Does lastpass have a login history? first thing would be to check if the mail is genuine
Completely agree. I did check and my Account History is showing the same info. I also talked to their support and they confirmed this info.
Ask HN: How did my LastPass master password get leaked?
51–60 of 529 posts
Re: Ask HN: How did my LastPass master password get leaked?
#52This just happened to me today, but login location was Bangkok. I also haven’t used my lastpass account in almost 2 years since I switched to Bitwarden, so no way this could have stolen from my computer recently
Re: Ask HN: How did my LastPass master password get leaked?
#53Earlier quoted context omitted.
Thanks Sending emails to support@lastpass.com doesn't work ("This inbox is not monitored") and I have to upgrade my account to contact their support, which I'll do right away. EDIT: after checking, the login attempt does appear in my Account History (my original email said it didn't -- I wasn't looking in the right place)
I suspect that it was a random phishing attempt. > Login attempt blocked > Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Looks fairly classic. Might want to look at the email headers, to see if it really came from LastPass. I get about ten of these a day. Some are scarily w…
I checked and the same information regarding the attempted login appears in my LastPass "Account History". I also talked to support and they've confirmed this.
Re: Ask HN: How did my LastPass master password get leaked?
#54Look at the email headers and post them here. Was the email actually from lastpass????!!!
Re: Ask HN: How did my LastPass master password get leaked?
#55Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235
WHAT!! Same IP range for me. How is this possible????
not sure, but this seems pretty bad! fwiw, i haven't used lastpass in at least a year. i've been using 1password.
Re: Ask HN: How did my LastPass master password get leaked?
#56Earlier quoted context omitted.
Bitwarden is great, highly recommend, it's open-source which adds to its trustworthiness and has a good track record of respecting users.
+1, you can host your own server as well https://github.com/dani-garcia/vaultwarden
There's an official self-host open source version as well ( the one you linked is unofficial), but it's rather heavy ( multiple .NET services, MS SQL) and not adapted for small scales.
Re: Ask HN: How did my LastPass master password get leaked?
#57Earlier quoted context omitted.
WHAT!! Same IP range for me. How is this possible????
not sure, but this seems pretty bad! fwiw, i haven't used lastpass in at least a year. i've been using 1password.
How old approximately was your account? I used my master password the last time in 2017... were our master passwords compromised back then... and someone held on to them for that long? That seems improbable?
Re: Ask HN: How did my LastPass master password get leaked?
#58Earlier quoted context omitted.
Yes, I do copy/paste from my local password manager. A clipboard scraper is a possibility, yes. I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier. Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks
Personally I just stick to local Keepass database files. I’ve never ventured into the cloud based services. If you are really worried about it, do you really need to use a cloud based password service? Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up ov…
Same here, I use KeePass on several Windows machines, and on a couple of Android phones (using KeePass2Android). I use a cheap VPS as a central point for syncing - so I can make changes on any machine, then sync them over SFTP, which merges the changes into the database on the VPS. I can then hit sync on any of the other machines, and it will pull down the latest database over SFTP and merge in the changes.
It sounds a bit complicated reading this back, but in reality it's pretty straightforward.
Re: Ask HN: How did my LastPass master password get leaked?
#59Earlier quoted context omitted.
After a bit of searching, I wasn't able to find any PHP forum software that LastPass lets you log in to. I could only find one official-seeming forum, and it uses a different login. So, I think this is FUD... I don't use LastPass, but accusing them of something like this (and using the phrase "or whatever") is pretty serious without proof.
They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here: https://web.archive.org/web/20150629081250/https://forums.la... Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master…
Thanks, that's pretty damning.
Re: Ask HN: How did my LastPass master password get leaked?
#60Look at the email headers and post them here. Was the email actually from lastpass????!!!
Yes, the same information appears in my Account History and LastPass support confirmed it.
So in this case, it's not a phishing attempt unfortunately.