LastPass breach is worse than you think because URLs were unencrypted | Hacker News Reader

LastPass breach is worse than you think because URLs were unencrypted

twitter.com

70 pointsscarygliders106 comments

This is unbelievably bad. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of:

- Customer Names

- Company Names

- Email Address

- Billing Address

- Telephone Numbers

- IP addresses (from where customers accessed the service)

- Website URLs saved in LastPass vaults (LastPass doesn't encrypt the website URLs)

- Encrypted vaults

That is a massive privacy violation and a puts every customer at risk for massive automated phishing, blackmail, and doxing. They marketed the whole vault as being encrypted in their Zero Knowledge architecture(TM).

And LastPass probably knew since AUGUST and tells us the day before Christmas. Note to obfuscating, dense language in the blog notice. Specifically "unencrypted fields such as website URLs", implying other vault fields could have been unencrypted but they can't/won't say.

LastPass will not survive the pending customer exodus and class action lawsuits.

Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts.

> tells us the day before Christmas.

there is probably a technical word for this similar to when news is released Friday night to suppress it. what is that called?

I see it being called "The Friday Afternoon Dump" here [1]. The PR and marketing term for finding best timing is "press release timing".

Weekends are a prime candidate because press and journalists are off, but social media thrives in weekends. Friday afternoon is the sweetspot if you want to avoid press and social media virality.

1. https://xenophonstrategies.com/the-friday-press-release/

> LastPass will not survive the pending customer exodus and class action lawsuits.

Literally nothing will happen. Mark my words.

Don't know where you are getting this fantasy of the company not surviving, and class action lawsuits. Every similar example in the last 10-15 years that I remember was the same (people forgot after a week and nothing happened).

>Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts.

Why didn't you just use decent passwords in the first place? You were using a password manager, what's the fucking point if your password is still "kittens1"?

This is all on you.

Because the password manager storing the strong, randomized passwords is now compromised, you walnut.

Only the encrypted randomized passwords were leaked. Unless you knowingly used a bad password for your cloud-based password manager, you're fine.

If you did use a bad password for the cloud based password manager, you're the walnut. The whole sales pitch is that lastpass can't fuck you as long as you have a reasonable password protecting your vault.

Your encrypted data is compromised, it is in the hands of an attacker who really wants to decrypt it. You're pinning all of your digital security on encryption holding against an active attacker. What if there is an undiscovered or undisclosed vulnerability in the encryption? What if last pass isn't using encryption as secure as they claimed? What if the attacker just gets really lucky and your password is in the first thousand bruteforce attempts?

Same rationale applies when a random website gets hacked and leaks their password database. Yes, your password is salted and hashed, and hypothetically unrecoverable. But you change your password anyway.

You have the option to guarantee your accounts are secure, or do nothing and hope it will be fine.

There's a lot of situations where your vault might be decrypted. Sure, they're all pretty unlikely, but the risk is not zero. Changing your passwords does make that risk zero.

You're already fucked. LastPass lied in their sales pitch, and they released a bunch of your data unencrypted. Having absolute trust in their encryption as your sole layer of security at this point is incredibly reckless and stupid. You don't know that your master password isn't uncompromisable, you're trusting the company's sales pitch, and they've already lied to you. There is no reason at all to assume your vault will be secure forever.

n? What if last pass isn't using encryption as secure as they claimed? What if the attacker just gets really lucky and your password is in the first thousand bruteforce attempts?

This is why you always do your own encryption on offline computer using trusted tools like VeraCrypt . Relying on cloud storage to encrypt is doomed to fail eventually.

> Your encrypted data is compromised, it is in the hands of an attacker who really wants to decrypt it. You're pinning all of your digital security on encryption holding against an active attacker.

Well, yeah. Just like you leak your encrypted password to the internet every single time you log into a website.

>What if there is an undiscovered or undisclosed vulnerability in the encryption?

lmao, if aes-256-cbc is broken then LastPass is probably the least of anyone's concerns. This happens to also be one of the more difficult AES modes to screw up.

