Current Events > Lastpass says hackers stole customers' password vaults

(+) Yeah! (+)

https://techcrunch.com/2022/12/22/lastpass-customer-password-vaults-stolen/

Password manager giant LastPass has confirmed that cybercriminals stole its customers encrypted password vaults, which store its customers passwords and other secrets, in a data breach earlier this year.

In an updated blog post on its disclosure, LastPass CEO Karim Toubba said the intruders took a copy of a backup of customer vault data by using cloud storage keys stolen from a LastPass employee. The cache of customer password vaults is stored in a proprietary binary format that contains both unencrypted and encrypted vault data, but technical and security details of this proprietary format werent specified. The unencrypted data includes vault-stored web addresses, but LastPass does not say more or in what context. Its not clear how recent the stolen backups are.

LastPass said customers password vaults are encrypted and can only be unlocked with the customers master password, which is only known to the customer. But the company warned that the cybercriminals behind the intrusion may attempt to use brute force to guess your master password and decrypt the copies of vault data they took.
Toubba said that the cybercriminals also took vast reams of customer data, including names, email addresses, phone numbers and some billing information.

Password managers are overwhelmingly a good thing to use for storing your passwords, which should all be long, complex and unique to each site or service. But security incidents like this are a reminder that not all password managers are created equal and can be attacked, or compromised, in different ways. Given that everyones threat model is different, no one person will have the same requirements as the other.

Hope no one kept their GameFAQs passwords on there..:

My work has always heavily pushed LP but Ive never used it.

Dodged a bullet, I guess.

Paper beats password manager

Trumpo posted...

Paper beats password manager

Scissors beats paper

CE_gonna_CE posted...

My work has always heavily pushed LP but Ive never used it.

Dodged a bullet, I guess.

My last job still uses LastPass, I think. My current job doesn't, though. We use 1Password, and I think 1Password is much better.

Just make sure to use a password that is long enough it would take years to brute force (I mean hundreds of years or more, as CPUs improve then estimates today will drop). Theres sites out there that will tell you that info

and then make sure to reset your passwords every 6-12 months so that eventually when your vault is brute forced, the passwords in there are all invalid regardless

my job uses LastPass as well, Im not a fan of it. I use 1password personally because the apps are far nicer with more features. Even Bitwarden is better than LastPass IMO, but 1password is more premium feeling than Bitwarden so I dont mind paying the fee

Oh Jesus fuck this is gonna cause problems at work

Password manager is an oxymoron. Darwin awards for everyone who uses one.

TheValiant posted...

Password manager is an oxymoron. Darwin awards for everyone who uses one.

? They are fine lol. Just cycle your passwords and make them long.

That's the last place I'd put my pass.

TheValiant posted...

Password manager is an oxymoron. Darwin awards for everyone who uses one.

That's a dumb take. Just use a manager that doesn't need to go online like KeePass. I've been trying to tell people for years that this was inevitable.