Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#111

Post by sillysaurusx »

gregsadetsky wrote: post #97
techknight wrote: post #89

Earlier quoted context omitted.

LastPass was my first thought, but I couldn't find anyone else having the same issue and decided it couldn't possibly be them. Now I'm not sure! I've emailed you a list of the extensions I use in Chrome - if you want to share publicly any that we have in common I'm okay with that

Hey, thanks -- just replied to your email. Since I haven't used this LastPass master password since 2017, I'd have to remember which extensions I had back then, which is hard to do... I may have had 1Password and Adblock Plus which you had/have too. But it's hard to say. It's a possible vector (that you, dogman123 and I had the same compromised extensions) but also... why would the hackers have sat on our master pass…

One other breadcrumb: https://news.ycombinator.com/item?id=29706957

It's looking like you got phished a long time ago, or installed malware which targeted the lastpass extension.

Did all of you use the same OS four years ago? (Windows perhaps?) Some malware targets Chrome/Firefox files on disk. A malicious extension probably wouldn't be able to affect your LastPass extension, but a malicious malware app could easily modify it.

Re: Ask HN: How did my LastPass master password get leaked?

#112

Post by runlevel1 »

fragmede wrote: post #68
gregsadetsky wrote: post #8

Earlier quoted context omitted.

Yes, I do copy/paste from my local password manager. A clipboard scraper is a possibility, yes. I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier. Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks

1Password has a cloud-based option these days, for better or worse.

And soon they'll _only_ have a cloud-based option with no option for local-only vaults.

https://1password.community/discussion/comment/602340/#:~:te...

Re: Ask HN: How did my LastPass master password get leaked?

#113

Post by gregsadetsky »

sillysaurusx wrote: post #102
dogman123 wrote: post #47

Earlier quoted context omitted.

posting another comment here too for visibility, but this _just_ happened to me as well.... Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

Hmm. So I don't know if this means anything, but I was googling for the IP address and wound up at https://ipinfo.io/160.116.88.235 which says hostname: visit.keznews.com. When you go to that hostname, it's one of the best phishing sites I've ever seen. They dynamically inserted my ISP's logo (Spectrum) and tried to do a phishing attempt: https://i.imgur.com/C9HQw1c.png The full non-clickable URL: https://us.poonstat…

Hey,

That's quite possible, for sure. I am not beyond/above/below being phished like anyone else, ha!

The issue -- what makes it perplexing -- is that I haven't used this LastPass password since 2017. I know because this LastPass account was only used to share passwords within an org that I left back then.

Is it possible that I was phished 4 years ago, and they sat on the password? Sure.

But 2 other people in this thread being phished from the same exact same phishing server/group?

Or we were separately phished using different techniques, and now one Brazil server attempted to use all of our logins?

That's what's rather strange.

Re: Ask HN: How did my LastPass master password get leaked?

#114

Post by gregsadetsky »

sillysaurusx wrote: post #111
gregsadetsky wrote: post #97

Earlier quoted context omitted.

Hey, thanks -- just replied to your email. Since I haven't used this LastPass master password since 2017, I'd have to remember which extensions I had back then, which is hard to do... I may have had 1Password and Adblock Plus which you had/have too. But it's hard to say. It's a possible vector (that you, dogman123 and I had the same compromised extensions) but also... why would the hackers have sat on our master pass…

One other breadcrumb: https://news.ycombinator.com/item?id=29706957 It's looking like you got phished a long time ago, or installed malware which targeted the lastpass extension. Did all of you use the same OS four years ago? (Windows perhaps?) Some malware targets Chrome/Firefox files on disk. A malicious extension probably wouldn't be able to affect your LastPass extension, but a malicious malware app could easily…

Yeah, all of us being phished years ago is a possibility (I just replied to your other comment)

I used macOS/Chrome back in 2017. I definitely could have been phished then, or used a compromised extension.

Re: Ask HN: How did my LastPass master password get leaked?

#115

Post by tyingq »

gregsadetsky wrote: post #15
Raed667 wrote: post #11

Earlier quoted context omitted.

I don't think that's possible, more likely an extension that has access to the login form of lastpass

Got it, thanks. And yes, you're right, after checking, Chrome extensions don't have access to local files by default. I checked all of the extensions I have (after disabling them all) and none had "file access" enabled.

Clipboard access might be possibility.

Re: Ask HN: How did my LastPass master password get leaked?

#120

Post by stavros »

cassepipe wrote: post #63

Not an answer to OP but I had seen that that on HM a while ago : https://www.lesspass.com/ Really liked the idea of not having to rely on a third-party ... But I never used it because of Firefox master password and sync functionality. Too lazy.

I switched to BitWarden from this, this works well until a site forces you to change your password (or has arbitrary password requirements), then it's basically impossible to do.
Post reply on HN