11–20 of 20 posts
So check your statements and see. I'm curious to know how many more people this has happened to.
This title is so manipulative and misleading. The attacker stole a mountain of AES encrypted blobs, so unless this threat actor has broken AES already, it'll probably be decades before they'll be able to peer into your secrets.
I read the customer update, and the severity of this breach is hidden deep in the statement and skimmed over.
Basically: LastPass just shared which sites you have logins for with the attacker. This could be sold or released to the entire world. They claim the usernames are encrypted fields but often the usernames can also be in the URLs saved along with the site.
There ought to be some kind of legal sanction against companies that try to hide the seriousness of data breaches. I read the customer update, and the severity of this breach is hidden deep in the statement and skimmed over. Basically: LastPass just shared which sites you have logins for with the attacker. This could be sold or released to the entire world. They claim the usernames are encrypted fields but often the…
Earlier quoted context omitted.
Bitwarden offers both a hosted and self-hosting option. Though their code is open source unlike LastPass and 1Password.
It works great but you'll need a reverse proxy with TLS + a domain if you want to use the android app. Self signed certs don't play nicely with the app.
This title is so manipulative and misleading. The attacker stole a mountain of AES encrypted blobs, so unless this threat actor has broken AES already, it'll probably be decades before they'll be able to peer into your secrets.
And "unencrypted data, such as website URLs" which really should be enumerated in full.
If anything, apart from leaking the domain, which could still be a privacy issue, they should have at least sanitized the URLs to remove usernames or tokens if they were going to automatically save those URLs to the vault. I can guess that not doing so allowed their auto-login function to work on some websites by saving the login URL endpoint, but all I'd really want is the vault to keep the sanitized domain.
[0]: https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...
There ought to be some kind of legal sanction against companies that try to hide the seriousness of data breaches. I read the customer update, and the severity of this breach is hidden deep in the statement and skimmed over. Basically: LastPass just shared which sites you have logins for with the attacker. This could be sold or released to the entire world. They claim the usernames are encrypted fields but often the…
I really don’t understand why they didn’t just encrypt the whole records.
Earlier quoted context omitted.
I really don’t understand why they didn’t just encrypt the whole records.
The convenience of offering to re-login if your session is expired and you hit a site where you use it?
This title is so manipulative and misleading. The attacker stole a mountain of AES encrypted blobs, so unless this threat actor has broken AES already, it'll probably be decades before they'll be able to peer into your secrets.
Someone is out there using whatever data or metadata was unencrypted.