11–20 of 529 posts
My bet would be on malware or compromised browser extension. You probably typed (or copy/pasted) the password ans something kept a copy along the way.
Compromised browser extension could make sense, aye. Do Chrome extensions have access to the file system too? Is there a chance my local KeePassX file has been siphoned off? Thanks
Since your master password is stored in another password manager, would it be accurate to say you copy/paste it into LastPass? If so, something running on your machine could be scraping your clipboard. This of course assumes that it wasn’t really you from an IP that was just misidentified as being from Brazil. For what it’s worth, I stopped using LastPass after they sold out to LogMeIn and would recommend others stop…
Yes, I do copy/paste from my local password manager. A clipboard scraper is a possibility, yes. I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier. Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks
The other possibility that comes to mind is a man in the middle attack of your password was ever sent over the wire with zero or weak encryption, when someone was snooping, like on coffee shop wifi or even a nosy neighbor on your home wifi.
Without knowing anything about LastPass, a few ideas come to mind. First, is your master password only something that exists in your head? Or is it written down anywhere else either digitally or physically. If so, someone may have gained access to that. Did you use the same password anywhere else, ever? If so, it could have been in a database of possible passwords that someone used to try to brute force a copy of you…
The specific password was computer generated, and I have not used it anywhere else i.e. it was only created for this LastPass account.
That's why this (probably) either means that my local password manager has been compromised (catastropic if true) or that the info I received from LastPass is not completely accurate..?
Earlier quoted context omitted.
Compromised browser extension could make sense, aye. Do Chrome extensions have access to the file system too? Is there a chance my local KeePassX file has been siphoned off? Thanks
I don't think that's possible, more likely an extension that has access to the login form of lastpass
Because LastPass is beyond stupid and uses your master password to log in to their bbulletin or whatever php forum. That’s what got me to write and publish this: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-... EDIT: "or whatever" means I couldn't remember the name of the php forum notorious for its insecurity, I thought it was something like 'bbulletin'. It was phpBB.
Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presumably it's not stored on their side. Is that accurate..? Thanks
Because LastPass is beyond stupid and uses your master password to log in to their bbulletin or whatever php forum. That’s what got me to write and publish this: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-... EDIT: "or whatever" means I couldn't remember the name of the php forum notorious for its insecurity, I thought it was something like 'bbulletin'. It was phpBB.
Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presumably it's not stored on their side. Is that accurate..? Thanks
Since your master password is stored in another password manager, would it be accurate to say you copy/paste it into LastPass? If so, something running on your machine could be scraping your clipboard. This of course assumes that it wasn’t really you from an IP that was just misidentified as being from Brazil. For what it’s worth, I stopped using LastPass after they sold out to LogMeIn and would recommend others stop…
Why do you recommend others to stop using LastPass?
Since your master password is stored in another password manager, would it be accurate to say you copy/paste it into LastPass? If so, something running on your machine could be scraping your clipboard. This of course assumes that it wasn’t really you from an IP that was just misidentified as being from Brazil. For what it’s worth, I stopped using LastPass after they sold out to LogMeIn and would recommend others stop…
Yes, I do copy/paste from my local password manager. A clipboard scraper is a possibility, yes. I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier. Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks