LastPass: Notice of Security Incident

Post by [deleted] » Thu, Aug 25, 2022, 11:24 PM UTC

insane_dreamer wrote: post #58

schmichael wrote: post #41

Earlier quoted context omitted.

If the password journal my mom left at my house while visiting is any indication: absolutely not. Use a password manager, remember a 2nd password for your email yourself, and then use a second factor for as many things as possible. USB keys are best, but anything is better than nothing: SMS, Authy, Google Authenticator, phone call, whatever. Chrome and Safari both have password managers these days, and some Chromeboo…

The password journal is probably the safest providing the passwords themselves are strong. The likelihood of someone compromising your mom's passwords online are an order of magnitude greater than someone breaking into her house and copying her journal.

Post by koolba » Thu, Aug 25, 2022, 11:37 PM UTC

schmichael wrote: post #33

jrm4 wrote: post #21

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, bu…

Not sure I follow. As stated in the article LastPass does not have the "key" (Master Password) in this case, so a straightforward reading of your comment suggests there's nothing to be worried about here. However I think what you're saying is that even trusting encrypted bundles of secrets to third parties is a bad idea? Even on this point I have to disagree because that's precisely what 2FA is for. Even if LastPass…

Post by paultopia » Fri, Aug 26, 2022, 12:03 AM UTC

jrm4 wrote: post #21

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, bu…

Post by notmelgibson » Fri, Aug 26, 2022, 12:19 AM UTC

FridgeSeal wrote: post #52

I wonder if this is a “precursor” attack to the likes of a solar-winds style compromise? Get into their dev env (ideally unnoticed), exfiltrate the sensitive code you need, poke around their systems. Once you’ve got a handle on their code and have figured out what to add, do so and just begin the waiting game. Maybe that’s all happened, and this attack is “air cover” for the last-stage.

Post by mancini0 » Fri, Aug 26, 2022, 12:22 AM UTC

insane_dreamer wrote: post #60

mancini0 wrote: post #37

Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The comm…

so simple even my grandma can do it! ;) in all seriousness, Lesspass has a cool concept (I hadn't heard of them before, just looked at their website now). I'd be interested in hearing what cryptography/security experts think about it.