LastPass notifies users of yet another data breach • Hacker News Board

Re: LastPass notifies users of yet another data breach

#151

Post by cdud3 » Thu, Jun 25, 2026, 4:59 PM UTC

qwertox wrote: post #134

bko wrote: post #55

Earlier quoted context omitted.

I think a lot of people use products like LastPass because it makes storing passwords easier. Works on mobile, computer, tablet. Pretty good experience tbh. With something like LastPass it's also much easier to create unique strong passwords for other sites. Also, let's be real: > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, inc…

> I'm pretty sure 99% of the people on exposed have already had their Right, but LastPass is a company that wants to make you believe that you can trust them with some of your most important assets. -- Probably related to this: https://www.bleepingcomputer.com/news/security/lastpass-conf... “On June 12th, LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platfo…

That's a npm supply chain attack style but next level for the Enterprise game: hack one and get access to everything of all of them since they are all unrestricted connected and with each other.

And then they force us to install cloudstrike, antiviruses and client side monitoring because "us are the security problem".

Re: LastPass notifies users of yet another data breach

#152

Post by fusslo » Thu, Jun 25, 2026, 5:03 PM UTC

vel0city wrote: post #122

fusslo wrote: post #12

I'm sure this is worse than using lastpass in some way but for the past couple years I've just generated and forgotten 90% of my passwords. the final 10% I keep in a password manager. But if the service isn't really that important I just use the 'forgot my password' to change and generate a new password every time I need to login

This is why a lot of services have just moved to using email with magic links to log people in. In the end for a lot of services controlling your email is defacto controlling the login.

I am a vocal opponent to magic links via email (I am an unhinged person, in case it wasn't obvious before :) ).

I NEVER log into my mail from my laptop/desktop. I access my email via my phone's mail app.

So

1. try logging on via my laptop's browser

2. service sends a magic link to my email

3. click the link on my phone

4. now I'm logged in on my phone! not what I wanted!

Re: LastPass notifies users of yet another data breach

#153

Post by fusslo » Thu, Jun 25, 2026, 5:05 PM UTC

antiframe wrote: post #85

fusslo wrote: post #53

Earlier quoted context omitted.

oh dang that's not good. I've had the same phone number since 2006 so I didn't really think about it

But the phone number you have is not 100% in your control. I had AT&T flub something and I lost my number and they assigned me a new one (I was chanting my plan just after they did some merging with someone). Granted its unlikely but I would still use defense in depth and not have password reset be my only login method.

Thats totally fair and really scary since so many services think 2fa means texting or calling a phone number (my bank for example)

Re: LastPass notifies users of yet another data breach

#154

Post by scottlamb » Thu, Jun 25, 2026, 5:06 PM UTC

fragmede wrote: post #128

thesuitonym wrote: post #125

Earlier quoted context omitted.

> I think a lot of people use products like LastPass because it makes storing passwords easier. Works on mobile, computer, tablet. Pretty good experience tbh. > With something like LastPass it's also much easier to create unique strong passwords for other sites. Sure, but LastPass, in addition to being the least secure option, doesn't even have a good user interface, and it's expensive. There are dozens of other pass…

Password managers are entirely a UX problem waiting to be solved better. Every time I hit a UX bug with my password manager, I mutter that I could do fix that, and then know that mine would also be worse in so many ways just to reach parity. What I wish is there was a public bug tracker of UX issues/optimizations that I, and the rest of the world, could log ideas to. Password managers are such a good idea but they al…

Can you give me an example of a UX problem that you attribute to the password manager? That'd help me understand.

I often hit problems with 1Password's autofill on particular websites, but by and large I blame the website. Few examples:

* one website expects me to type the PIN then a Symantec VIP OTP token into a single field called "password". That's a (possibly deliberately) password manager-hostile design. I finally got annoyed with it enough to use an open source project called `python-vipaccess` to create a proper `otpauth://totp/...` URL I could add into 1Password and wrote a TamperMonkey script that added separate autofillable fields that would get concatenated automatically. Now 1Password works fine.

