Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

351–360 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#351

Post by politelemon »

gkoberger wrote: post #22
ComputerGuru wrote: post #7

Because LastPass is beyond stupid and uses your master password to log in to their bbulletin or whatever php forum. That’s what got me to write and publish this: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-... EDIT: "or whatever" means I couldn't remember the name of the php forum notorious for its insecurity, I thought it was something like 'bbulletin'. It was phpBB.

There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/

There's a level of irony in complaining about malicious code, and still recommending a closed source password manager.

Re: Ask HN: How did my LastPass master password get leaked?

#352

Post by jeffybefffy519 »

gregsadetsky wrote: post #303
chubs wrote: post #299

Just tried to delete my lastpass account and get the following message: "Something went wrong. : A" Not very confidence-building. Anyone know how to work around this? Also: Went to https://support.logmeininc.com/lastpass/help/delete-your-las... and it doesn't actually tell you how to delete the account, just tells you how to recover your password. Methinks this is all a dark pattern.

There are multiple independent reports here of that error happening as well! See: https://news.ycombinator.com/item?id=29708961 One commenter noted that it wasn't possible to login again (after that error happened), so presumably the account was deleted...?

Have you actually contacted lastpass about this?

Re: Ask HN: How did my LastPass master password get leaked?

#353

Post by tuwtuwtuwtuw »

jeffybefffy519 wrote: post #352
gregsadetsky wrote: post #303

Earlier quoted context omitted.

There are multiple independent reports here of that error happening as well! See: https://news.ycombinator.com/item?id=29708961 One commenter noted that it wasn't possible to login again (after that error happened), so presumably the account was deleted...?

Have you actually contacted lastpass about this?

He wrote elsewhere that he contacted them but they shrugged it off, or something like that..

Re: Ask HN: How did my LastPass master password get leaked?

#354

Post by swissfunicular »

I know this is irrelevant, but these are my two pennies. Apart from strong password and 2FA, I have restricted login only from my country. So can't login from other country, unless hacker knows which country I have set and uses that VPN. Also I have blocked login from Tor.

Re: Ask HN: How did my LastPass master password get leaked?

#355

Post by tuwtuwtuwtuw »

mulmboy wrote: post #349

Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrome extension. ``` Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Was this you? Account xxx@xxx.com Time Monday, December 27…

Maybe you could share the list of extensions you use, unless you consider it too private?

I haven't gotten any email like this myself and in my organization with 20 LP users no one else has as well it seems. I am using uBlock Origin and LastPass only.

Re: Ask HN: How did my LastPass master password get leaked?

#356

Post by wruza »

tlrobinson wrote: post #96

Given we’re likely stuck with passwords for the foreseeable future, I’d like to see two things in a password manager (maybe these exist?) 1. “hardware wallet” level security, with good UX. Maybe a USB/Lightning dongle, but I really wish computers/phones had built-in capability to do hardware wallets. Apple TouchBar got close (I realize it wouldn’t considered be a dedicated hardware wallet). 2. a way to automatically…

2. a way to automatically roll passwords periodically

Ironically, that’s what LastPass can do for many important sites. Technical details: it opens a site, clicks around its menus and does that for you, and you see all of this automation on your screen. Imagine how many non-2FA users are now experiencing automated password resets on their most valuable accounts.

I’m all for 1, as I take my physical keys with me everywhere, but random ISB solutions out there I don’t really trust any more than e.g. lastpass.

Re: Ask HN: How did my LastPass master password get leaked?

#357

Post by macrolime »

mastazi wrote: post #229
trajcek wrote: post #194

Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…

- Disable Lastpass MFA and use Google Authenticator (Authy) could you please explain this point? Isn't LastPass Authenticator equivalent to Google Authenticator, Authy or any other TOTP app? Or is there something that makes it less secure than other apps? Perhaps because it has cloud backups?

Lastpass MFA is not at all like Google Authenticator. The codes in Lastpass Authenticator are optional and can be bypassed. It's not secure at all.

Re: Ask HN: How did my LastPass master password get leaked?

#358

Post by scraft »

I used Keepass + Dropbox (to sync database). This set up was suggested to me when I joined a company that requires complex unique passwords for all sign ups. At the time I didn't think too much about it, but this thread has made me thankful I was guided in this direction.

I don't have experience of any other password management software, so I certainly can't compare and contrast. But I will say Keepass + Dropbox has worked flawlessly for me across desktop, laptop and mobile. The biggest inconvenience I have had is things like manually typing in a Netflix password into a Smart TV when on holiday (just takes time with long passwords with capitals, lowercase, numbers and symbols).

Re: Ask HN: How did my LastPass master password get leaked?

#359

Post by newaccount74 »

mellowagain wrote: post #310

This has nothing to do with OP's problem but I figured this may be a good place to post about my bad experience with LastPass back in 2019: When I moved to Bitwarden, I have deleted my account on LastPass. I have received a confirmation email regarding my account which states [0]: > Your LastPass account has been permanently deleted and all of your data has been purged from our systems. A few months later I receive a…

You can never know for certain if your passwords are still stored somewhere or not, but I wouldn't worry about a billing email arriving after your account was deleted.

Many companies will retain billing/transactional data even if you delete your account. They might do this for regulatory compliance (eg.in Austria I need to store invoices for 7 years in case the Finanzamt wants to do an audit) or they might just do it as a protection against fraud or credit card chargebacks.

I would assume that "deleting an account" just means "delete your data" (ie. passwords and most personal data) and does not mean "delete all information related to me as if I had never done business with you".

Re: Ask HN: How did my LastPass master password get leaked?

#360

Post by newaccount74 »

tomsmeding wrote: post #36
40four wrote: post #27

Earlier quoted context omitted.

Personally I just stick to local Keepass database files. I’ve never ventured into the cloud based services. If you are really worried about it, do you really need to use a cloud based password service? Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up ov…

TIL about the merge functionality! You can also use Syncthing to synchronise the databases between your devices; if you don't have public IPs for your devices, this essentially means that you can only synchronise when two devices are on the same network -- but this might not be a problem for you.

Syncthing works great even behind a NAT, not sure how it works but it just works for me (might depend on your NAT though)
Post reply on HN