Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#221

Post by jwatt »

I stopped using Lastpass in 2017 after the second breach that year that allowed remote code execution:

https://en.wikipedia.org/wiki/LastPass#2017_security_inciden...

It wasn't so much that that happened, but rather their response:

https://blog.lastpass.com/2017/03/important-security-updates...

- "Our investigation to date has not indicated that any sensitive user data was lost or compromised"

- "No master password change is required"

- "No site credential passwords need to be changed"

Given the fact that an attacker could run code in a user's browser extension without any communication with Lastpass servers, there was no way for them to know whether the master or site passwords had been stolen. The only responsible thing for them to do at that point in my view was to recommend everyone change all their passwords. Instead they completely played it down.

So they completely lost my trust and I spend the next several days moving off Lastpass and changing the passwords for hundreds of websites...I feel for all of you finding yourselves in that situation now. :-(

Re: Ask HN: How did my LastPass master password get leaked?

#222

Post by 4rb1t »

GordonS wrote: post #58
40four wrote: post #27

Earlier quoted context omitted.

Personally I just stick to local Keepass database files. I’ve never ventured into the cloud based services. If you are really worried about it, do you really need to use a cloud based password service? Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up ov…

Same here, I use KeePass on several Windows machines, and on a couple of Android phones (using KeePass2Android). I use a cheap VPS as a central point for syncing - so I can make changes on any machine, then sync them over SFTP, which merges the changes into the database on the VPS. I can then hit sync on any of the other machines, and it will pull down the latest database over SFTP and merge in the changes. It sounds…

why not just use dropbox? and secure dropbox using 2FA?

FWIW, I used to run nextcloud on a ec2 instance. Decided to just use dropbox instead. the webdav support on nextcloud was neat with keepass

Re: Ask HN: How did my LastPass master password get leaked?

#224

Post by gregsadetsky »

RisingFusion wrote: post #206

Same issue for me. Time Monday, December 27, 2021 at 3:55 PM EST Location UNITED STATES IP address 154.202.117.78 Password is only used for lastpass. It was caught since I use 2FA. I did previously have "The Great Suspender" chrome extension, which changed hands and had an update including malware, I wonder if this was the culprit. I last changed my master password on November 24, 2017, the previous exploit was appar…

Wow. Truly insane to see all of these confirmations pile up.

And like you, my master password dates back to 2017.

So there was another exploit after 2016? Or a much more recent one?

I haven't used The Great Suspender in the past.

Re: Ask HN: How did my LastPass master password get leaked?

#225

Post by gregsadetsky »

Dma54rhs wrote: post #173
dogman123 wrote: post #39

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

Mine was from India, master password definetly unique and very strong. I'm still hoping for some bug that mass alerted every day login attempts instead of actually gaining access.

I'm hoping for an email bug / false positive too.

Also, incorrect login attempts (i.e. using the wrong password) does not send out an email.

If you do attempt to login with the correct master password from a different/new IP, then you'll get the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email.

Re: Ask HN: How did my LastPass master password get leaked?

#227

Post by leftpass »

gregsadetsky wrote: post #207
leftpass wrote: post #202

Earlier quoted context omitted.

I thought that LastPass didn't send your master password over the wire, rather it uses client-side code to take your Master Password and turn it into a hash which is then sent to LastPass for comparison[1]. If that is the case, how can LastPass claim to know that your master password was used? At best, they can claim that the hash sent to the server matches your password's hash but that is not the same as your master…

Very interesting theory! What's a bit surprising is how "low effort" the rest of the attack was: presumably if they found this flaw to bypass passwords, they then attempted to login (which caused an email to be sent out), but LastPass stopped them because they (i.e. the folks on the Brazil IP range) were logging in from a new IP. So this would be a case of one protective layer (the new IP detection) compensating for…

Another possibility is that one of their (many) previous security incidents led to the leaking / exposure of master password hashes, and maybe LastPass don't treat the password hashes as they should (as a password!) and didn't take steps to ensure that any compromise hashes couldn't be re-used. So, potentially, your master password is safe, but there's a hash of it floating around.

Personally, I've long recommended people stay well clear of LastPass for their bad record of security, so shipping a bug in password-hash verification, or treating password hashes haphazardly would not surprise me in the slightest.

Re: Ask HN: How did my LastPass master password get leaked?

#228

Post by grumblepeet »

trajcek wrote: post #215
grumblepeet wrote: post #209

I might be overreacting but if it’s true then it’s bad. Ive Been getting reports from my devices that all my accounts had been leaked in a data breach and I was thinking whaaa? What all of them? Wait a minute! Some of which I had generated complex long passwords for in Lastpass and even I didn’t know what the password was. So this fits. My Evernote account which I don’t use any more is showing logins from Brazil. I’v…

Is this all today? Also did you check account history on your LastPass before asking for account deletion?

Yes just checked earlier when I saw activity here. Ive actually been getting reports for a few days about accounts being in a breach from iOS and Google and I have diligently changed my passwords. Then looked at the old Evernote account and saw logins from Brazil and India. I use 2FA everywhere important but if this master is compromised then it’s all over. I cant delete my Lastpass account it is controlled by the organisation I work for. I can delete the entries there though. It is the old Evernote account that I’ve asked for deletion, and I’ve deleted all the notes. It it’s already too late there they has obviously downloaded everything already. Sorry for garbled text I’m on mobile and headed back to home to assess on my laptop there.

Re: Ask HN: How did my LastPass master password get leaked?

#229

Post by mastazi »

trajcek wrote: post #194

Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…

- Disable Lastpass MFA and use Google Authenticator (Authy)

could you please explain this point? Isn't LastPass Authenticator equivalent to Google Authenticator, Authy or any other TOTP app? Or is there something that makes it less secure than other apps? Perhaps because it has cloud backups?

Re: Ask HN: How did my LastPass master password get leaked?

#230

Post by hda111 »

nyolfen wrote: post #33
coderintherye wrote: post #12

Earlier quoted context omitted.

Bitwarden is great, highly recommend, it's open-source which adds to its trustworthiness and has a good track record of respecting users.

+1, you can host your own server as well https://github.com/dani-garcia/vaultwarden

Unofficial server so you probably should avoid the web application (or build it yourself from official sources). In theory it could contain malicious code that leaks your password.
Post reply on HN