How did LastPass master passwords get compromised? • Hacker News Board

Re: How did LastPass master passwords get compromised?

#31

Post by SavantIdiot » Thu, Dec 30, 2021, 4:21 PM UTC

wubbert wrote: post #20

This is exactly why I have never used LastPass, and have always stuck with KeePass (and KeePassXC). It is much more secure to keep all of my passwords locally than in the cloud.

This argument has never made sense to me. Keeping an encrypted password file in the cloud or locally makes no difference. There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Storing the encrypted database in the cloud and downloading it is the same as storing it locally if the decryption protocol is performed locally. If the decryption was done in the cloud I would agree with you, but that is not the case, so the two are the equivalent.

Re: How did LastPass master passwords get compromised?

#32

Post by sunshinekitty » Thu, Dec 30, 2021, 4:22 PM UTC

I stopped using lastpass a couple years ago now due to ill-communicated master password leaks, ever-rising fees, and buggy UX.

This seems par for the course, I can’t imagine any credible company or keen user actually using lastpass at this point.

Re: How did LastPass master passwords get compromised?

#33

Post by herodotus » Thu, Dec 30, 2021, 4:22 PM UTC

Update: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac...

Re: How did LastPass master passwords get compromised?

#34

Post by mgraczyk » Thu, Dec 30, 2021, 4:28 PM UTC

willis936 wrote: post #28

syvanen wrote: post #25

So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…

Which is exactly what you say when facing an existential crisis. If you have a master password leak you either: 1. lie about it and the truth never comes to light 2. lie about it and get caught and the consequences are the same as if you came clean If LP suffered a master password leak then there is no benefit to telling the truth.

One advantage of telling the truth is that you don't go to prison for fraud.

When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very long.

Re: How did LastPass master passwords get compromised?

#35

Post by NickBusey » Thu, Dec 30, 2021, 4:28 PM UTC

Just one of the many reasons I self host my password manager. Bitwarden hosted via HomelabOS.

Re: How did LastPass master passwords get compromised?

#36

Post by jerf » Thu, Dec 30, 2021, 4:29 PM UTC

skarz wrote: post #30

Passwords were NOT compromised. It is hackers using existing compromised email/password combinations on brute force attempts at Lastpass. That is why your Lastpass password should be a password that you have not nor will ever use on any other site.

I'm not sure we can concretely say there was no compromise.

However, at the moment I'm not satisfied that a compromise has been demonstrated, either. As near as I can tell, nobody has reported a compromise, just suspicious emails. That's not enough evidence to prove a compromise.

LastPass' response, so far, adequately covers what we've actually seen.

Re: How did LastPass master passwords get compromised?

#37

Post by md_ » Thu, Dec 30, 2021, 4:34 PM UTC

_aavaa_ wrote: post #27

syvanen wrote: post #25

So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…

That statement is too squirrelly for me to trust if my passwords were stored with them. “SOME of these security alerts” “were LIKELY triggered” “HAS BEEN solved” (Emphasis mine) How can the issue be definitely solved if you aren’t sure that they were actually triggered in error, if they were in error then it’s only some of them.

It's easy for me to imagine how you get here.

- Eng are still writing the postmortem

- Marketing want to put out a statement

- Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production

- Legal advises not to say anything definitive that they can't stand behind later

I don't see any of that as particularly damning or malicious. "We aren't yet sure, but have a suspicion and are still investigating" can come out like the LastPass blog post when run through the PR filter.

Re: How did LastPass master passwords get compromised?

#38

Post by smorgusofborg » Thu, Dec 30, 2021, 4:35 PM UTC

gruez wrote: post #13

jmull wrote: post #11

> "First of all, malware provides a level of access that makes hacking LastPass accounts unnecessary. If it can intercept or extract the LastPass master password, it can do the same for all other passwords as well." That logic doesn't really make sense. Malware might make hacking LastPass accounts unnecessary, but it would still be highly desirable (one target gives you everything else). Frankly, it feels like OP dec…

But if that were true you'd expect a bunch of other account compromises?

If it is a group accumulating passwords via extensions it would make a lot of sense to me if they planned to sell them like credit card data on bulletin boards.

I don't think individual financial accounts would sell that well without really knowing if you have the necessary associated email accounts, etc to delay detection of a fraud.

I also don't think such groups are necessarily sophisticated enough not to have someone slip up at stage 2 of their plan, give away a few accounts to boast, etc, etc.

Re: How did LastPass master passwords get compromised?

#39

Post by latortuga » Thu, Dec 30, 2021, 4:36 PM UTC

skarz wrote: post #30

Passwords were NOT compromised. It is hackers using existing compromised email/password combinations on brute force attempts at Lastpass. That is why your Lastpass password should be a password that you have not nor will ever use on any other site.

Plenty of folks who reported getting this email from LP, including myself, reported that they used a strong unique passphrase for LP only.

Re: How did LastPass master passwords get compromised?

#40

Post by trajcek » Thu, Dec 30, 2021, 4:36 PM UTC

palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

Thanks for writing this up! After reading LastPass' very vague response, they did not inspire confidence for me to stick around as a paying customer.

I am unsure if this is too small of a compromise for them to be able to a) care or b) spend resources on investigating or that they just don't know what's happening.