231–240 of 529 posts
I stopped using Lastpass in 2017 after the second breach that year that allowed remote code execution: https://en.wikipedia.org/wiki/LastPass#2017_security_inciden... It wasn't so much that that happened, but rather their response: https://blog.lastpass.com/2017/03/important-security-updates... - "Our investigation to date has not indicated that any sensitive user data was lost or compromised" - "No master password c…
Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…
- Disable Lastpass MFA and use Google Authenticator (Authy) could you please explain this point? Isn't LastPass Authenticator equivalent to Google Authenticator, Authy or any other TOTP app? Or is there something that makes it less secure than other apps? Perhaps because it has cloud backups?
I contacted their support to check if it’s gone for good, waiting for a reply. Lesson learned, don’t forget to delete password vaults not in use.
account had 2FA set up, but I was able to simply remove it (since I didn't have access to the token anymore)
I rarely say “amazing”, but this is the time.
Earlier quoted context omitted.
Couldn't it just be that someone got a copy of the password some years ago and now sold the list of credentials to someone else, who then tried to use it? Maybe the original owner of the list didn't realize some of the credentials was for LastPass, for example. I'm still seeing hackers trying to log on using passwords I haven't used in ~10 years, because it's on a list somewhere.
I agree, that could make sense. So LastPass (their extension) may have been hacked ~5 years ago ish, a few people here on the thread were all hacked in the same way, our passwords were sold off, and now the same Brazil IP range just tried all of those passwords.
Earlier quoted context omitted.
Very interesting theory! What's a bit surprising is how "low effort" the rest of the attack was: presumably if they found this flaw to bypass passwords, they then attempted to login (which caused an email to be sent out), but LastPass stopped them because they (i.e. the folks on the Brazil IP range) were logging in from a new IP. So this would be a case of one protective layer (the new IP detection) compensating for…
Another possibility is that one of their (many) previous security incidents led to the leaking / exposure of master password hashes, and maybe LastPass don't treat the password hashes as they should (as a password!) and didn't take steps to ensure that any compromise hashes couldn't be re-used. So, potentially, your master password is safe, but there's a hash of it floating around. Personally, I've long recommended p…
I wonder if haveibeenpwned.com would somehow have information about this. I just pinged them on twitter.
This just happened to me today, but login location was Bangkok. I also haven’t used my lastpass account in almost 2 years since I switched to Bitwarden, so no way this could have stolen from my computer recently
Can you please post more information? Was this an old LastPass account? You didn't use this master password elsewhere, etc.? Thanks!
Earlier quoted context omitted.
There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…
> There was no 1Password to LastPass importer at the time I wrote that The details were hazy, but in 2016, there was a way to export your passwords from LastPass and import them into 1Password, though I don't think there was a way to do so on windows (which I believe is what your importer addresses). After LastPass vulnerability in July 2016, I switched to 1Password.
Earlier quoted context omitted.
I don’t use Lastpass, but if what you are saying is correct, they could not have sent the OP an e-mail (assuming it’s legit) informing them of the attempt to sign in using the master pass from Brazil, right?
Cryptography means lastpass doesn't need the master password to verify the password.
It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.
Earlier quoted context omitted.
Just because you put a warning label on a bad practice doesn't mean it's a good practice. Pumping your passwords through some random code on Github that has a "be smart" label doesn't make it a good idea. Would be so easy to imitate you, reupload the code with an exploit. For giggles, if I was making this into a hijack I'd leave all your warnings in and even make them bigger and more obvious, confident in the knowled…
> Just because you put a warning label on a bad practice doesn't mean it's a good practice. That is such a salient point, generally.