Just had this in an email, not sure if this is widely known or not, however I used to use Lastpass, so thought worth sharing, this is the second time it has happened
Dear valued customer,
Dear valued customer,
In keeping with our commitment to transparency, we wanted to inform you of a security incident that our team is currently investigating.
We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement.
We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass's Zero Knowledge architecture.
We are working diligently to understand the scope of the incident and identify what specific information has been accessed. As part of our efforts, we continue to deploy enhanced security measures and monitoring capabilities across our infrastructure to help detect and prevent further threat actor activity. In the meantime, we can confirm that LastPass products and services remain fully functional. As always, we recommend that you follow our best practices around the setup and configuration of LastPass, which can be found here.
As is our practice, we will continue to provide updates as we learn more. Please visit the LastPass blog for the latest information related to the incident: blog.lastpass.com/202…nt/.
We thank you for your patience while we work through our investigation.
40 Comments
sorted byHacking / data leaks are a part of life now and the only way to reduce the impact is to minimise our online footprint. So if a retailer forces me to create an online account, I abandon the shopping cart (unless it is a phone + pens + bidet deal ). I just don't see any alternative given how dependent we all are on technology now.
Then add on something that you commit to memory but have not saved anywhere - example: Archer
So password for site A = R2&$YU4WArcher
Password for site B = 7*#pVw2!Archer
If password manager is breached, the generated part may be compromised, but the salt you use would not be.
The majority of attackers would use credentials to brute force. But attempting to brute force with only the generated portion of the password would not work.
There is always a balancing act between security and convenience. Of course in an ideal world you'd use a unique password on every site and commit to memory without storing it anywhere. However, a password manager is markedly better than reusing the same passwords which most do. It's just important to find a reliable, trustworthy, secure solution - not Lastpass.
Can't have all your eggs in one place n that (edited)
I've used safeincloud for years, and although I sync my passwords via Google drive as an encrypted file, the passwords don't sync with their own servers, just stored within the app on the device, and works well for me. But how safe is that......? So far so good, until it isn't I guess?
I do worry about how safe all these managers are, even when I save my passwords through Google I think about what 'could happen' and ask myself is this really safe?
If you need, use only local app if you need to.