Reading this thread is giving me major trust issues
Ask HN: How did my LastPass master password get leaked?
151–160 of 529 posts
Re: Ask HN: How did my LastPass master password get leaked?
#152No post body was provided.
Re: Ask HN: How did my LastPass master password get leaked?
#153My girlfriend once asked me why I don't use a password manager like LastPass. A week later she got locked out of her LastPass account because she was inadvertently using an enterprise account that one of her clients forced her to use while on a project. And even though she was paying for her own premium LastPass subscription, the support experience had was terrible. Issue was resolved when the client was able to unlo…
What can we learn from this apart from not saving private data into someone else's corporate account?
I don't think it's the password manager's fault, mistakes like that can happen if you don't double check whose the account is.
Re: Ask HN: How did my LastPass master password get leaked?
#154Earlier quoted context omitted.
Hmm. So I don't know if this means anything, but I was googling for the IP address and wound up at https://ipinfo.io/160.116.88.235 which says hostname: visit.keznews.com. When you go to that hostname, it's one of the best phishing sites I've ever seen. They dynamically inserted my ISP's logo (Spectrum) and tried to do a phishing attempt: https://i.imgur.com/C9HQw1c.png The full non-clickable URL: https://us.poonstat…
Hey, That's quite possible, for sure. I am not beyond/above/below being phished like anyone else, ha! The issue -- what makes it perplexing -- is that I haven't used this LastPass password since 2017. I know because this LastPass account was only used to share passwords within an org that I left back then. Is it possible that I was phished 4 years ago, and they sat on the password? Sure. But 2 other people in this th…
Hey guys I think that maybe this has to do with an exploit in the web browser LastPass extension about 5 years ago: HN POST: [0].
Re: Ask HN: How did my LastPass master password get leaked?
#155You trusted an online service to look after your passwords. Use something local, like 1password. I have no idea why anyone would use a hosted solution like LastPass. Of course something will happen?
> I have no idea why anyone would use a hosted solution like LastPass.
Convenience. I use Bitwarden. I get a lot of value from having my passwords synced across multiple PCs and my phone.
Re: Ask HN: How did my LastPass master password get leaked?
#156I got the same thing in the last month. Then my bank account had 7 transactions from ali express about a week later. Nine were mine. I deleted everything in lastpass and deleted my account.
Re: Ask HN: How did my LastPass master password get leaked?
#157My girlfriend once asked me why I don't use a password manager like LastPass. A week later she got locked out of her LastPass account because she was inadvertently using an enterprise account that one of her clients forced her to use while on a project. And even though she was paying for her own premium LastPass subscription, the support experience had was terrible. Issue was resolved when the client was able to unlo…
So what do you do to remember passwords? Do you write them down on paper, or maybe save in browser? I'm curious, I've pondered writing down my pivotal passwords on paper and hiding in a book or something.
Personally I combine a hash of something site-specific, eg. name, purpose etc and a base alphanumeric string. Allows each account have their own specific credentials while not being overly burdensome to remember.
Re: Ask HN: How did my LastPass master password get leaked?
#158do you have it installed on your smartphone? have you ever entered your master password on your smartphone? what sort of smartphone do you have, does it get security updates regularly, is the manufacturer competent? same with your desktop. is everything up to date?
I have an iPhone and I do have my keepass file there too. So yes, presumably, the iOS app that I use could have accessed my keepass file and sent it unencrypted over the network to someone (which would be terrible). Thanks for the comment/reminder! I'll definitely have to re-consider what I do with regards to the keepass file on my phone.
also, just for grins. have you checked to see if the same email is generated in error when a failed login attempt happens from an unknown location?
Re: Ask HN: How did my LastPass master password get leaked?
#159Earlier quoted context omitted.
There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/
There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…
Clearly we both agree it's an insecure practice, since you felt it needed a warning.
Now that you know there's an official LastPass importer for 1Password, I'm curious why you're defending your version rather than updating your blog post, unlinking your original HN comment and deprecating the GitHub repo.
I believe you're genuine and just trying to help. If there's an attack, it wouldn't be you doing it – it'd be someone else replacing the binaries on an old 2017 post without you noticing. WordPress is just as insecure as phpBB. Like the other commenter said, "Just because you put a warning label on a bad practice doesn't mean it's a good practice."
Re: Ask HN: How did my LastPass master password get leaked?
#160Another data point, same deal.
Time Monday, December 27, 2021 at 1:29 PM EST
Location São Paulo, SP 01323, BRAZIL
IP address 160.116.231.145