LastPass Says Source Code Stolen in Data Breach

Also make sure to read this article, most MFA methods that companies are currently using are a pretty much a joke.

https://www.bitsight.com/blog/analyzing-exposed-sso-credentials-of-public-companies

 

Email from LastPass:

 

FWIW

Perhaps a coincidence, but LastPass released a v4.05.0,1289 update for at least the macOS app yesterday that does not yet seem to be documented. LastPass major browser extension versions appear to be unchanged so far.

HTH

 

Another email from LastPass:

 

Hackers have been very persistent with LastPass.
It's architecture, design and structure of LastPass make it a target for hackers.

LastPass: Hackers Stole Customer Vault Data in Cloud Storage Breach

The LastPass Blog | Notice of Recent Security Incident

 

It seems to me that Lastpass is a target simply because it has people's passwords. What do architecture, design and structure have to do with it?

 

Came across something interesting on my Twit feed--what one can expect following the theft of LastPass data. In short: phishing attempts!

https://twitter.com/snipeyhead/status/1606116796477513728

 

I figured that from the beginning. It's the most productive thing they can do at this point. I know I've said it before but I'm glad I dumped them and had them delete my data. If only they would stop spamming me to try to get me to come back.

 

A very informative article is this one by Wladimir Palant:https://palant.info/2022/12/23/lastpass-has-been-breached-what-now/

 

Do you use a different cloud service now or do you manage it locally?

 

These guys can't even protect their own systems from getting hacked, what a joke. This would make me stop using cloud based password managers. BTW, the same happened with Okta which is supposed to protect other companies like Lastpass.

https://www.wilderssecurity.com/thr...digital-breach-by-lapsus.444787/#post-3122555

 

The first part is too alarmist for me. Baseline requirements for passwords are meant for general audience. Evidence shows that being too strict on password requirements for regular people backfired in many cases.
I don't think it is good idea to force all people accounts to paranoid, VIP level requirements. VIPs should follow advisories prepared for them. VIP, dissidents etc should have known better about their own password choices.

 

I use Sticky Password. You can do internet sync, LAN sync, or none at all.

 

What to Do About the LastPass Breach
https://www.youtube.com/watch?v=8uZ3QcrPCWk

 

Thanks for the video. My routine includes:

• Change the Master Password every 6 months with 20+ characters, A-Z, a-z, 0-9, Symbols.
• Change ALL my financial website passwords every 3 months.
• My other 100+ password websites: Put them in 4 groups. Every 3 months change the website passwords on one group. By the end of the year all passwords would be change.
• I only use a password manager for passwords. I do not store credit card numbers or any other sensitive information on a password manager.
• Use Two-Factor Authentication when possible.

I would do the above routine no matter what password manager I would use. It looks like a lot of work changing password all the time, but what else do I have to do. I'm retired, old and every day is a weekend for me.
So I believe I'm safe so far, I hope. Do I trust anything in the cyber world? Hell No!
Btw: ALL Password were changed when I learned of this LastPass breach.

 

You don't really need to regularly change passwords.
https://www.youtube.com/watch?v=asDNQEqAGLY

 

Though frequent password changes may not be the necessity, once recommended, the existing LastPass master password might benefit from a strength test:

The Password Meter​

Password Strength Test​

Technically, both appear to use the same algorithm, but even though the UI is more colorful, the “Password Strength Test” seems to have the tested password transit the Internet.

HTH

 

https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/

https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/#c000010r000001

 

https://blog.1password.com/not-in-a-million-years/

 

Haven't read everything yet, but it sounds a bit like what is being used by Passkeys?

 

Security experts blast LastPass for misleading users about stolen password vaults and data
By Ashwin - December 30, 2022

 

I do not trust password managers who use the cloud to store files. Mine has always been KeePass where I always have the master password database file on a flash drive.

 

I posted this elsewhere last nite cuz it just seemed, I dunno, flaky maybe? Not believable? Outrageous? Et Cetera?

It's the search result using Duck Duck Go in Firefox (uBO takes out the sponsored junk).

Spoiler: lastpass--what are you talking about?

Guess their work is cut out for them to catch up with this hyperbole. Neat word...hyperbole.