Ask HN: How did my LastPass master password get leaked? • Hacker News Board

Re: Ask HN: How did my LastPass master password get leaked?

#301

Post by [deleted] » Tue, Dec 28, 2021, 1:40 AM UTC

mehphp wrote: post #297

shrimp_emoji wrote: post #275

Here's what happened when I tried deleting my LastPass account: https://i.imgur.com/QazTVTD.png

Same

[deleted]

Re: Ask HN: How did my LastPass master password get leaked?

#302

Post by coayer » Tue, Dec 28, 2021, 1:45 AM UTC

shrimp_emoji wrote: post #275

Here's what happened when I tried deleting my LastPass account: https://i.imgur.com/QazTVTD.png

Same here. However, trying to log in again fails with a "you may have mistyped the email address" so it seems to have worked.

Re: Ask HN: How did my LastPass master password get leaked?

#303

Post by gregsadetsky » Tue, Dec 28, 2021, 1:51 AM UTC

chubs wrote: post #299

Just tried to delete my lastpass account and get the following message: "Something went wrong. : A" Not very confidence-building. Anyone know how to work around this? Also: Went to https://support.logmeininc.com/lastpass/help/delete-your-las... and it doesn't actually tell you how to delete the account, just tells you how to recover your password. Methinks this is all a dark pattern.

There are multiple independent reports here of that error happening as well!

See: https://news.ycombinator.com/item?id=29708961

One commenter noted that it wasn't possible to login again (after that error happened), so presumably the account was deleted...?

Re: Ask HN: How did my LastPass master password get leaked?

#304

Post by Havoc » Tue, Dec 28, 2021, 1:53 AM UTC

shmoogy wrote: post #285

Changed mine just incase. I don't use it anymore I think everything in it is obsolete but always nervous something old is still active in it and I would lock myself out.

Remember to change the setting that lets you revert it to previous too ;)

Re: Ask HN: How did my LastPass master password get leaked?

#305

Post by notemaker » Tue, Dec 28, 2021, 1:56 AM UTC

shrimp_emoji wrote: post #275

Here's what happened when I tried deleting my LastPass account: https://i.imgur.com/QazTVTD.png

Same. Looks like the deletion went through tho - can't log in anymore. Knock on wood.

Re: Ask HN: How did my LastPass master password get leaked?

#306

Post by gravelc » Tue, Dec 28, 2021, 1:58 AM UTC

Trying to delete my old inactive account and it keeps throwing a meaningless error: "Something went wrong. : A". Wish I'd been more sensible and done it earlier.

Re: Ask HN: How did my LastPass master password get leaked?

#307

Post by 4d66ba06 » Tue, Dec 28, 2021, 2:01 AM UTC

wruza wrote: post #233

I didn’t receive any emails (usually they send them do when logging in from non-recent locations). I have 2FA turned on via Google Authenticator, also not used LastPass for a year or so. When I tried to delete my account, guess what “Something went wrong: A.”. Was unable to login again, but I was able to re-register and see empty vault, then delete it again with the same error message. I contacted their support to ch…

Also getting that same error trying to delete my old unused Lastpass account :(

Re: Ask HN: How did my LastPass master password get leaked?

#308

Post by coayer » Tue, Dec 28, 2021, 2:02 AM UTC

gravelc wrote: post #306

Trying to delete my old inactive account and it keeps throwing a meaningless error: "Something went wrong. : A". Wish I'd been more sensible and done it earlier.

Try logging in on Lastpass.com. I got the same error but it says the email is wrong (seems like the account is deleted)

Re: Ask HN: How did my LastPass master password get leaked?

#309

Post by Proven » Tue, Dec 28, 2021, 2:03 AM UTC

replete wrote: post #278

ivanhoe wrote: post #243

Earlier quoted context omitted.

I see no big diff actually. It offers you no more security if you're directly compromised. It also doesn't help much in reducing the risk of the 3rd party services being hacked, as your data still travels through someone else's cloud. The one attack you avoid by it is LastPass being hacked and your encrypted vault stolen - but then you also open up yourself for Dropbox being hacked and your data stolen attack (which…

There is a fairly big difference, you are decrypting a local file using a master password NOT stored on the internet. No data is going over the wire, no 'other peoples computers'. Even if someone got your vault file, with a _very strong_ master password it's just not going to get brute forced any time soon. [1] With an online-only solution you have no idea how they are storing your data. I think 1p local vault (only)…

No post body was provided.

Re: Ask HN: How did my LastPass master password get leaked?

#310

Post by mellowagain » Tue, Dec 28, 2021, 2:08 AM UTC

This has nothing to do with OP's problem but I figured this may be a good place to post about my bad experience with LastPass back in 2019:

When I moved to Bitwarden, I have deleted my account on LastPass. I have received a confirmation email regarding my account which states [0]:

> Your LastPass account has been permanently deleted and all of your data has been purged from our systems.

A few months later I receive a email stating that my premium subscription is expiring [1]. Clearely my account was not actually permanently deleted from their systems. Considering LastPass is a service used for storing passwords, I think this is unacceptable. How am I sure that they also still don't have my passwords that I had saved in their account?

I reached out to them via Twitter when this happened (because that is apparently how you get support in this day of age) and only then I was told that my account was actually deleted. I still have no way of verifying if this is in fact true or not.

[0]: https://i.imgur.com/P5yEqEl.png [1]: https://i.imgur.com/WyEueF6.png