Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#81

Post by boringg »

dogman123 wrote: post #66
gregsadetsky wrote: post #57

Earlier quoted context omitted.

How old approximately was your account? I used my master password the last time in 2017... were our master passwords compromised back then... and someone held on to them for that long? That seems improbable?

just checked my email. last pass account was created in 2015, not sure if the current leaked password has been in use that whole time, but it has definitely been quite a few years. moved over to 1passward in march of this year and likely have not used last pass at all since.

What prompted the move to 1password? Curious as I am deciding myself which service to use.

Re: Ask HN: How did my LastPass master password get leaked?

#83

Post by aidos »

ComputerGuru wrote: post #48
gkoberger wrote: post #18

Earlier quoted context omitted.

After a bit of searching, I wasn't able to find any PHP forum software that LastPass lets you log in to. I could only find one official-seeming forum, and it uses a different login. So, I think this is FUD... I don't use LastPass, but accusing them of something like this (and using the phrase "or whatever") is pretty serious without proof.

They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here: https://web.archive.org/web/20150629081250/https://forums.la... Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master…

Unless I’m misremembering, the login to their general system was done by never sending the password over the wire. Instead they used js to do some sort of hashing type system locally.

But during the heartbleed attack when their systems were shown to be vulnerable, that was one of their arguments as to why it wasn’t so bad.

Re: Ask HN: How did my LastPass master password get leaked?

#84

Post by vbo »

ChrisMarshallNY wrote: post #41
gregsadetsky wrote: post #5

Earlier quoted context omitted.

Thanks Sending emails to support@lastpass.com doesn't work ("This inbox is not monitored") and I have to upgrade my account to contact their support, which I'll do right away. EDIT: after checking, the login attempt does appear in my Account History (my original email said it didn't -- I wasn't looking in the right place)

I suspect that it was a random phishing attempt. > Login attempt blocked > Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Looks fairly classic. Might want to look at the email headers, to see if it really came from LastPass. I get about ten of these a day. Some are scarily w…

Quick note that apple allows you to download a recovery code and disable all other account recovery mechanisms which I found incredibily soothing.

Re: Ask HN: How did my LastPass master password get leaked?

#85

Post by gregsadetsky »

cosmojg wrote: post #80
gregsadetsky wrote: post #57

Earlier quoted context omitted.

How old approximately was your account? I used my master password the last time in 2017... were our master passwords compromised back then... and someone held on to them for that long? That seems improbable?

What browser extensions do you have installed?

I don't remember which extensions I had in 2017, unfortunately...

Re: Ask HN: How did my LastPass master password get leaked?

#86

Post by jacquesm »

gregsadetsky wrote: post #51
anotheryou wrote: post #42

Does lastpass have a login history? first thing would be to check if the mail is genuine

Completely agree. I did check and my Account History is showing the same info. I also talked to their support and they confirmed this info.

That's really bad news.

Re: Ask HN: How did my LastPass master password get leaked?

#88

Post by Godel_unicode »

gregsadetsky wrote: post #74
ajb wrote: post #71

Earlier quoted context omitted.

Not sure it's really in Brazil. LACNIC says the IP range was transferred to AFRINIC. They then say that it is owned by: Affiliated Computing Services (Pty) Ltd descr: P. O. Box 261333 descr: Excom 2023 country: ZA But then further note that ownership is in dispute! We need someone to look it up in the current routing tables to see where it's presently being routed to.

I also saw that very weird thing -- Brazil vs AFRINIC. Help/insight from ASN? BGP? networking experts would be appreciated..! Thanks a lot

That IP is present in a cn record for visit[.]keznews[.]com, whose whois record lists an admin contact in CZ.

Be very wary of geo-ip results, on the modern internet they are effectively useless.

Re: Ask HN: How did my LastPass master password get leaked?

#89

Post by techknight »

gregsadetsky wrote: post #69
dogman123 wrote: post #66

Earlier quoted context omitted.

just checked my email. last pass account was created in 2015, not sure if the current leaked password has been in use that whole time, but it has definitely been quite a few years. moved over to 1passward in march of this year and likely have not used last pass at all since.

That's really so strange. What is the probability that you, techknight (the other user in this thread) and me used the exact same compromised software back in ~2017 and had our master passwords stolen then? And for that person/bot (in Brazil) to try all of those master passwords now? It's beginning to look like this is a LastPass issue, no..?

LastPass was my first thought, but I couldn't find anyone else having the same issue and decided it couldn't possibly be them. Now I'm not sure!

I've emailed you a list of the extensions I use in Chrome - if you want to share publicly any that we have in common I'm okay with that

Re: Ask HN: How did my LastPass master password get leaked?

#90

Post by komatsu »

cassepipe wrote: post #63

Not an answer to OP but I had seen that that on HM a while ago : https://www.lesspass.com/ Really liked the idea of not having to rely on a third-party ... But I never used it because of Firefox master password and sync functionality. Too lazy.

I wonder how secure is the Firefox solution vs LastPass and others.
Post reply on HN