I've been getting lastpass 2fa codes via text sent to me before and after changing master passwords lately. However I don't get the authenticator notification like I would from a login attempt so I'm thinking they're attempting password resets?
Ask HN: How did my LastPass master password get leaked?
171–180 of 529 posts
Re: Ask HN: How did my LastPass master password get leaked?
#172My girlfriend once asked me why I don't use a password manager like LastPass. A week later she got locked out of her LastPass account because she was inadvertently using an enterprise account that one of her clients forced her to use while on a project. And even though she was paying for her own premium LastPass subscription, the support experience had was terrible. Issue was resolved when the client was able to unlo…
This is like saying that you should never store anything on a computer because you know someone who got locked out of their work laptop with important documents on it after they were let go.
The real lesson here is to never put anything sensitive or personal on corporate devices/services.
Re: Ask HN: How did my LastPass master password get leaked?
#173Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235
Mine was from India, master password definetly unique and very strong. I'm still hoping for some bug that mass alerted every day login attempts instead of actually gaining access.
Re: Ask HN: How did my LastPass master password get leaked?
#174Earlier quoted context omitted.
So what do you do to remember passwords? Do you write them down on paper, or maybe save in browser? I'm curious, I've pondered writing down my pivotal passwords on paper and hiding in a book or something.
Personally I combine a hash of something site-specific, eg. name, purpose etc and a base alphanumeric string. Allows each account have their own specific credentials while not being overly burdensome to remember.
What do you do for sites with strange password requirements, like 12 character max or requiring you to use a very specific set of special characters?
I used to do what you described but my base password was rejected by far too many sites because of absurd (and insecure) requirements.
Re: Ask HN: How did my LastPass master password get leaked?
#175Earlier quoted context omitted.
I absolutely agree. I love KeePass and use it for everything... this LastPass account was setup to share passwords with others at an org that I worked at. The problem is... that LastPass password, the one stored in KeePass, is presumably the one that was leaked. Which is what is spooking me -- if someone has access to my entire KeePass file, it's game over.
So...when you say "...was setup to share passwords with others..." is there a chance that this also means the master password was shared with one or more others?
Sorry, no, that was a confusing way of phrasing it.
The LastPass account that was almost-breached today uses the "password sharing" functionality to share passwords (to certain sites) with other people in the same org.
I was just explaining that the only reason why I have a LastPass account was to share passwords. (not the master password, obviously -- I was sharing passwords to other sites)
I typically use KeePass for all of my (site) passwords and keepass stores all of this in a local encrypted file.
Re: Ask HN: How did my LastPass master password get leaked?
#176Yeah me too. Same IP range too, but location listed as Toronto. Not that this means anything.
More data (mine as well):
Monday, December 27, 2021 at 12:27 PM EST
Location INDIA
IP address 196.19.204.79
Re: Ask HN: How did my LastPass master password get leaked?
#177This just happened to me today, but login location was Bangkok. I also haven’t used my lastpass account in almost 2 years since I switched to Bitwarden, so no way this could have stolen from my computer recently
Same thing for me, havent used my account for years, has strong password and I just got an email that someone from Paris tried to login but was blocked.
!!! This makes 6 of us in this thread...
It's improbable that we were all phished years ago by the same group...
Was the LastPass extension hacked years ago (as mentioned in https://news.ycombinator.com/item?id=29707325 ) and all of our master passwords were leaked/stolen, and someone just attempted to use them?
Re: Ask HN: How did my LastPass master password get leaked?
#178Because LastPass is beyond stupid and uses your master password to log in to their bbulletin or whatever php forum. That’s what got me to write and publish this: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-... EDIT: "or whatever" means I couldn't remember the name of the php forum notorious for its insecurity, I thought it was something like 'bbulletin'. It was phpBB.
Is there an official counter for phpBB RCEs/vulnerabilities that revealed user passwords? This has been going on for decades now. It's getting ridiculous.
Welcome to frameworkless PHP where code & user files are stored in the same root and any PHP file requested by a web client is executed by the server.
In most proper frameworks, including PHP ones, the only thing responding to web requests is an entrypoint file (that gets passed the request metadata including URL) and the framework takes it from there. This means that with proper configuration, even requesting a malicious PHP file shouldn't actually execute it and instead hit the framework which will promptly respond with a 404 (of course, with PHP the danger is that in case of misconfiguration the server may still prioritize an exact path match and execute the file rather than defaulting to executing the framework's entrypoint, where as other languages typically don't rely on the webserver to execute the files and couldn't run a malicious file even if they tried).
But these stupid legacy applications are still around and haven't been updated to fix this design flaw, so any flaw in sanitizing uploaded files turns into a persistent RCE. I'm sure some people will pitch in and say this isn't a design flaw and you're using it wrong, and while I agree that it can probably be made secure with enough effort, why leave such a loaded footgun around when this is essentially a solved problem in all other languages?
In other languages a malicious file being uploaded to the web root will at best result in a stored XSS which can be further mitigated by having your file uploads on a separate domain, but in PHP it's fatal.
Re: Ask HN: How did my LastPass master password get leaked?
#179Another data point, same deal. Time Monday, December 27, 2021 at 1:29 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.231.145 Went ahead and deleted my Lastpass account and changed my password in other password managers.
Holy moly!!!
Were you using LastPass around 2017? One theory that's floating is that we were all owned by a compromised LastPass extension 4-5 years ago.
Just trying to find some common thread among all of us (a thread that's different than "lastpass was owned" which presumably should be more improbable...)
Re: Ask HN: How did my LastPass master password get leaked?
#180I've been getting lastpass 2fa codes via text sent to me before and after changing master passwords lately. However I don't get the authenticator notification like I would from a login attempt so I'm thinking they're attempting password resets?
Maybe,
but man I'm soo feed up with services requiring SMS at least for setup often as a non-disabelable fallback. It's not secure! (And worse sometimes allowing password resets using the 2nd factor.)
I understand that there is a usability issue for a non-resetable 2nd factor (due to people losing reset 2nd factor), but pls. give me and "advanced I know what I'm doing" option or similar.