Ask HN: How did my LastPass master password get leaked? • Hacker News Board

Re: Ask HN: How did my LastPass master password get leaked?

#461

Post by verifex » Tue, Dec 28, 2021, 9:11 PM UTC

I don't trust LastPass or practically anyone else to be 100% secure. I use keypass, and store the file somewhere I can access remotely (online file storage) then can access it via my phone. If someone hacks your file storage account, they still can't access your passwords. The master password can be as complex or composite as possible and you never enter it into anything except the secure screen in keypass. There are some neat plugins for keypass too.

TL;DR keepass can do everything lastpass does, while you still hold all the keys and the data.

Re: Ask HN: How did my LastPass master password get leaked?

#462

Post by 40four » Tue, Dec 28, 2021, 9:14 PM UTC

gregsadetsky wrote: post #62

40four wrote: post #27

Earlier quoted context omitted.

Personally I just stick to local Keepass database files. I’ve never ventured into the cloud based services. If you are really worried about it, do you really need to use a cloud based password service? Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up ov…

I absolutely agree. I love KeePass and use it for everything... this LastPass account was setup to share passwords with others at an org that I worked at. The problem is... that LastPass password, the one stored in KeePass, is presumably the one that was leaked. Which is what is spooking me -- if someone has access to my entire KeePass file, it's game over.

Yeah, hard to say. I don’t think it means it’s ‘game over’ though. I think it just means you might need to go through the tedious process of walking through your whole DB file and update every password. And generate a new key file. Then and only then will you have peace of mind I think. Good luck!

Re: Ask HN: How did my LastPass master password get leaked?

#463

Post by verifex » Tue, Dec 28, 2021, 9:16 PM UTC

nemacol wrote: post #407

Which password manager do you folks use?

Keepass + Cloud File Storage + Keepass plugins = about the same thing as Lastpass except you have more control; This could be a positive or negative thing I suppose though. :D

Re: Ask HN: How did my LastPass master password get leaked?

#464

Post by 40four » Tue, Dec 28, 2021, 9:20 PM UTC

gregsadetsky wrote: post #62

40four wrote: post #27

Earlier quoted context omitted.

Personally I just stick to local Keepass database files. I’ve never ventured into the cloud based services. If you are really worried about it, do you really need to use a cloud based password service? Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up ov…

I absolutely agree. I love KeePass and use it for everything... this LastPass account was setup to share passwords with others at an org that I worked at. The problem is... that LastPass password, the one stored in KeePass, is presumably the one that was leaked. Which is what is spooking me -- if someone has access to my entire KeePass file, it's game over.

Wow, you were ahead of the curve here @gregsadetsky! Looks like real news articles are coming out about this now! https://news.ycombinator.com/item?id=29716715

Re: Ask HN: How did my LastPass master password get leaked?

#465

Post by trajcek » Tue, Dec 28, 2021, 9:24 PM UTC

drakonka wrote: post #418

This article claims LastPass has responded to their request for comment: https://www.howtogeek.com/776450/lastpass-says-it-didnt-leak ... "LastPass investigated recent reports of blocked login attempts and determined the activity is related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained fro…

My master password was specifically for LastPass and it's a quite complex non-English language non-dictionary variant. There is no way that it's due to another breach or that it's a dictionary attack.

Re: Ask HN: How did my LastPass master password get leaked?

#466

Post by gregsadetsky » Tue, Dec 28, 2021, 9:26 PM UTC

40four wrote: post #464

gregsadetsky wrote: post #62

Earlier quoted context omitted.

I absolutely agree. I love KeePass and use it for everything... this LastPass account was setup to share passwords with others at an org that I worked at. The problem is... that LastPass password, the one stored in KeePass, is presumably the one that was leaked. Which is what is spooking me -- if someone has access to my entire KeePass file, it's game over.

Wow, you were ahead of the curve here @gregsadetsky! Looks like real news articles are coming out about this now! https://news.ycombinator.com/item?id=29716715

I feel like the proverbial canary in the mine. Well, a dead canary...

Re: Ask HN: How did my LastPass master password get leaked?

#467

Post by varjolintu » Tue, Dec 28, 2021, 9:31 PM UTC

This is quite interesting. The first thing that comes to my mind is the clipboard sniffing. Copy/paste should be never used for passwords. Using it for master password is even more dangerous if you are using a cloud based password manager. KeePass(XC) has Auto-Type after all.

I also wonder if these cases with 1Password and Bitwarden are related: https://old.reddit.com/r/1Password/comments/rimvc8/constantl... https://old.reddit.com/r/Bitwarden/comments/rmp1c4/what_is_t...