321–326 of 326 posts
Earlier quoted context omitted.
all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here) https://news.ycombinator.com/item?id=27407603
Seems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?
Earlier quoted context omitted.
Given these experiences, especially the same message after changing the password, makes me think that LastPass’ message is wrong - that it claims someone used your password, but the attacker is not actually doing so. This would explain all the data I’ve seen so far, including LastPass’ reaction. Speculation: LastPass might use this message even if someone tries an old password? Does that fit the data so far?
That's an interesting new avenue -- that older passwords are/were recognized too. I just tried my old password and the error message only says to check the password -- there are no emails sent saying that someone attempted to log into my account with my password. LastPass did change their systems, supposedly correcting for the issue that we all saw. So the test I just did also isn't really indicative of how their sys…
I switched to using icloud keychain a while back, after a breach LastPass had a few years ago.
Protip: even if you don't use LastPass any more, check if you deleted your account when leaving the service.
They currently have disabled deletion of accounts. Everyone is getting a "A" error when trying to do so.
(I removed my account recently and got the same error message, everything seems to be gone now)
Earlier quoted context omitted.
If AES being broken is in your personal threat model, you have far more to worry about than passwords.
What if its broken in 10 years? Or in 50 years? Eventually it will be.
Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…
It still seems that the most likely answer might be that lastpass are incorrectly alerting that someone's correct passphrase had been used, and that the email is being triggered by a bug, or something like a login attempt using the wrong password from a suspicious IP. The fact that lastpass support says that it means that the correct password was used doesn't mean it's true, the support staff might just be mistaken.
Earlier quoted context omitted.
My setup: - Windows Desktop - Macbook Air I installed Keepass on my windows desktop along with iCloud drive sync. I keep my Keepass database in my iCloud directory. I can now use this Keepass database on my iPhone (via Files app), on my Macbook (iCloud Drive). Any changes made are automatically synced daily. Is that really too difficult? And yes, it does "just work". Bonus: Any passwords stored in my iCloud Keychain…
For what it's worth, my attempt at using Keepass drove me away because the password database kept becoming conflicted, necessitating a merge. Keepass' options for dealing with conflicts were to "accept mine" or "accept theirs", but I'd often end up in situations where the conflict went sideways and I lost my login completely. In the end I was running the conflict resolution command once every couple days. Normally I…
I have written a CLI tool in Rust called keepass-diff that may help you with this: https://github.com/Narigo/keepass-diff