* frequently websites will complain about needing a valid credit card number after autofill. I have to go to the field, delete the last digit, add it back, tab away, then it works. I think they have just used the wrong event handlers and never tested it with autofill.

* they often will skip `autocomplete="new-password"` attributes, so my password manager will look for a (nonexistent) current password rather than prompting me for a new one, and/or they won't have the username and new password fields ever in the DOM at the same time so the password manager doesn't save it properly. (Even if it makes sense in terms of user-visible flow to do these in sequence, they can still leave the username in as a hidden form element for the benefit of the password manager.)

I've also hit UX problems in 1Password itself, for example the "quick access" pop-up doesn't reliably appear on the current Space in macOS. (Confusing and annoying to have to switch to another to see it.) But they seem less common.

Re: LastPass notifies users of yet another data breach

#155

Post by willmadden » Thu, Jun 25, 2026, 5:10 PM UTC

I find it hard to believe that LastPass still has users.

Re: LastPass notifies users of yet another data breach

#156

Post by willmadden » Thu, Jun 25, 2026, 5:13 PM UTC

argee wrote: post #147

I, like many others, wanted to move off of LP but was too lazy. So I just exported my passwords and put them into Google Sheets. While I have rotated many of those passwords (especially the important ones) and put them into a better password manager, there are several I haven't — and they've remained safer in Google Sheets than in LP. The lesson here is to get off of LP ASAP, you can figure out where to go later.

You put your passwords in Google Sheets? The data there is not encrypted at rest. Google has 191k employees in countries like China, India, and Pakistan who could potentially access your records. Make sure you use something that encrypts your data at rest, preferably on a device you own and control.

Re: LastPass notifies users of yet another data breach

#157

Post by Peanuts99 » Thu, Jun 25, 2026, 5:18 PM UTC

greenavocado wrote: post #92

This is why I use Microsoft Teams and Outlook as my password manager. I just save my passwords to draft or email them to my coworkers so they never lose track /s

Hello coworker of mine.

Re: LastPass notifies users of yet another data breach

#158

Post by Terr_ » Thu, Jun 25, 2026, 5:41 PM UTC

vel0city wrote: post #122

fusslo wrote: post #12

I'm sure this is worse than using lastpass in some way but for the past couple years I've just generated and forgotten 90% of my passwords. the final 10% I keep in a password manager. But if the service isn't really that important I just use the 'forgot my password' to change and generate a new password every time I need to login

This is why a lot of services have just moved to using email with magic links to log people in. In the end for a lot of services controlling your email is defacto controlling the login.

Links sent in plaintext over the network. :(

Re: LastPass notifies users of yet another data breach

#159

Post by toomuchtodo » Thu, Jun 25, 2026, 5:42 PM UTC

PunchyHamster wrote: post #101

eddieroger wrote: post #77

Earlier quoted context omitted.

Liability is the answer! If you build an auth system and it fails, it's your backside. If Okta fails, it's theirs. Enterprises buy products as much as they buy protection from problems.

They don't offer any meaningful reimbursement if they lose your data so what does that matter ?

It's about shifting the blame, not compensation. You're paying for "not my problem," not "it always works and I get reimbursed when it doesn't."

Re: LastPass notifies users of yet another data breach

#160

Post by throwawayffffas » Thu, Jun 25, 2026, 5:43 PM UTC

bradley13 wrote: post #145

WTF is LastPasd doing, handing customer details to a market research company? Any such data should have been fully anonymized: no names, no specific addresses, etc.. For anyone looking for a recommendation: I use KeepassXC with Keepass2Android. Open source, with a local database that you can choose to sync (or not). I sync using Own cloud.

> Any such data should have been fully anonymized: no names, no specific addresses, etc..

Why even give them that?