Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

441–450 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#441

Post by gregsadetsky »

jagstangxl wrote: post #440
gregsadetsky wrote: post #427

Earlier quoted context omitted.

That would truly be the best outcome possible -- that LastPass sent out "Someone just used your master password" emails incorrectly i.e. those were false positives.

They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.

But if your master passphrase is only used for LastPass (as is exactly my case -- I've never used it elsewhere), how can it can be credential stuffing? Or was the password breached from LastPass itself in the past? That's possible, but then it doesn't jell with people having this same issue with accounts created in November 2021.

As far as I can tell, the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email we all received was only sent when a correct password was used. Incorrect passwords did not trigger that email.

But yes, it would be great to learn that those emails were sent incorrectly i.e. it was a false positive (i.e. someone tried to login with a wrong password, but the email above was sent anyway). It's still not great that the wrong kind of email was sent, but that would be a low level bug.

Re: Ask HN: How did my LastPass master password get leaked?

#442

Post by 40four »

Retric wrote: post #402
EVa5I7bHFq9mnYK wrote: post #365

Earlier quoted context omitted.

MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password: d9afca35a87a2af4168500640fcf2370 Password is 16 characters long, all lower case, no numbers, no special symbols. Please tell me the password.

What percentage of people do you think actually use 16 character passwords?

Probably pretty low.

I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)

Re: Ask HN: How did my LastPass master password get leaked?

#443

Post by dogman144 »

OP, the direction of this is totally based on these questions:

- have you reused your LP master password as a password anywhere besides LP.

- have you entered your LP master password into anything besides a LP login window. (edit: nvm, ya it went into the other PW manager. Without investigating that, not worth pointing the finger at LP and causing enterprise LP account usage chaos).

- Do you enter the LP password into only the browser extension from LP, your phone's LP app, and any other LP-official services when you log into it.

If you can do a yes/no answers, totally clears this up or totally escalates it.

Re: Ask HN: How did my LastPass master password get leaked?

#444

Post by 40four »

4rb1t wrote: post #222
GordonS wrote: post #58

Earlier quoted context omitted.

Same here, I use KeePass on several Windows machines, and on a couple of Android phones (using KeePass2Android). I use a cheap VPS as a central point for syncing - so I can make changes on any machine, then sync them over SFTP, which merges the changes into the database on the VPS. I can then hit sync on any of the other machines, and it will pull down the latest database over SFTP and merge in the changes. It sounds…

why not just use dropbox? and secure dropbox using 2FA? FWIW, I used to run nextcloud on a ec2 instance. Decided to just use dropbox instead. the webdav support on nextcloud was neat with keepass

My whole point was I like to be in total control my password database, and never have to decide whether to trust a third party provider or not.

Not saying Dropbox or lastpass isn’t trustworthy. Just that it’s a point of failure you can eliminate, if the lack of convenience isn’t a huge deal to you.

Re: Ask HN: How did my LastPass master password get leaked?

#445

Post by belenos46 »

ipaddr wrote: post #416
md_ wrote: post #363

Earlier quoted context omitted.

I can't parse this. Is your point that "closed source" is a synonym for "insecure"?

Closed source is a synonym for insecure if you accept secure means no blackbox processes.

Dingding Exactly!

Re: Ask HN: How did my LastPass master password get leaked?

#446

Post by somehnguy »

caladin wrote: post #341
somehnguy wrote: post #181

Earlier quoted context omitted.

Similar story as you, promoted LastPass when it first started because it worked and was the obvious choice. About 3 years ago I finally switched to BitWarden after realizing Lastpass was never going to fix their terrible UI. A few months ago I switched to 1Password though and am very happy. It has a few nice QOL improvements over BitWarden IMO, though BitWarden was leagues better than LastPass at least. This post pro…

> It has a few nice QOL improvements over BitWarden IMO Mind sharing what in particular you found to be QOL improvements? I'm curious.

Here are a few in no particular order:

-When adding an item on desktop & then immediately trying to use it on another device I had to manually open BitWarden & pull down to refresh for the item to show up. It wouldn't auto-refresh when opening in Safari or another app, I had to open BitWarden itself to force a refresh

-First class support for Apple Watch. Apple watch support on 1Password for desktop use while my MBP is in clamshell mode works fantastic. When not in clamshell it lets me unlock either via TouchID OR Apple Watch, which is really nice. I almost never have to actually type my password. Plus you can add individual items to your watch for viewing.

-Sharing items to my family members is way simpler than with BitWarden. This was the one that pushed me over to 1Password actually, my girlfriend wanted to start using a password manager. The documentation for having family members/shared entries with BitWarden was pretty confusing and kinda wishy-washy on how exactly to setup that kind of thing. 1Password also recently added the ability to share an item to a user that doesn't use 1Password (via a link with the ability to set a time limit) which can be handy.