>What if last pass isn't using encryption as secure as they claimed?

Shit, if that was a real concern you would have to be a complete idiot to use LastPass in the first place.

What proof do you have that last pass uses that encryption scheme? Is there any evidence to suggest that it meets rigorous standards?

Remember that last pass has just been caught lying about their security, and you can't trust what they say.

Calling other people idiots just makes you look like an uninformed asshole, so stop that. You're wrong, and you're trying to justify yourself rather than just back down.

Changing passwords in the face of a breach like this is standard practice and is the only logical step forward. You cannot trust last pass security from this point forward. Whether or not you should have trusted them in the first place is irrelevant in the extreme.

Last pass users should change their passwords, period. Telling those users that they're idiots who shouldn't have trusted them to begin with makes you look foolish and toxic.

Do better.

>Remember that last pass has just been caught lying about their security, and you can't trust what they say.

I'm curious, what were they caught lying about?

>What proof do you have that last pass uses that encryption scheme? Is there any evidence to suggest that it meets rigorous standards?

LastPass has been extensively reverse engineered. There are, for example, public Defcon talks about it.

>Changing passwords in the face of a breach like this is standard practice and is the only logical step forward.

This is not logical at all.

>You cannot trust last pass security from this point forward.

Why not? Because they disclosed a breach?

AES CBC not broken, but it's likely LastPass implementation of AES was bad , such as bad RNG or other possible problems.

Why do you think it is likely? That's a very strong claim.

> such as bad RNG

How could that be a problem? The attacker doesn't control your passwords. How would you exploit a known IV as an attacker in this context?

there are many ways the encryption could have been implemented badly. a weak RNG is one

Do you actually know anything about this subject, or are you just speculating?

faulty implementation of crpyto is not unheard of. it happens a lot.

Yes, but how exactly is the LastPass implementation faulty? In your other comment you claim to know that it is.

>Shit, if that was a real concern you would have to be a complete idiot to use LastPass in the first place.

What are you even talking about? Of course it's a real concern. That exact kind of thing happens constantly. And of course, the nature of the concern here involves us not knowing that LastPass was fucking up. LastPass might not even know. It's not like companies regularly announce in public, "hey, customers! We're actually massive fuckups, we know it, we haven't fixed it, and we just thought you'd like to know!"

If you don't trust LastPass to encrypt your passwords properly, why would you use it at all?

>That exact kind of thing happens constantly

Like when?

>And of course, the nature of the concern here involves us not knowing that LastPass was fucking up.

What do you mean? The cryptography used by LastPass is very well understood.

well understood and badly implemented, which is the same as no encryption

How is the LastPass encryption badly implemented?

In your other comment you claimed it was "likely" to be badly implemented, but here you state it as a fact. What's up with that?

Rest assured I have a strong master password that would take in the order of 10^2 years to bruteforce, not taking any chances though.

https://twitter.com/jsrailton/status/1606195077939744768 seems to be the new working URL.

i have been a hardened user of keepass and it is strange to find people who "HATE" the idea of keepass over anything online, bitwarden or lastpass or 1password or whatever BS "zero knowledge backup" or other nonsense. you dont need to have LIVE SYNCING for your passwords.

i have a keepass on my laptop and its copy on my phone. if occasionally i have to update anything, i do that and copy the file to the other place. say i update on the phone so next time i just share the file to the laptop and i am synced.

this "janky" method has worked for over 5-7 years now without any problems so i dont understand why anyone wants to "keep live sync" enabled for such things and have to pay someone for the privilege and then have to wait for them to get hacked. nonsense

Why don't I want live syncing between my phone and my laptop? I use my phone quite a lot despite my laptop being within an arm length or two. Having new passwords accessible between them seems like an obviously useful thing.

I keep the file in dropbox so it syncs to all the devices.

good for you. are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? probably but that would mean keepass has been broken, something that hasnt been the case so whats the problem?

