I'm a day late, but I just got a similar email but with an IP in Canada. So the anecdata continues...
Thanks, new reports always appreciated! There was a whole new thread today... https://news.ycombinator.com/item?id=29716715
Ask HN: How did my LastPass master password get leaked?
491–500 of 529 posts
Re: Ask HN: How did my LastPass master password get leaked?
#492Just happened to me a few hours ago. Completely random password only written down in a notebook locked in my safe. - - - - - - Login attempt blocked Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Was this you? Account Time Tuesday, December 28, 2021 at 7:33 AM EST Location U…
Also haven't used the account in years so that's even more odd.
Thanks for the report!
Re: Ask HN: How did my LastPass master password get leaked?
#493I'm a day late, but I just got a similar email but with an IP in Canada. So the anecdata continues...
Thanks, new reports always appreciated! There was a whole new thread today... https://news.ycombinator.com/item?id=29716715
Thanks! I missed that thread, so I came back to this one. I'll check it out.
Re: Ask HN: How did my LastPass master password get leaked?
#494If you change the masterpassword, and then still get the same message after that, then this means it is not from some old hacked data store, but it is someone able to glean the latest masterpassword from your account live.
I saw this on twitter, but cant reply as I am in twit jail: "Exactly the same thing happened to me last night. They tried again literally minutes after I changed the password to something not used on any other form."
Re: Ask HN: How did my LastPass master password get leaked?
#495Earlier quoted context omitted.
> It has a few nice QOL improvements over BitWarden IMO Mind sharing what in particular you found to be QOL improvements? I'm curious.
Here are a few in no particular order: -When adding an item on desktop & then immediately trying to use it on another device I had to manually open BitWarden & pull down to refresh for the item to show up. It wouldn't auto-refresh when opening in Safari or another app, I had to open BitWarden itself to force a refresh -First class support for Apple Watch. Apple watch support on 1Password for desktop use while my MBP…
Thank you for responding!
Re: Ask HN: How did my LastPass master password get leaked?
#496Earlier quoted context omitted.
What percentage of people do you think actually use 16 character passwords?
Probably pretty low. I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)
Do you use 64 character master password?
Re: Ask HN: How did my LastPass master password get leaked?
#497Earlier quoted context omitted.
Welcome to frameworkless PHP where code & user files are stored in the same root and any PHP file requested by a web client is executed by the server. In most proper frameworks, including PHP ones, the only thing responding to web requests is an entrypoint file (that gets passed the request metadata including URL) and the framework takes it from there. This means that with proper configuration, even requesting a mali…
we miss cgi-bin/
good mention. an rtfm for everyone else.
Re: Ask HN: How did my LastPass master password get leaked?
#498Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235
Hey, could you please confirm whether you have uBlock origin installed in the following thread? https://news.ycombinator.com/item?id=29719033 It's not the most scientifically accurate method, but a few people and I are trying to rule out / determine which software in common all of us might have. Thanks!
I feel this is like a Reddit detective moment. Almost everyone here is going to have uBlock Origin installed.
Re: Ask HN: How did my LastPass master password get leaked?
#499Earlier quoted context omitted.
TIL about the merge functionality! You can also use Syncthing to synchronise the databases between your devices; if you don't have public IPs for your devices, this essentially means that you can only synchronise when two devices are on the same network -- but this might not be a problem for you.
Syncthing works great even behind a NAT, not sure how it works but it just works for me (might depend on your NAT though)
I've had zero success with nat hole punching in the past, on multiple networks. Maybe I'm just unlucky. :)
Re: Ask HN: How did my LastPass master password get leaked?
#500Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrome extension. ``` Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Was this you? Account xxx@xxx.com Time Monday, December 27…
It’s unlikely to be due to a browser extension. A browser extension that can steal your master password can steal all the other passwords as well, it doesn’t need LastPass for that. More importantly, an extension can only steal your master password when it is used – yet several people reported not having used LastPass for a year or more. It’s still not impossible that an extension has been stealing master passwords for years only for them to be used now, it’s merely unlikely.
Judging by the reports here, the source of the leak appears to be LastPass after all. Given that most people write about old accounts, my original suspicion was https://palant.info/2018/07/09/is-your-lastpass-data-really-... – from all I know, LastPass never investigated whether that websiteBackgroundScript.php issue was already being abused. It was obvious enough that someone might have discovered it independently of me.
If on the other hand you changed your master password recently (and someone had a login attempt on a brand new account) then this theory is moot. While I am aware of a number of LastPass design flaws (see https://security.stackexchange.com/questions/45170/how-safe-...), none of them could be the culprit here. It must be something new then. The weird thing: LastPass must have stored unencrypted passwords somewhere, because reversing 100,000 rounds of PBKDF2 wouldn’t have allowed such large-scale attacks.