Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

21–30 of 326 posts

Re: LastPass users warned their master passwords are compromised

#21
post #15

Hate to hear this, but I'm glad I bailed when LogMeIn bought them years ago.

The whole service pretty much started to deteriorate after being bought. We have daily issues with initial logins taking maybe five minutes. I've also experience being told that my account was a "Free user" and I had zero password. Not something you want to see when working for a company that has 1000+ passwords in Lastpass.

Re: LastPass users warned their master passwords are compromised

#22
post #3

Let this be your Last non-selfhosted Pass solution.

That has almost nothing to do with it.

It's about convenience vs security, and specifically, auto-filled passwords across devices and applications. Anything that provides such a feature will be inherently less secure than an encrypted file.

If LastPass and others are to blame for anything, it would possibly be their marketing around the this tradeoff, though I think they avoid direct misrepresentation by just avoiding the issue completely.

Re: LastPass users warned their master passwords are compromised

#23
> However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere.

So it’s not just bots trying passwords from other database leaks

The whole premise of LastPass is that they can’t even decrypt your master password. It’s pretty concerning that this is happening.

If hackers can get your master password, then _all_ of your passwords are at risk

Re: LastPass users warned their master passwords are compromised

#26

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

What if you’re in another country and your devices get stolen? Should you bring the Yubikey to travel? What happens if there’s a fire at your house and the Yubikey is destroyed?

You can add multiple keys to the account.

Re: LastPass users warned their master passwords are compromised

#27

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

Ah yes, the $5 wrench method.

Come on, this is hacker news.

Some of our skulls are so thick you’d need at least a $10 wrench

Re: LastPass users warned their master passwords are compromised

#28
post #26

Earlier quoted context omitted.

What if you’re in another country and your devices get stolen? Should you bring the Yubikey to travel? What happens if there’s a fire at your house and the Yubikey is destroyed?

You can add multiple keys to the account.

So is the recommendation to get something like 3 keys and keep them in different safe places and bring one when you travel? I’ve been considering getting a Yubikey. Do they work on mobile?

Edit: Looks like some Yubikey work via nfc for mobile.

Re: LastPass users warned their master passwords are compromised

#29
post #26

Earlier quoted context omitted.

What if you’re in another country and your devices get stolen? Should you bring the Yubikey to travel? What happens if there’s a fire at your house and the Yubikey is destroyed?

You can add multiple keys to the account.

I can sell you a picture of my pliers for 1eth
Post reply on HN