And if that was the case wouldn't same risk profile apply to something hacking the file from your device?

Dropbox famously worked with the NSA sharing both encrypted user data as well as decrypted user data...

I would not use them for anything sensitive ever.... But you do you I guess

sure. where do you draw the line?

mind- your own mind/post-it notes- you forget and you loose notes

offline- keepass- works. is safe. has not been broken

online- whatever SAAS- works but only pinky promise of being unhackable- can leak from beyond your own control.

your keepass could be hacked but they would require access to your device. you have control over that. you do not have control over lastpass servers

best to use what is the most secure. your own brain?

>are you worried a threat actor would hack your dropbox and steal your keepass file and break your password?

I keep a copy of my password file in Dropbox, as one of several backups.

(The file, to begin with, is GPG-encrypted.)

I keep my passwords in my head. This has worked for over 30 years.

I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game?

My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc.

Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?

As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons:

- people forget

- you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords

- this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk

These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because:

- you don't store passwords

- you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password)

- your users can't forget their passwords

- it's pretty much just as secure as your email, which is probably gmail, which is fine

I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.

Your assertion that you need a "system" to remember multiple passwords is simply false. In fact, I generate passwords with a random generator I wrote in python, just like any software "solution".

You did touch on one of my secrets, I don't maintain hundreds of superfluous "accounts". I'm not going to count them, but I suspect I'm at around 30. If I don't log into a service for a long time then I just go ahead and transition that to "never" in which case it doesn't matter if I remember the password or not since it's clear I don't need that account anyway.

I also use unique logins and emails with each service which I guess is even more to remember.

For throwaway accounts and things that really don't matter I use an easier to guess (and crack) leetspeak pw and/or a post-it note.

I suspect people who are not techies have even fewer accounts to remember so this may actually work for many (though I agree, not all) of them. Probably more than you give credit. In fact I assume that most non-techies are simply keeping credentials in their memory in which case the best advice is probably just to remind them to use unique ones, at least for their email and their bank...

I've also worked help desk and no one ever called to report that everything was hunky dory.

Anyway, I appreciate you taking the time to address the issue rather than just leaving another drive-by downvote.

Yeah I mean, there may be a goldilocks zone of sophisticated enough to remember 30 random strings of text but not sophisticated enough to need to remember 300 random strings of text, and yeah if it works for you that's awesome (I keep thinking I'll try and get my memory back to where it was when I was in college, but I keep forgetting to do it!! :P)

And yeah I think the big bad we're working against is people using the same password (or a password with some very small variations that's super easy to guess from a variant) across all their services. I'm sure almost everyone does this, I even know sophisticated engineers who do it, I also do it for accounts I don't care about. "Use a password manager browser extension" is the easiest thing for us former help deskers to tell people, and as long as that person didn't choose LastPass (which you should never have chosen, how many breaches will it take) they'll be in great shape.

So you’ve memorized multiple hundred passwords of high complexity and uniqueness? I’m impressed if so but kind of doubtful.

So you log into hundreds of unique accounts each month? Why?

Maybe not every month, but having hundreds of unique accounts is quite trivial to do. For example I manage dozens of accounts for friends and family for a variety of reasons. The fact that I don’t log into these accounts every month makes it even harder to remember them.

“Just have less accounts so you can remember your passwords!” is not real advice

I'll warrant that if you have hundreds of accounts you rarely log in to then it may behoove you to record them somewhere. However in this case I'm not sure a password vault is superior to just keeping them on an encrypted volume on a thumb drive. And I'd still argue its best to keep these rarely-used credentials siloed from your day-to-day passwords, especially if they're being held in trust for someone else (really each client should have their own silo).

That’s a good point about siloed credentials, I honestly never thought about that.

