LastPass: Notice of Security Incident
blog.lastpass.com
LastPass: Notice of Security Incident
1–10 of 141 posts
Re: LastPass: Notice of Security Incident
#2Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate.
> we have seen no evidence that this incident involved any access to customer data or encrypted password vaults.
One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Re: LastPass: Notice of Security Incident
#3Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary.
LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
Re: LastPass: Notice of Security Incident
#4Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Or just use the tools already on your computer.
www.passwordstore.org and stand up your own bare git repo.
Re: LastPass: Notice of Security Incident
#5This is definitely a better example of handling a breach, many others would disclose this years later (if at all) since nothing material has happened or is known to have happened.
We're looking at you Twitter / GitHub
Re: LastPass: Notice of Security Incident
#6Suppose that LastPass is compromised. What can an attacker do? Passwords are encrypted, with keys on users’ side.
Short of serving customers malicious JS code or an app to steal passwords, the production environment referred in the article can be made totally public, without secrets in vaults bring revealed, no?
Re: LastPass: Notice of Security Incident
#7Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Or just use the tools already on your computer. www.passwordstore.org and stand up your own bare git repo.
Pass with Yubikey is great! It’s amazing how much this simple shell script can conveniently do.
You can literary audit this password manager in 30 mins! Thus, I feel it’s more secure than a complex solution like LastPass, since the code is small and a Yubikey touch gives you a chance at one password (with other password managers the whole vault is unlocked and all passwords are at risk and may be extracted at once).
Pass has advantages over other password managers (even though it has some limitations too).
Re: LastPass: Notice of Security Incident
#8Not really a big worry, thanks to zero knowledge encryption. Glad it was disclosed. Probably not a fun time over there right now lol
Re: LastPass: Notice of Security Incident
#9Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
> Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary.
I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers.
My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading to the cloud, but even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere, so there's no need to limit myself to one company's servers. I can use whatever works best for my needs and won't have to worry about what I'd do if the one I was using goes under or becomes unavailable. In exchange for a little extra work you gain a ton of utility and resiliency
Re: LastPass: Notice of Security Incident
#10I like the way then handle the communication about the incident.
There 2 ways to interpret the message:
1. Someone managed to get access to dev credentials and exfiltrated source code (the part that is explicitly mentioned).
2. Someone managed to push code on behalf of the compromised account and they responded to this change (not mentioned, but otherwise how would they know the account was compromised - each SCM has its logging limitations).