I've switched to Bitwarden after the first of such incidents and never looked back. More incidents were just bound to happen to LastPass.
LastPass: Notice of Security Incident
111–120 of 141 posts
Re: LastPass: Notice of Security Incident
#112"engaged a leading cybersecurity and forensics firm."
This is the current trend each time there is a breach: let's pretend/show that we are serious and waste money taking "security" consultants, that will in the end probably tell us obvious things.
Pay more or listen to your own employees instead and eventually go hire competent engineers instead of funding bullshit jobs.
Lastpass is supposed to be in the "cyber security" field, so it is a little bit ridiculous to say that you need external help on this subject...
Re: LastPass: Notice of Security Incident
#113Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Or just use the tools already on your computer. www.passwordstore.org and stand up your own bare git repo.
I loved keepass but I wanted to manage my passwords in the cli. Found out that pass exists, switched to it, and have been using it ever since.
I have my pass repo somewhere on the internet and the android/ios clients have been adequate for me.
Re: LastPass: Notice of Security Incident
#114Earlier quoted context omitted.
The inputs are domain + username + counter. So you just increment the counter.
How does it solve the problem when bank1 requires [a-zA-Z0-9] characters (no special) and bank2 requires [a-zA-Z0-9!@#$%^&*()] characters (special required)?
You can set it up for that, as well. Of course, it means that you'll also have to back up the config, but it's just a JSON file. They do have a cloud service to sync that, too.
I recommend checking out their main page - it's got plenty of screenshots that showcase all the important features:
Re: LastPass: Notice of Security Incident
#115Self-host with Bitwarden I guess?
Re: LastPass: Notice of Security Incident
#116Earlier quoted context omitted.
People like to dunk on the password journal but I find it hard to believe that someone is going to break in to your mom's house as the way to access her bank or facebook account. It's a horrible idea to leave the password for the database sitting next to the admin's workstation. But physical access is a vastly different concern for a corporation than an individual. Threat surfaces are different for different people.…
Yup. Writing passwords on paper, at home, is just about as secure as it gets.
Self hosted, on-prem, 2FA (something you have and somewhere you are). If your handwriting's bad enough you're almost pushing into some kind of biometric lock.
:)
Re: LastPass: Notice of Security Incident
#117Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
[deleted]
Re: LastPass: Notice of Security Incident
#118Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Early? It happened two weeks ago. That doesn't fit my definition of early.
Re: LastPass: Notice of Security Incident
#119Earlier quoted context omitted.
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
> even a full breach of their servers would fail to leak passwords This is a dangerous fallacy. Nothing fundamentally would prevent someone who attacked their infrastructure from pushing a malicious app update or a malicious extension update which exfiltrated the decrypted library from the client side.
I wasn't specific about that. I should have said a full dump of their database.
Yes, if someone got into their supply chain, they could push a malicious update. That's also true of KeePass and every other password manager. There's no way to avoid that vector.
Re: LastPass: Notice of Security Incident
#120Earlier quoted context omitted.
You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master passw…
While this is true, and I did this for the better part of 2010s, it was pretty clunky. Especially if one needs a platform for their wife or children to also use. I'm gonna ride out LastPass until webauthn really takes off. Which could be soon based on what we're hearing from the mobile vendors.
> Which could be soon based on what we're hearing from the mobile vendors.
I'd really like to see wider webauthn support, so I'm curious to know what you mean by what you're hearing from the mobile vendors please?