Lastpass Security Incident
blog.lastpass.com
Lastpass Security Incident
1–10 of 587 posts
Re: Lastpass Security Incident
#2> was able to gain access to certain elements of our customers’ information
This is frustratingly vague. This incident started 4 months ago, and you can't provide any details?
If it wasn't such a PITA to move off LastPass, I would do so. They got me.
Re: Lastpass Security Incident
#3Ruh Roh
Re: Lastpass Security Incident
#4> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.
How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.
Re: Lastpass Security Incident
#5> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.
How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.
It's easy if you don't share passwords with others. I have my whole family and business using it, and there's lots of shared folders.
Convincing my wife and colleagues to all switch simultaneously isn't feasible unless this data fiasco gets worse.
Re: Lastpass Security Incident
#6Lastpass has had so many security incidents I have no idea why anyone uses it anymore when the whole product is supposed to be Security.
Re: Lastpass Security Incident
#7> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.
How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.
I tried migrating from LP to BW and got import errors. Bitwarden's error message was very vague (along the lines of "sorry, something went wrong") and I haven't been able to track down what entries were causing the issue. I've tried 3 or 4 times including trying to reproduce with subsets of the full collection but it's too much of a pain with hundreds of accounts and I so far haven't been motivated enough to manually transfer them or to write a selenium script to do it automatically.
Re: Lastpass Security Incident
#8> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.
> If it wasn't such a PITA to move off LastPass,
It's really not. As the quality of their software declined severely starting around 4-5 years ago, I put off moving because I assumed it would be a huge hassle. It turned out to be surprisingly easy. I have since deleted my LastPass account and wouldn't trust that company to mop my floors.
Re: Lastpass Security Incident
#9> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.
I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.
Re: Lastpass Security Incident
#10> We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.
Sure sounds like they found passwords or keys in the development environment breach back in August, and nobody bothered to change those after knowing they were hacked.