Hacker News Reader

There was some speculation over at /r/sysadmins that this was a dump of passwords that came from the compromise five years ago. I have no way to confirm/deny that.

I have MFA enabled with the google auth app- has there been any discussion that accounts with two factor auth are pwned as well?

View on HN

Lastpass used to run a phpBB forum where the login system used your lastpass master password to log in.

phpBB is notorious for security flaws. It doesn't seem unlikely that someone hacked the forum and modded it to leak user master passwords.

More info:

https://news.ycombinator.com/item?id=29706579

That speculation is in direct contradiction with everyone here who claimed their much more recent passwords had also been compromised.

Not necessarily. The 5 year old master password could have granted access to a service that made it possible to intercept the password change.

This was also happening to accounts that did not exist 5 years ago.

It might be that the previous leak completely or partially exposed the algorithm of LastPass's password generator, or some other commonly used tool, and people being targeted show up on other lists. Credential stuffing with a targeted list of generated passwords.

If passwords from other breaches fit the characteristics of a weak or compromised generator, that could also be used for targeting.

Reply on news.ycombinator.com