However I’d say give that the password vault is open-source and can be self-hosted (like Bitwarden) there are many reasons to use it over an encrypted flash drive. It can be automatically backed up easily, is supported on every device (including mobile) via a web browser. It also includes useful tools like a configurable password generator, versioning, and auto fill. For the average person that is much better than an encrypted flash drive volume, which IME are platform locked (LUKS doesn’t work on Windows, Bitlocker doesn’t work on Linux), are much less convenient, and are much more fragile.

Of course, use whatever works best for you, I don’t know your situation.

Sure, but for passwords you rarely use the added convenience of things like autofill seems less impactful compared to the added attack surface.

Not the person you're responding to, but: My keepass database has over 250 entries over the last decade. There's no way I could remember a unique password for each entry.

If you could explain how "monthly" is relevant to the discussion, that'd be great.

I’m a happy user of 1Password for Families, which I only mention since it means >1 person is storing in our vaults (and 1P isn’t as vulnerable to “my backup has unencrypted URLs stored in it” — one of my main issues with LastPass’ latest breach).

Like you we have TONS of credentials (and other supported items), around 2800 vault items in total, some of which we definitely only use once a year, others we use multiple times per day. Probably started using a password manager and some technique to share some vaults around 2010, so also a decade.

> "... around 2800 vault items in total... "

This is absolutely insane to me.

The number of people reporting needing access to multiple hundreds or more of required credentials is blowing my mind. If this is the reality of how people are using the internet these days then we desperately need a better cross-platform solution to identity management and authentication than can ever be offered by passwords. These vault programs are sounding more like a horrendous bandaid than the mere unnecessary convenience I viewed them as.

If you need to share passwords amongst multiple people I guess I can see some of the appeal of these networked vaults, but it strikes me that even this is a drastically subpar situation that ought to be handled on a deeper architectural level (like with sub-accounts and ACLs).

> This is absolutely insane to me.

What's absolutely insane to ME is how consistently your responses seem to ignore that other people have different use cases for passwords. Nobody cares if something seems "insane" to you. It may surprise you to discover that services like these exist, perhaps, because people interact with passwords in a different way than your "I only keep passwords that I use monthly" brain database paradigm.

You can't seriously be telling me that managing 2800 secrets for a single "family" isn't evidence of a broken system. Unless GP is doing IT for the actual mafia I stand by my assertion that this is nuts and we ought to consider whether there's a better paradigm we could be pursuing.

To whoever is reading this: I am not doing IT for the Mafia. ;)

I mean, this is all apples and oranges, but if you could, examine your browser history across all devices as a household going back let's say 10 years. Lots of sites, right? How many did you ever create an account on for whatever reason? Are those all in your vault today? They essentially are for us. To the very best of my knowledge (and there's functionality in 1Password to analyze this, obviously anything not in vaults is invisible to it however) we have no duplicated passwords, anywhere on the internet.

To give some examples of how we do use 1Password, in terms of "Online Shopping" (just one of our shared vaults) that has 100's of credentials for everything from Amazon through Walmart and covering whatever we buy online from groceries to ammunition. Tons of more specialist or niche suppliers like Christmas Designers also make you 'Create Account' to have order histories and to be able to track shipments - this one in particular is a great place for garland, lighting and other holiday items, tis the season!

1Password also stores all our rewards programs (i.e. Store Cards, Airline, Hotels). I'd guess we are signed up with 40-50 merchants for some kind of "Rewards" (i.e. Fred Meyer or QFC, and where the ROI for signing up for their program is some items will be $2.49 instead of $4.49 on offer). I have traveled a lot for business and so can't always fly one carrier alliance or stay entirely within one hotel chain, so I guess that's another ~20 (airlines) and ~20 (hotel chains) for you.

I'm not going to memorize software licenses (serial numbers or license files for e.g., Bartender for macOS), nor other access tokens (i.e. SSH Keys, API Tokens) to various geekery.

