Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

321–330 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#321

Post by jeppesen-io »

studiecomput wrote: post #10
RKearney wrote: post #4

Since your master password is stored in another password manager, would it be accurate to say you copy/paste it into LastPass? If so, something running on your machine could be scraping your clipboard. This of course assumes that it wasn’t really you from an IP that was just misidentified as being from Brazil. For what it’s worth, I stopped using LastPass after they sold out to LogMeIn and would recommend others stop…

Why do you recommend others to stop using LastPass?

I just switched last night for unrelated reasons

1. BW supports inline Android 11 password fill. I find the UX much better with this feature

2. LP is a bit buggy, particularly on Android

3. LP is slow to add new features

4. I didn't expect this, but I really enjoyed BW's UI

5. On Android, I enjoy the three quick launch buttons they provide

6. LP creates new logins in folders of it's choosing by default. Not a fan

But in general, BW it just "works" better/faster for me

Re: Ask HN: How did my LastPass master password get leaked?

#322

Post by donedeals »

gregsadetsky wrote: post #211
donedeals wrote: post #190

Got the same but from NJ.

Did your email say "Someone just used your master password to try to log in to your account from a device or location we didn't recognize"? Just making sure we're all concerned with the same issue Thanks!

Yup. Exactly that text.

Re: Ask HN: How did my LastPass master password get leaked?

#323

Post by purplesnowflake »

charcircuit wrote: post #318
mellowagain wrote: post #310

This has nothing to do with OP's problem but I figured this may be a good place to post about my bad experience with LastPass back in 2019: When I moved to Bitwarden, I have deleted my account on LastPass. I have received a confirmation email regarding my account which states [0]: > Your LastPass account has been permanently deleted and all of your data has been purged from our systems. A few months later I receive a…

It's very possible the billing system is separate from everything else.

It's most likely generated via Stripe (or some equivalent). And even though the account and associated information has been deleted from the Lastpass servers, they didn't delete it from all their vendors, forgetting that those vendors might send the end-user an email. A classic PM move, de-prioritizing any feature related to a churned user...

Re: Ask HN: How did my LastPass master password get leaked?

#326

Post by learner007 »

some potential areas to consider

- used a VPN service that was malicious - router is compromised - someone near you was running a MITM device like Stingray (assuming you were using a mobile device away from home) - mobile device had unpatched OS (exploit gains root access via something like binary sms) - your desktop / laptop is compromised

Re: Ask HN: How did my LastPass master password get leaked?

#328

Post by sillysaurusx »

Fnoord wrote: post #284
sillysaurusx wrote: post #102

Earlier quoted context omitted.

Hmm. So I don't know if this means anything, but I was googling for the IP address and wound up at https://ipinfo.io/160.116.88.235 which says hostname: visit.keznews.com. When you go to that hostname, it's one of the best phishing sites I've ever seen. They dynamically inserted my ISP's logo (Spectrum) and tried to do a phishing attempt: https://i.imgur.com/C9HQw1c.png The full non-clickable URL: https://us.poonstat…

Great post, seriously. How many extensions are you using again? :-)

Hmm. Tabist, Twitch Now, EditThisCookie, TooManyTabs, ublock, adblock, tampermonkey, disable Reddit CSS, FreshStart, Notion, Netflix auto-skip, gist from website, Auto Kill Sticky... and a couple I don’t recognize. I’ll post a full list when I’m back at a laptop.

“Too many” :)

Re: Ask HN: How did my LastPass master password get leaked?

#329

Post by kevinslashslash »

gregsadetsky wrote: post #179
bombita wrote: post #160

Another data point, same deal. Time Monday, December 27, 2021 at 1:29 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.231.145 Went ahead and deleted my Lastpass account and changed my password in other password managers.

Holy moly!!! Were you using LastPass around 2017? One theory that's floating is that we were all owned by a compromised LastPass extension 4-5 years ago. Just trying to find some common thread among all of us (a thread that's different than "lastpass was owned" which presumably should be more improbable...)

I got the "Someone just used your master password" email too

Time Monday, December 27, 2021 at 3:05 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.190.69

I haven't used LastPass since 2016 or 2017.

Re: Ask HN: How did my LastPass master password get leaked?

#330

Post by haberman »

claudiojulio wrote: post #106

Please stop using this service. Use reliable, open source and auditable services. https://www.privacyguides.org/software/passwords/

This page does not provide any information why the recommended solutions (Bitwarden, KeePassXC) are more secure than the products it warns against (1Password, LastPass, Roboform, and iCloud Keychain).
Post reply on HN