-1Password seems to do slightly better with finding authentication related fields in random web pages & apps

-In general I just find the workflow for adding new items/recalling old ones with 1Password slightly more intuitive than with BitWarden

None of these are dealbreakers for using BitWarden at all IMO, just QOL improvements via a paid-for more polished product. BitWarden provides a very solid experience especially considering the free tier, I just think 1Password is a little more polished.

Re: Ask HN: How did my LastPass master password get leaked?

#447

Post by leftpass »

gregsadetsky wrote: post #429
ksec wrote: post #420

Earlier quoted context omitted.

Finally, if it is indeed not Lastpass's fault and as they say they dont store master password on their server, then there must be a software all these victims have in common. And it has to be fairly common so we could get at least 20 report on a HN thread. Side Note: Interesting all it takes was AppleInsider publishing, getting some sort of traction. And Lastpass had a response within two hours. Edit: This still does…

Yeah, what doesn't make sense is that the emails we all received says: "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" so either: - the email was sent incorrectly i.e. our master passwords were /not/ used to login. In that case, why was the email sent? - the email is correct i.e. someone does indeed have access to our master password (it was conf…

An extra consideration is that LastPass claim to be monitoring their systems constantly, specifically call out automated attempts ("fairly common bot-related activity"), so we can assume that monitoring includes "attempts to login with wrong passwords" or "attempts to login to accounts that do not exist". That information would be a good way to identify a credential-stuffing attack with confidence, i.e: they might be seeing millions of login attempts to accounts that don't exist + accounts that do with the wrong password...

If that is the case, then the email must be sent in error... which is definitely plausible, i.e: they have a logic mistake somewhere in their system which is incorrectly identifying some unsuccessful attempts as successful (which is triggering an event which triggers the email, the audit log entry etc).

Hopefully they make a better statement soon, because this is very terrible communication from a password management company.

Re: Ask HN: How did my LastPass master password get leaked?

#448

Post by tikiman163 »

gregsadetsky wrote: post #429
ksec wrote: post #420

Earlier quoted context omitted.

Finally, if it is indeed not Lastpass's fault and as they say they dont store master password on their server, then there must be a software all these victims have in common. And it has to be fairly common so we could get at least 20 report on a HN thread. Side Note: Interesting all it takes was AppleInsider publishing, getting some sort of traction. And Lastpass had a response within two hours. Edit: This still does…

Yeah, what doesn't make sense is that the emails we all received says: "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" so either: - the email was sent incorrectly i.e. our master passwords were /not/ used to login. In that case, why was the email sent? - the email is correct i.e. someone does indeed have access to our master password (it was conf…

There have been several major breaches of security in recent months, such as the log4j vulnerability, that could have allowed malware to end up being spread to quite a few people. If your computer has been compromised, KeyPass files are among the list of items malware will attempt to send back. There are also secondary attacks which might have resulted in capturing their master passwords without needing to steal a KeyPass or similar file (such as key loggers). Given the scope of recent breaches it seems likely to me that there should be a sudden cluster of users whose passwords were individually compromised.

Re: Ask HN: How did my LastPass master password get leaked?

#449

Post by gregsadetsky »

dogman144 wrote: post #443

OP, the direction of this is totally based on these questions: - have you reused your LP master password as a password anywhere besides LP. - have you entered your LP master password into anything besides a LP login window. (edit: nvm, ya it went into the other PW manager. Without investigating that, not worth pointing the finger at LP and causing enterprise LP account usage chaos). - Do you enter the LP password int…

> - have you reused your LP master password as a password anywhere besides LP.

No. I computer generated this password to use it for this LastPass account only. The password was secure (mixed alpha case + numbers, longer than 12 characters), and stored in an encrypted KeePass file.

> - have you entered your LP master password into anything besides a LP login window. (edit: nvm, ya it went into the other PW manager. Without investigating that, not worth pointing the finger at LP and causing enterprise LP account usage chaos).

I have probably logged into lastpass.com's web ui directly i.e. without using their extension. So a compromised extension (back in 2017 when I last used this account/password) could have sniffed it. Or a malware monitoring my clipboard.

> - Do you enter the LP password into only the browser extension from LP, your phone's LP app, and any other LP-official services when you log into it.

As above, I most probably have used the password while logging into lastpass.com in Chrome with other extensions active.

Re: Ask HN: How did my LastPass master password get leaked?

#450

Post by mkopinsky »

znep wrote: post #254
trajcek wrote: post #194

Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…

One other thing to note is that by default lastpass allows reverting to your previous password for 30(?) days. The option is in account settings -> advanced -> "Allow master password changes to be reverted". To be safe you would probably want to disable that then change your password again. Just don't lose your new password as you then can't revert. See https://support.logmeininc.com/lastpass/help/recover-your-lo...

I last changed my master password in 2019, and it gave me the option to revert to previous password. So it's not just a 30 day thing.
Post reply on HN