vaults. At least with a local vault if they got hacked, and a flaw was found then someone would have to get my vault as well. Nice defense in depth. But with my vault in their cloud it's a one stop fucking shop... fuck all of that.

0

philyue t1_j1hh3vj wrote

The thing is given the utter incompetency of LastPass’ security, can we have faith they have correctly and completely implemented the master zero-knowledge encryption on our password vaults?

10

Once_Wise t1_j1fy2dl wrote

  1. Some years ago when I was looking for a password manager I specifically excluded any cloud based ones, as there is no way they can be made as secure as a local one as a bad actor located anywhere in the world has access to the cloud site. For a local password manager file, someone would have to actually enter where I keep my computer to access the file. And that is a much smaller population of bad people. There are a lot of advantages of cloud based systems, but a password manager is not one of them.
6

DrQuantum t1_j1g317p wrote

The ability to manage passwords for an enterprise may necessitate a cloud based system.

4

sleepybrett t1_j1ghdqu wrote

As an enterprise you can run it all behind the vpn.

1

xal1124 t1_j1gch75 wrote

Is your password computer connected to the internet?

2

sleepybrett t1_j1ghbj9 wrote

My local vault IS accessible only on my wireguard vpn. 'come at me bro'. I'm one man to hack that is an undertaking, better results (as many vaults as they can find) and probably easier (bigger footprint) hacking the password manager cloud company...

−7

scruffles360 t1_j1gss3p wrote

Does the product you use deal well with multiple users (10-12 devices) and syncing changes made while off network between them? Serious question. I wouldn’t mind moving off the cloud solutions but I’m not sure there’s a good fit out there.

1

drinkmoredrano t1_j1gpb0x wrote

After LogMeIn bought them I knew they were going to go to shit. I'm glad I jumped ship when I did. I only hope that my "deleted" account was truly deleted and not susceptible to these compromises.

6

Useless_Advice_Guy t1_j1fxrds wrote

Is it still an issue if I have 2fa?

2

OppositeCode t1_j1g14xm wrote

From a privacy standpoint, you should change passwords (especially your master password). The hackers have the URLs for accounts of LastPass users (as it wasn't encrypted). So it is recommended to change passwords for "important accounts" (emails, financials, etc).

You can then slowly go through your other passwords and change them. Like the next time you visit the site. Also don't use LastPass any longer, if you want to keep using a cloud based password manager, I recommend Bitwarden for free users.

3

Flashbulb_RI t1_j1gparw wrote

I'm really angry that LastPass was not encrypting EVERYTHING in the user vaults including URLs because LastPass says on their website "Data stored in your vault is kept secret, even from LastPass." However from a practical point of view I wonder if the hackers can identify the email address/identity of the vault owner. Without that info the URLs are not useful.

6

DrQuantum t1_j1g14v8 wrote

Yes and no, you need 2fa on the accounts in your Lastpass. But the encrypted fields in your account are exposed. They can crack the master passwords and then have your others. If you have a strong password, like complex 14-16 characters or more it will take brute forcers a very long time to get in.

But everyone with Lastpass should reset their master password regardless and just in case everything in it if they must stay with last pass. But really at this point they should move off the platform.

2

WhiteToast- t1_j1gq1k9 wrote

My jobs been trying to get me to use last pass for months. Glad I’ve just been ignoring those emails

2

aarondigruccio t1_j1h50ss wrote

On the note of switching encrypted password managers: does anyone with a decent amount of knowledge on the subject matter have an opinion on iCloud Keychain?

2

locri t1_j1g2zea wrote

This is why I don't use those services...

1

Severe-Purchase-1171 t1_j1hso1z wrote

This is a classic example for ‘ a chain is as strong as the weakest link’ . All your passwords are under the risk of compromise unless you didn’t set a complex master password. LastPass should have had encrypted vault with a mix of user password and their own password.

1

circular_file t1_j1hvqd5 wrote

How many times do we need to say it; if we cannot review the source code, it is not secure.

1

adb202 t1_j1inwvo wrote

If MFA is set on the account…doesn’t that make the vault harder to open? Or is it since the hackers have downloaded the vaults, MFA no longer applies?

1

__Loot__ t1_j1jwy1s wrote

if your master pass is weak your fucked because they stole the whole database . MFA is only good when connecting to last pass servers. They stole the whole database so the hackers can bypass mfa

1

angelHairNoodles t1_j1j6rc3 wrote

Imo, I wouldn't trust any online password managers, no matter how good any cryptography is. Keep your sensitive data offline, choose a good master password and also use a hardware 2FA to lock up your encrypted database file(s). Don't be a fool.

1

Polymatheia t1_j1hppat wrote

Which password manager alternative is recommended to switch to? I will have to reset my password for hundreds of sites which will take hours, fuck Lastpass! 😡

0

jashsayani t1_j1gsk6l wrote

Can't wait for macOS to have a good built in solution (better than iCloud Keychain). Then I can ditch a 3rd party password manager. In 2022, all major OSes should have a solid built in one. They should maybe acquire 1Password.

−1

OppositeCode t1_j1gxq1f wrote

This changes from user to user. In my situation, I'm not in the apple ecosystem. I use Windows, Apple, and Android. This is where 3rd party password mangers shine. Usually, it has extensions and apps for each OS. If each major OS had it's own password manager, in my situation, would be completely useless.

3

tinny123 t1_j1hjs53 wrote

Tech novice here. Dont use lastpass. Dont trust it.

But if the hackers have all this data, are current users who attempt to sign in with their master password at risk because the vaults were hacked and stolen.?

−2