LastPass Hack

[Etern4l]

LastPass users: Your info and password vault data are now in hackers’ hands

 

 

[Azther]

On 12/25/2022 at 4:12 PM, Etern4l said:

LastPass users: Your info and password vault data are now in hackers’ hands

 

 

And people thought i was being overly paranoid for using KeePassXC instead for an offline portable solution lol, sad that this has occurred but on the other hand glad i decided to go the offline route.

[jaybee83]

11 hours ago, Azther said:

And people thought i was being overly paranoid for using KeePassXC instead for an offline portable solution lol, sad that this has occurred but on the other hand glad i decided to go the offline route.

absolutely best route to go! especially for such a simple app, u dont need to take every shitty lil thing online these days, geez...

[electrosoft]

18 hours ago, Azther said:

And people thought i was being overly paranoid for using KeePassXC instead for an offline portable solution lol, sad that this has occurred but on the other hand glad i decided to go the offline route.

 

7 hours ago, jaybee83 said:

absolutely best route to go! especially for such a simple app, u dont need to take every shitty lil thing online these days, geez...

 

Yep, I use no online keychain anything even Apple. As much as I love my iphone/ipad, I keep everything external and portable.

 

Keeping anything like this in a cloud based service is just asking to be compromised. Once compromised, all your information is open for the taking.

 

 

[Papusan]

Yep, LastPass play Russian roulette with your security. On top they want that you pay for it. What a great deal. They should offer their services for free the next one or two years for already paying customers. This if they still want their services.

 

 

The latest LastPass fail came from an employee’s home PC

A key component of the 2022 hack was an employee's home computer that was running vulnerable third-party software.

[Papusan]

LastPass Employee Could've Prevented Hack With a Software Update pcmag.com

The hacker exploited a vulnerability in the Plex Media Server software that was patched in May 2020. 'The version that addressed this exploit was roughly 75 versions ago,' Plex says.

 

 

[Sandy Bridge]

I didn't really understand just how bad LastPass's security practices were until reading this post on Mastodon from a Yahoo! security engineer.  It's a bit long and a bit technical, even as a professional developer with some interest in security, but he's not kidding when he says they committed essentially every crypto 101 sin.  Roll their own crypto... use outdated encraption rather than modern encryption... store the entire vault unencrypted in memory... tracking all the sites you log in to... I could go on (and the Yahoo! guy does), but it makes you wonder what they spent all their revenue on to have so many flaws.

 

Meanwhile, KeePass, which doesn't have a revenue model, has none of those flaws, and not just because it's offline but because it's designed with security in mind.  It sounds like 1Password and BitWarden are significantly better-designed as well.

 

Maybe LastPass was always just an service that had a good user interface and the idea of only having to know one password, but they never really did know anything/care about security?

 

Now the question is, will it do enough reputational/financial damage to make a difference?  Will the tech press stop recommending LastPass, or even call out "whatever you use, don't use LastPass?"  I'm skeptical.  It wasn't until I read the Yahoo! guy's post that I realized how bad the rot goes, so how's the average person going to realize it's a house of cards?  Though there is a class action lawsuit about it now, so that's something...

 

Edit: There's also a great breakdown by a Polish guy that's not as technical as the Yahoo! one but still does a great job of conveying why this is a big deal.  One of the takeways is the longer you've been a LastPass user, the easier your database is to crack!  Not a good way to reward their customers!