Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#191

Post by beaunative »

gkoberger wrote: post #159
ComputerGuru wrote: post #43

Earlier quoted context omitted.

There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…

Clearly we both agree it's an insecure practice, since you felt it needed a warning. Now that you know there's an official LastPass importer for 1Password, I'm curious why you're defending your version rather than updating your blog post, unlinking your original HN comment and deprecating the GitHub repo. I believe you're genuine and just trying to help. If there's an attack, it wouldn't be you doing it – it'd be som…

cut them a break. no body's gonna to update a 2017 blog post irl, and last I checked a majority of the bloggers just use Wordpress, not exactly their problem.

Re: Ask HN: How did my LastPass master password get leaked?

#192

Post by [deleted] »

briffle wrote: post #95
davidstoker wrote: post #28

Earlier quoted context omitted.

Of note, LastPass just announced that they are splitting out of LogMeIn and becoming independent again: https://blog.lastpass.com/2021/12/lastpass-investing-even-mo...

Of course, you must reduce the risk to the parent company before the huge disclosure comes out

[deleted]

Re: Ask HN: How did my LastPass master password get leaked?

#193

Post by colejohnson66 »

Godel_unicode wrote: post #88
gregsadetsky wrote: post #74

Earlier quoted context omitted.

I also saw that very weird thing -- Brazil vs AFRINIC. Help/insight from ASN? BGP? networking experts would be appreciated..! Thanks a lot

That IP is present in a cn record for visit[.]keznews[.]com, whose whois record lists an admin contact in CZ. Be very wary of geo-ip results, on the modern internet they are effectively useless.

Ignoring VPNs, why are they useless?

Re: Ask HN: How did my LastPass master password get leaked?

#194

Post by trajcek »

Just happened to me one hour ago and got scared shitless.

  Time Monday, December 27, 2021 at 3:50 PM EST
  Location UNITED STATES
  IP address 107.173.195.83
Actions taken, in this order:

  - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far)
  - Disable Lastpass MFA and use Google Authenticator (Authy)
  - *Account Settings* -> click on *Show Advanced Settings* -> *Destroy Sessions* (to see if anyone is actively logged in)
  - *Account Settings* -> click on *Show Advanced Settings* -> *Country Restriction* to my country only (luckily not in the US as the bot was)
  - Change Master Password
Also moments earlier:

  - Investigating all Mac processes
  - Disabled all Chrome extensions and deleted most (should have made a list)
Let's hope it's not as bad as it seems.

Edit#1 | Following IP addresses are reported in the thread so far:

  160.116.88.235
  160.116.231.145
  160.116.88.235
  107.173.195.83
  107.173.195.213
  154.202.117.78
  196.19.204.79

Re: Ask HN: How did my LastPass master password get leaked?

#196

Post by hotpotamus »

ahelwer wrote: post #99
CryptoBanker wrote: post #52

This just happened to me today, but login location was Bangkok. I also haven’t used my lastpass account in almost 2 years since I switched to Bitwarden, so no way this could have stolen from my computer recently

I too moved to bitwarden a year or so ago. Kept my lastpass account around just in case. This post inspired me to finally delete it for good.

Exact same here. Made the jump around a year ago and this post made me realize the lastpass was still a liability so just deleted it.

Re: Ask HN: How did my LastPass master password get leaked?

#197

Post by gxqoz »

gregsadetsky wrote: post #51
anotheryou wrote: post #42

Does lastpass have a login history? first thing would be to check if the mail is genuine

Completely agree. I did check and my Account History is showing the same info. I also talked to their support and they confirmed this info.

Where is LastPass's account history?

Re: Ask HN: How did my LastPass master password get leaked?

#198

Post by balls187 »

ComputerGuru wrote: post #43
gkoberger wrote: post #22

Earlier quoted context omitted.

There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/

There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…

> There was no 1Password to LastPass importer at the time I wrote that

The details were hazy, but in 2016, there was a way to export your passwords from LastPass and import them into 1Password, though I don't think there was a way to do so on windows (which I believe is what your importer addresses).

After LastPass vulnerability in July 2016, I switched to 1Password.

Re: Ask HN: How did my LastPass master password get leaked?

#199

Post by gregsadetsky »

trajcek wrote: post #194

Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…

You received a "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email?

And your master password was secure/not used anywhere else, etc.?

Did we all (that's 8 of us now in the thread) get compromised a few years ago (using the LastPass extension?) and someone just mass attempted to try all of those passwords..?

Edit: since you're tracking IPs found in this thread (thanks!) my attacker's was 160.116.189.21 . You also have 1 ip duplicated (160.116.88.235) which was from the same user both times. You can also add 160.116.95.249 which was just posted

Re: Ask HN: How did my LastPass master password get leaked?

#200

Post by lucb1e »

jackson1442 wrote: post #174
shnock wrote: post #157

Earlier quoted context omitted.

Personally I combine a hash of something site-specific, eg. name, purpose etc and a base alphanumeric string. Allows each account have their own specific credentials while not being overly burdensome to remember.

What do you do for sites with strange password requirements, like 12 character max or requiring you to use a very specific set of special characters? I used to do what you described but my base password was rejected by far too many sites because of absurd (and insecure) requirements.

> requiring you to use a very specific set of special characters?

Stupid requirements don't matter. If you have a secure password, e.g. a passphrase consisting of 7 random words (diceware) and the service complains that you're missing digits, uppercase, and symbols, then adding A0! to the passphrase does not make it less secure. Appending anything never makes it less secure. You can also write down in plain text and store on pastebin what you added per site because it's not part of the secret anyway. (Okay okay, might as well keep it private rather than pastebin; it's about the general point.)

> like 12 character max

This is not that common anymore, most services have reasonable limits. If you do run into one and it's too important not to use, then you don't have a choice anyway: you'll have to make an exception to the scheme and memorize or store an actual password for once. Doesn't mean you have to design all your other passwords for one exceptional case.

Post reply on HN