Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#121

Post by emotivehealer »

gregsadetsky wrote: post #100
emotivehealer wrote: post #98

Yeah me too. Same IP range too, but location listed as Toronto. Not that this means anything.

Wait sorry, this might be actually critically important. When you say same IP range, what do you mean? The IP that the login attempt happened from starts with 160.? If 4 of us (in this thread) all had quasi-successful login attempts to our accounts, it could mean that some LastPass master passwords have been leaked...?? Or LastPass has been compromised?

Begins with 160.116…

Re: Ask HN: How did my LastPass master password get leaked?

#122

Post by sovietssbns »

dogman123 wrote: post #39

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

got one at 1528EST from 23[.]236[.]213[.]5 - OSINT shows it part of BLAZING_SEO_PROXY

pw was only ever used here and stored offline

Re: Ask HN: How did my LastPass master password get leaked?

#123

Post by tlrobinson »

hocuspocus wrote: post #109
tlrobinson wrote: post #96

Given we’re likely stuck with passwords for the foreseeable future, I’d like to see two things in a password manager (maybe these exist?) 1. “hardware wallet” level security, with good UX. Maybe a USB/Lightning dongle, but I really wish computers/phones had built-in capability to do hardware wallets. Apple TouchBar got close (I realize it wouldn’t considered be a dedicated hardware wallet). 2. a way to automatically…

1. Check out https://www.themooltipass.com

Cool, great start, but something Yubikey sized would be more practical.

Re: Ask HN: How did my LastPass master password get leaked?

#124

Post by gregsadetsky »

a-dub wrote: post #44

do you have it installed on your smartphone? have you ever entered your master password on your smartphone? what sort of smartphone do you have, does it get security updates regularly, is the manufacturer competent? same with your desktop. is everything up to date?

I have an iPhone and I do have my keepass file there too. So yes, presumably, the iOS app that I use could have accessed my keepass file and sent it unencrypted over the network to someone (which would be terrible).

Thanks for the comment/reminder! I'll definitely have to re-consider what I do with regards to the keepass file on my phone.

Re: Ask HN: How did my LastPass master password get leaked?

#125

Post by emotivehealer »

gregsadetsky wrote: post #100
emotivehealer wrote: post #98

Yeah me too. Same IP range too, but location listed as Toronto. Not that this means anything.

Wait sorry, this might be actually critically important. When you say same IP range, what do you mean? The IP that the login attempt happened from starts with 160.? If 4 of us (in this thread) all had quasi-successful login attempts to our accounts, it could mean that some LastPass master passwords have been leaked...?? Or LastPass has been compromised?

Also FWIW I too have not used Lastpass for 2-3 years. Login history doesn’t appear to go back that far but I’d estimate it’s at least 2 years since I logged in.

Re: Ask HN: How did my LastPass master password get leaked?

#126

Post by coryfklein »

FWIW, I migrated off paid LastPass onto the free BitWarden plan recently and my experience has been much improved. I was a huge LastPass proponent in the beginning and at the time they seemed like the obvious best choice in a field with few options. But they have definitely not been able to keep up with the times and their paid service just isn't even comparable to what is now available for free.

Re: Ask HN: How did my LastPass master password get leaked?

#128

Post by l33r »

My girlfriend once asked me why I don't use a password manager like LastPass. A week later she got locked out of her LastPass account because she was inadvertently using an enterprise account that one of her clients forced her to use while on a project. And even though she was paying for her own premium LastPass subscription, the support experience had was terrible. Issue was resolved when the client was able to unlock the account for her, but it was a pain because it was during the holidays. I would avoid a password management software because of her experience.

Re: Ask HN: How did my LastPass master password get leaked?

#129

Post by gregsadetsky »

emotivehealer wrote: post #121
gregsadetsky wrote: post #100

Earlier quoted context omitted.

Wait sorry, this might be actually critically important. When you say same IP range, what do you mean? The IP that the login attempt happened from starts with 160.? If 4 of us (in this thread) all had quasi-successful login attempts to our accounts, it could mean that some LastPass master passwords have been leaked...?? Or LastPass has been compromised?

Begins with 160.116…

Exactly the same here!!!!

Wow, this is fantastically bad.

Re: Ask HN: How did my LastPass master password get leaked?

#130

Post by hsbauauvhabzb »

indigochill wrote: post #30
gregsadetsky wrote: post #9

Earlier quoted context omitted.

Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presumably it's not stored on their side. Is that accurate..? Thanks

You don't need access to a password to check it, just the hash (then they hash what you enter and compare the hash to the one they have). So both "They use it to log in to their whatever" and "They don't have access to it" can be correct.

If there’s a breached phpbb instance, the attacker can modify login.php to log plaintext credentials.
Post reply on HN