Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

481–490 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#481

Post by gregsadetsky »

Dma54rhs wrote: post #173
dogman123 wrote: post #39

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

Mine was from India, master password definetly unique and very strong. I'm still hoping for some bug that mass alerted every day login attempts instead of actually gaining access.

Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033

It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!

Re: Ask HN: How did my LastPass master password get leaked?

#482

Post by gregsadetsky »

sovietssbns wrote: post #122
dogman123 wrote: post #39

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

got one at 1528EST from 23[.]236[.]213[.]5 - OSINT shows it part of BLAZING_SEO_PROXY pw was only ever used here and stored offline

Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033

It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!

Re: Ask HN: How did my LastPass master password get leaked?

#484

Post by tlrobinson »

Fnoord wrote: post #300
macrolime wrote: post #188

Earlier quoted context omitted.

It can be done with yubikey. Passwords stored encrypted on disk and get decrypted on the yubikey with gpg. https://github.com/drduh/YubiKey-Guide https://attackpointsecurity.com/go-pass-yubikey-and-gpg

Isn't a hardware wallet airgapped? For a cheap alternative you can use an old smartphone, and disable all radios. People will use a Librem 5 in 20 years still for this purpose wink.

> Isn't a hardware wallet airgapped?

No, most of them connect over USB. The important thing is reducing the attack surface to a bare minimum with simple protocols and implementations.

I think at a minimum it would need to emulate a keyboard to type out complex passwords. Ideally it could also receive simple commands from, say, a browser extension to request filling in a specific website.

Re: Ask HN: How did my LastPass master password get leaked?

#485

Post by yawaworht1978 »

EVa5I7bHFq9mnYK wrote: post #365
Retric wrote: post #239

Earlier quoted context omitted.

If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.

MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password: d9afca35a87a2af4168500640fcf2370 Password is 16 characters long, all lower case, no numbers, no special symbols. Please tell me the password.

The best I could find is this

https://stackoverflow.com/questions/10041298/how-to-recover-...

But can you show me the way how you'd go on about this? Really curious.

Re: Ask HN: How did my LastPass master password get leaked?

#486

Post by w0wbagger »

I've been having this problem for the last couple of months. Correctly using my (altered several times) password that I don't use anywhere else. The attempts come from the Isle of Man. It could be any of 3 different devices that have been compromised. I've run 5 different keylogging detection programs on my machine and get nothing, so wondering if it's a Chrome extension exploit?

Re: Ask HN: How did my LastPass master password get leaked?

#487

Post by w0wbagger »

w0wbagger wrote: post #486

I've been having this problem for the last couple of months. Correctly using my (altered several times) password that I don't use anywhere else. The attempts come from the Isle of Man. It could be any of 3 different devices that have been compromised. I've run 5 different keylogging detection programs on my machine and get nothing, so wondering if it's a Chrome extension exploit?

To clarify. This has happened several times of late with my account, even after having changed my password, that is exclusive to LastPass. LastPass successfully catches the invalid attempts (I also use 2FA), but still, a bit worrying.

Re: Ask HN: How did my LastPass master password get leaked?

#488

Post by Xcel »

Same issue just arose for me but got 2 emails from different IPs. Master password only stored in my head and is completely unique. Master pre-dates 2017. I have only used LP on my one PC and the phones I have used over the years. The only device I do not still have in my possession is one that I traded in 3 weeks ago for new device (I wiped the trade-in).

Location UNITED STATES IP address 198.23.179.27

Location Frankfurt am Main, HE 60313, GERMANY IP address 168.81.130.131

Post reply on HN