I'm guessing that the email actually was a phishing attempt, and no-one actually has your LastPass master password.
Other poster above says support confirmed the master pass was used
Ask HN: How did my LastPass master password get leaked?
241–250 of 529 posts
Re: Ask HN: How did my LastPass master password get leaked?
#242Earlier quoted context omitted.
Same here, I use KeePass on several Windows machines, and on a couple of Android phones (using KeePass2Android). I use a cheap VPS as a central point for syncing - so I can make changes on any machine, then sync them over SFTP, which merges the changes into the database on the VPS. I can then hit sync on any of the other machines, and it will pull down the latest database over SFTP and merge in the changes. It sounds…
why not just use dropbox? and secure dropbox using 2FA? FWIW, I used to run nextcloud on a ec2 instance. Decided to just use dropbox instead. the webdav support on nextcloud was neat with keepass
I have the VPS for others things anyway, and I don't use Dropbox.
Re: Ask HN: How did my LastPass master password get leaked?
#243Earlier quoted context omitted.
> I have no idea why anyone would use a hosted solution like LastPass. Convenience. I use Bitwarden. I get a lot of value from having my passwords synced across multiple PCs and my phone.
1Password allows you to use a local vault, encrypted with a master password, that can be synced across devices in multiple ways, for instance using Dropbox. There's no web logins going, no 'someone elses database' accessed over the web. I have used this solution for a number of years, and would _never_ go for a cloud option like lastpass, for important personal data.
I see no big diff actually. It offers you no more security if you're directly compromised. It also doesn't help much in reducing the risk of the 3rd party services being hacked, as your data still travels through someone else's cloud. The one attack you avoid by it is LastPass being hacked and your encrypted vault stolen - but then you also open up yourself for Dropbox being hacked and your data stolen attack (which also makes for pretty big attack surface with its automatic sync on all machines). In both cases the attacker gets the encrypted vault, so having a good master password is a smart move.
One should really stay away from storing the vault on any permanent online storage, and do the one-time sync using temporary file-transfer services or even better some private peer-to-peer transfer method - but then you loose a lot of convenience of tools like LastPass or 1Password over the Dropbox. And in security everything is in picking the right balance between safety and convenience for you personally.
Re: Ask HN: How did my LastPass master password get leaked?
#244Earlier quoted context omitted.
Can you please post more information? Was this an old LastPass account? You didn't use this master password elsewhere, etc.? Thanks!
Old LastPass account with a random string as the password, definitely not used anywhere else
And you received the same "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email?
Someone is tracking IP addresses now in the thread -- would you mind sharing what was your attacker's IP?
Re: Ask HN: How did my LastPass master password get leaked?
#245Earlier quoted context omitted.
That IP is present in a cn record for visit[.]keznews[.]com, whose whois record lists an admin contact in CZ. Be very wary of geo-ip results, on the modern internet they are effectively useless.
Ignoring VPNs, why are they useless?
Why ignore VPNs? Im sure someone else can chime in but to my knowledge that's what makes them useless. You can't be sure someone isn't running VPN, then you can never be certain GeoIP is correct, thus it's useless.
Re: Ask HN: How did my LastPass master password get leaked?
#246I doubt this is your situation, but about 10 years ago, I discovered a person’s 1Password database on a bookmark sharing service, and it was using a very poorly chosen password. My recollection is that it was a large text file containing Javascript code at the beginning and the encrypted text database at the end. The person must ha inadverantly saved it as part of arching their desktop files to the service.
Re: Ask HN: How did my LastPass master password get leaked?
#247This also happened to me back on Nov 10, 2021. I had an old LastPass account, wasn't using it, when all of a sudden i get an email: -- Login attempt blocked Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. --- Like you, it told me that the attempt came from Brazil, using an IP…
What, really?? This is too crazy of a coincidence to be a coincidence. This is exactly what's happening to me, and same IP prefix. What does it mean? --- How old of account was this? Can you contact me by email (email in my profile)? --- Two theories: - there is a problem with LastPass - you and I both had the same Chrome extension installed that was actually compromised, and that extension was listening to/sending p…
I just tried logging into my LassPass (not used for a while) and I entered the password wrongly (I capitalised one letter) and got an email "Someone just used your master password to try to log in to your account from a device or location we didn't recognize."
Maybe it says someone used your master password even if they didn't? It gave the IP as Islington which is kind of correct.
Re: Ask HN: How did my LastPass master password get leaked?
#248This just happened to me today, but login location was Bangkok. I also haven’t used my lastpass account in almost 2 years since I switched to Bitwarden, so no way this could have stolen from my computer recently
Same thing for me, havent used my account for years, has strong password and I just got an email that someone from Paris tried to login but was blocked.
Same thing for me as well.
Re: Ask HN: How did my LastPass master password get leaked?
#249Earlier quoted context omitted.
Ignoring VPNs, why are they useless?
Why ignore VPNs? Im sure someone else can chime in but to my knowledge that's what makes them useless. You can't be sure someone isn't running VPN, then you can never be certain GeoIP is correct, thus it's useless.
Because everyone knows that VPN IPs’ geoloc is useless, so I assumed that those were being ignored. Also because it’s possible to see if an IP is (possibly) a VPN one by looking up the owner.
Re: Ask HN: How did my LastPass master password get leaked?
#250Given we’re likely stuck with passwords for the foreseeable future, I’d like to see two things in a password manager (maybe these exist?) 1. “hardware wallet” level security, with good UX. Maybe a USB/Lightning dongle, but I really wish computers/phones had built-in capability to do hardware wallets. Apple TouchBar got close (I realize it wouldn’t considered be a dedicated hardware wallet). 2. a way to automatically…
> “hardware wallet” level security
This is mutually exclusive with passwords:
A hardware wallet never reveals its private key and allows you to review and approve private key operations through a well-defined and hardened interface. Passwords are bearer tokens, and there is no such option.