Two other things which end up helping a lot, one of which adds lots of vault items: the integration story with Privacy [1] and Fastmail [2]. We've used and loved Privacy for a long time, and this integration stores the unique per-merchant credit card details in a vault. With Fastmail you can create 'Masked Emails' so you've got a unique email for each place you signed up. We've easily rotated both card details and emails on accounts when we find out someone was compromised, and with these integrations we're only rotating that site, not potentially 100+ sites using say the same Chase Sapphire card.

So, your own approach may vary, and I see from other comments that you memorize all your accounts (?) and commented on the frequency of access ("monthly") being relevant to you, so I'd assume frequency/recency plays a part, and you duplicate credentials for less important sites or rely on 'Forgot Password' functionality for less used sites? How do you deal with accounts you didn't need in the last 60 days? In any case, 1Password works amazingly for us, and quite a large number of our friends too, although anecdotally they've usually got 100's not 1000's of items in vaults. :)

[1] https://blog.1password.com/privacy-virtual-cards/

[2] https://1password.com/fastmail/

"sub-accounts and ACLs" sounds just as awful to me, if not worse, quite honestly. Imagine managing an "Account" at each of 100's of online merchants and other sites like Netflix, where each has >= 1 "User", and "ACLs" (permissions).

I am entirely happy for my family to just have access to the Amazon or Netflix email addresses (logins) and passwords without any of that overhead.

Monthly is just a simple test to see if you're actually using these accounts. I'd say start by reconsidering if you need these accounts at all and if you decide you do, go ahead and keep them in a software vault. But I still recommend keeping the ones you use once a month or more in your head. It will be more secure (and possibly more convenient) and if you are using them this frequently it will also be easy to remember them. I'd also posit that these frequently-accessed accounts are likely to be your most important ones, deserving of a little extra security.

Over 20 years, probably.

I do the same. I have iterations written down in a safe but my family will have a hard time accessing my digital identity when I’m gone

How many?

Around 30.

That’s too few to be secure by about an order of magnitude, for me

Glad that method works out for you. Fortunately for the rest of the world, technology has progressed far enough that Password Storage is a solved problem.

I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. Some people would rather entrust a reputable service to handle the very menial task of managing their passwords for them, rather than go through the hassle of doing it themselves.

Not only do these services provide better convenience, they make you more secure! Many people reuse the same password, so when a site gets "owned", any site using that same password is now compromised as well. Some of these services will even automatically tell you when a site gets "owned" and offer to change that password for you retroactively.

Now, if you want to go ahead and use a local only method, be my guest. But please, don't ever suggest to anyone else that they should do the same, that's just bad security advice! By the way, getting hacked in the password manager does not mean all your passwords leaked. It just means some extra metadata about you may get discovered, which I'd argue is a reasonable trade-off.

What on earth are you talking about?

There is no universe in which having a local encrypted key vault that is not online and not synced to the cloud is less secure than having a cloud synched version of the same thing.

There is literally no way that can possibly be less secure.

So if your argument is that the convenience of it makes it more secure … I dont know to say except:

you’re wrong.

> Not only do these services provide better convenience, they make you more secure!

Nope.

> By the way, getting hacked in the password manager does not mean all your passwords leaked.

Nope. That’s not what it means. It means your encrypted vault was leaked, which includes your passwords, if they bother to crack it.

> which I'd argue is a reasonable trade-off.

Well, at least it’s fair to say you saved that as an opinion; fair. Other people probably agree that the security risk of using an online password vault is worth the convenience of using it.

Fair.

…but, fundamentally less secure.

Anyone who chooses to manage their own passwords, offline, is choosing a more secure, less convenient alternative.

I think that’s fair too; and, given number of hacks to lastpass, okta, etc… not, perhaps, terrible advice.

You don’t need cloud synced passwords.

You just want that, because it’s easy.

You could get robbed of your physical key. simpler than an actual burglar. however they could not even do an autopsy of your brain to recover your cloud keys.

I don't feel too strongly about this, just replying since you were being an absolutist.

