Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

341–350 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#341

Post by caladin »

somehnguy wrote: post #181
coryfklein wrote: post #126

FWIW, I migrated off paid LastPass onto the free BitWarden plan recently and my experience has been much improved. I was a huge LastPass proponent in the beginning and at the time they seemed like the obvious best choice in a field with few options. But they have definitely not been able to keep up with the times and their paid service just isn't even comparable to what is now available for free.

Similar story as you, promoted LastPass when it first started because it worked and was the obvious choice. About 3 years ago I finally switched to BitWarden after realizing Lastpass was never going to fix their terrible UI. A few months ago I switched to 1Password though and am very happy. It has a few nice QOL improvements over BitWarden IMO, though BitWarden was leagues better than LastPass at least. This post pro…

> It has a few nice QOL improvements over BitWarden IMO

Mind sharing what in particular you found to be QOL improvements? I'm curious.

Re: Ask HN: How did my LastPass master password get leaked?

#342

Post by seanwilson »

> Either the 3 of us had the same malware/Chrome extension

Is stealing the master password this way possible in practice? As far as I know, Chrome extensions cannot inject e.g. JavaScript into tabs and toolbar popups that are owned by Chrome extensions. Random pages and extensions are able to send string/JSON messages to an extension but message sources usually have to be on an allow list + JavaScript `eval` should be disabled in the Chrome extension context.

Re: Ask HN: How did my LastPass master password get leaked?

#343

Post by hellotesttest »

gregsadetsky wrote: post #336
hellotesttest wrote: post #327

Oh no it happened to me too Time Monday, December 27, 2021 at 2:07 PM EST Location Fair Lawn, NJ 07410, UNITED STATES IP address 172.245.155.253

Fascinating, we must be at about 20 independent reports here. When was your account created?

My account was created 13 years ago.

Re: Ask HN: How did my LastPass master password get leaked?

#344

Post by Nexxxeh »

gregsadetsky wrote: post #161
trevcanhuman wrote: post #154

Earlier quoted context omitted.

Hey guys I think that maybe this has to do with an exploit in the web browser LastPass extension about 5 years ago: HN POST: [0]. [0] https://news.ycombinator.com/item?id=12171547

Yeah, that's not impossible. Surprising that they sat on the passwords for so long, but this is quite possible. Thanks for the reference/link!

You don't necessarily know they sat on it. You only just got a notification of the failed login now.

That doesn't mean they didn't try stuffing it elsewhere previously, or have login attempts you weren't notified of.

Nor do you know if the entity responsible for the failed login is the one who originally captured the credentials.

If you'll forgive the wild speculation, your credentials could have been sold recently and the new owners are less picky about alerting victims to the breach.

It could be that a bunch of credentials were captured for a specific purpose. Perhaps it was a targetted attack aiming for a specific victim, you and others here were collateral damage, and now the attacker is selling the assets.

Re: Ask HN: How did my LastPass master password get leaked?

#345

Post by fomine3 »

Nextgrid wrote: post #178
explaingarlic wrote: post #70

Earlier quoted context omitted.

Is there an official counter for phpBB RCEs/vulnerabilities that revealed user passwords? This has been going on for decades now. It's getting ridiculous.

Welcome to frameworkless PHP where code & user files are stored in the same root and any PHP file requested by a web client is executed by the server. In most proper frameworks, including PHP ones, the only thing responding to web requests is an entrypoint file (that gets passed the request metadata including URL) and the framework takes it from there. This means that with proper configuration, even requesting a mali…

we miss cgi-bin/

Re: Ask HN: How did my LastPass master password get leaked?

#346

Post by deusex_ »

explaingarlic wrote: post #70
ComputerGuru wrote: post #7

Because LastPass is beyond stupid and uses your master password to log in to their bbulletin or whatever php forum. That’s what got me to write and publish this: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-... EDIT: "or whatever" means I couldn't remember the name of the php forum notorious for its insecurity, I thought it was something like 'bbulletin'. It was phpBB.

Is there an official counter for phpBB RCEs/vulnerabilities that revealed user passwords? This has been going on for decades now. It's getting ridiculous.

There is such a counter, CVE databases.

If you would actually take a look, you would realize you are spreading FUD.

phpBB has been rewritten from scratch around 2008 with phpBB3 and hasn't had a single severe vulnerability since. That's 13 years.

Re: Ask HN: How did my LastPass master password get leaked?

#347

Post by raverbashing »

dogman123 wrote: post #39

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

That IP is not from Brazil. It revert-resolves to keznews.com (Looks like it's registered in Prague)

If you try hitting it, it will redirect you to some website which might or might not be the same to every person

Re: Ask HN: How did my LastPass master password get leaked?

#348

Post by chmod775 »

aidos wrote: post #83
ComputerGuru wrote: post #48

Earlier quoted context omitted.

They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here: https://web.archive.org/web/20150629081250/https://forums.la... Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master…

Unless I’m misremembering, the login to their general system was done by never sending the password over the wire. Instead they used js to do some sort of hashing type system locally. But during the heartbleed attack when their systems were shown to be vulnerable, that was one of their arguments as to why it wasn’t so bad.

> Instead they used js to do some sort of hashing type system locally.

Just the other day a co-worker brought up this idea as an offhand remark. After bouncing it off those present, it took him all of twenty seconds to see why it might do harm and will do little good.

You'd think a password manager would employ some security minded people who could shoot down ideas that bad immediately.

Re: Ask HN: How did my LastPass master password get leaked?

#349

Post by mulmboy »

Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrome extension.

``` Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look.

Was this you?

Account xxx@xxx.com Time Monday, December 27, 2021 at 12:06 PM EST Location Berlin, BE 12529, GERMANY IP address 196.19.169.161 ```

Post reply on HN