Lastpass compromised

Should have been using Bitwarden. You can even self host if you want. But regardless it's open source and end to end encrypted.

If the company managing your passwords has a backdoor so can any attacker.

If you're going to go that drastic then why not just not even write anything down and reset your password every frickimg time you log in, right?

Of course not, because there comes a point where inconvenience outweighs security.

I thought the master passwords were hashed.

quote:

---

They are, but still crackable.

---

This is pretty in depth coverage of the event. LINK / The TL;DR version is if you are Joe Six Pack and used a reasonably long master password you should be fine, just watch out for phishing attempts. If you're a 1 Percenter worth throwing the computer resources at, they can crack it and you should probably change all of your passwords now.

Y'all know all of your bank accounts (Regions.com, USAA.com, etc.), cell phone service (ATT.com, iCloud phone backups), etc., are all hosted on "a cloud?" The ability to move money presents a far greater fraud impact than anything else.

Focus on the right targets: password re-use and weak passwords, particularly master passwords.

Teaching people how to sync passwords using local storage will get you laughed at by 99.999999% of people. They'll just keep using "geauxtigers" for every single website and service that they use.

I switched to Bitwarden years ago, but that was more of a functionality issue than anything else.

quote:

---

Your passwords in Lastpass are still safe though.

(unless you used a weak password)

---

Even strong passwords are crackable eventually.

quote:

---

The architecture of products like LastPass and Bitwarden are that they don't know your passwords and they don't know or store your master password to the vault. This protects you against bad actors be it internal or external to LastPass.

---

This is true of every site or service with a password (at least it should be), but the thing about password managers is you only have to crack one password to crack them all (for a given user). That makes each one of much higher value than typical account passwords and as such more resources may be devoted to cracking them. Especially since, as mentioned in the link posted above, LastPass apparently didn't encrypt URLs stored in the vaults giving the attackers a super effective way to sort cracking priority.

quote:

---

Not really, in practical terms.

---

Security recommendations are updated often because what was once impractical has become practical. I don't expect that to end.

quote:

---

Nope, not even close. Most sites have sys admins that can technically access your data either directly, through delegation, or by resetting your pw and logging in. This is true even with big secure companies like Google. Just ask the FBI, NSA, DHS, and CIA.

---

Your data in many cases yes, your password no. And yes they can reset your password but they cannot reveal or recover your existing one (without brute force cracking).

I do realize that the password vaults (your data) are encrypted whereas a lot of other sites and services store your data unencrypted, however that does not make me feel warm and fuzzy inside because still only one password has to be cracked to reveal dozens or hundreds more.

The encrypted data is out there. It can't be taken back or encrypted any stronger. All passwords ever stored with LastPass have to be assumed compromised.

quote:

---

So should people be worried? I have everything on LP. I got their email about this and they played as though it's going to be fine. I changed my Master, even though it was already a good password, as I figured another new long one wouldn't hurt. Am I likely safe?

---

Yes, you will be fine so long as your master was a decent password and was unique. Changing your master now doesn't really help because your master in their copy of the vault will never change. You should always use two-factor authentication when possible.

Big tech is trying to move away from passwords, believe it or not.

quote:

---

Yikes. I had a unique password. It was 12 characters and nothing that could tie to me, but if they have a long time to just keep trying then who knows...

---

The passwords your LP account was protecting will be susceptible forever unless you change them along with your 'master' pw.

Are you likely to be targeted? Who knows, but I know I would spend 5 minutes of my day to change all my pws if it were me.