31–40 of 529 posts
Just checking the absolutely obvious, because I had a similar thing ... and then it turned out I had my VPN on. Thought I'd double check, in case someone was a silly as I am.
Since your master password is stored in another password manager, would it be accurate to say you copy/paste it into LastPass? If so, something running on your machine could be scraping your clipboard. This of course assumes that it wasn’t really you from an IP that was just misidentified as being from Brazil. For what it’s worth, I stopped using LastPass after they sold out to LogMeIn and would recommend others stop…
Why do you recommend others to stop using LastPass?
Left a really bad taste in my mouth. I wouldn't be using them at all if I didn't have to for a client.
Earlier quoted context omitted.
Yes, I do copy/paste from my local password manager. A clipboard scraper is a possibility, yes. I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier. Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks
Bitwarden is great, highly recommend, it's open-source which adds to its trustworthiness and has a good track record of respecting users.
-- Login attempt blocked Hello,
Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. ---
Like you, it told me that the attempt came from Brazil, using an IP address starting with 160. I have no idea how they would've gotten that password. Made me wonder if LastPass had some issue, but nothing was in haveibeenpwned
Earlier quoted context omitted.
Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presumably it's not stored on their side. Is that accurate..? Thanks
I don’t use Lastpass, but if what you are saying is correct, they could not have sent the OP an e-mail (assuming it’s legit) informing them of the attempt to sign in using the master pass from Brazil, right?
Earlier quoted context omitted.
Yes, I do copy/paste from my local password manager. A clipboard scraper is a possibility, yes. I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier. Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks
Personally I just stick to local Keepass database files. I’ve never ventured into the cloud based services. If you are really worried about it, do you really need to use a cloud based password service? Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up ov…
Disclaimer: I worked on the 2FA part of the saas pass password manager which never has a master password and always uses passwordless MFA like scanning an encrypted barcode for unlocking the browser extension.
This also happened to me back on Nov 10, 2021. I had an old LastPass account, wasn't using it, when all of a sudden i get an email: -- Login attempt blocked Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. --- Like you, it told me that the attempt came from Brazil, using an IP…
This is too crazy of a coincidence to be a coincidence.
This is exactly what's happening to me, and same IP prefix.
What does it mean?
---
How old of account was this? Can you contact me by email (email in my profile)?
---
Two theories:
- there is a problem with LastPass
- you and I both had the same Chrome extension installed that was actually compromised, and that extension was listening to/sending passwords typed into lastpass.com
I last used this account/master password back in 2017. Is that similar-ish to when you used your account?
Just deleted my last pass account!
here's the info that came with the email
Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235
I'd get in touch with LastPass support asap to see if they have a digital trail to help you figure out what happened. I'd also guess the most plausible situation would be malware on your computer that managed to sniff your credentials in-transit/clipboard/memory/browser/keyboard and exfiltrate it to some shady folks.
Thanks Sending emails to support@lastpass.com doesn't work ("This inbox is not monitored") and I have to upgrade my account to contact their support, which I'll do right away. EDIT: after checking, the login attempt does appear in my Account History (my original email said it didn't -- I wasn't looking in the right place)