If they can rob you they can also use the 5$ wrench attack to force you to give up your cloud password manager master password. So even in that case having a local vault is at least as secure as a cloud vault.

https://xkcd.com/538/

What I like the most is offline relative to the Internet but online when it comes to my LAN and when I want to. Like 1Password in the good old days.

I'm lol'ing cuz "Password Storage" using keepass is indeed a solved problem.

>I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things.

this should be taught in schools if that is your concern. what i am doing with the "manual sync" for files is because i have 2 machines i want to get my passwords. there is a HUGE population who only have a phone. for them, keepassdroid or some other keepass app is the only thing that they should ever need or use. i know because i have set up the files for my family members, they only have their phones at hand and the file has served them well for years without any problem.

now they "whatsapp or email" the file to themselves or to me if they have to change their phone and get it back in a matter of minutes. this is not as big of a deal that you need to have online tied system and be a techie otherwise

If I only had a phone, I would definitely want live sync, so I had a chance of recovery if my phone was gone. Keepass isn't even something I'd consider.

I'm not sure what you're referring to that should be taught in schools. The problem of forgetting things is often "human error" not "pilot error", a random packet loss of the mind rather than lack of skill.

There's strategies to mitigate it, like always leaving the house with the same set of items and never changing it up, and avoiding situations where you rely on memory, but live sync is going to prevent a lot of mistakes.

The threat model of storing passwords in an encrypted file with live sync is gonna be smaller than only keeping it in one device. Yeah you are at more risk of getting pwnd but at almost no risk of losing your passwords. Your phone dies and you lose everything. And if you send your passfile through a convenient service like whatsapp or telegram you risk your data also getting leaked through them without the benefit of live sync.

But doing password saving and live sync through a third party service it's pretty crazy to me. Why not split the threat? One program to store your passwords and one service to sync them. I use keepass2android and keepassxc with my own file sync server as sync method. If you don't want your own server you can use a multitude of third party ones.

What should be taught in school is to store your passwords in a secure way just like any other important real life skills like doing your taxes, basic eating and physical health, etc.

The trouble is losing a phone is probably just as common or more common than getting hacked, and keepass sync is purely manual.

I suspect the most secure way to store passwords is in your Google account, because they have a far higher budget than almost anyone else. They will spy on you, but they also keep random hackers out.

I use BitWarden (with gmail as the 2FA) instead because I wanted the ability to try different browsers, and I like being able to store other bits of critical info in my vault.

You generally can't get hacked on anything important unless you already lost your phone, even if they have your password, because of 2FA.

You also don't lose your account if you lose your phone if you use SMS 2FA like most people do even though it's not perfectly secure, because your cell carrier can recover your number.

So glad I migrated to bitwarden when they tried to make you choose between mobile or desktop use.

Bitwarden is still vulnerable to hacks, but I guess it's a bit like saying all banks have issues, but we can all agree Wells Fargo (lastpass) sucks.

Same boat as you. Now we just have to hope LastPass deleted our information when we asked them to.

I wonder if these risks are also with a service like 1Password. How can you know if they are in fact, actually encrypting every single detail associated with the login? It’s not like we can view the servers ourselves.

1Password also uses a secret key in addition to your master password to encrypt your data. You enter the secret key when setting up the account on a new device.

So a hacker would have to get hold of the encrypted data, together with the secret key for each account. The secret key isn't stored by 1Password, requiring the hacker to brute force it. However, each key provides 128 bits of entropy, which makes it infeasible to brute force with current technology.

More info: https://support.1password.com/secret-key-security/

But the issue in this thread is less about how the encryption is done compared to the amount of data that is actually encrypted. I wonder if 1Password encrypts everything, in addition to passwords.

My understanding is that they do, but there are some caveats. For example the feature that tells you if 2fa is available for a website presumably requires sending an HTTP request to 1Password servers including the domain of the website.

Although it's possible they implement this with a local bloom filter or something. I'm just speculating. And either way, those requests would only end up stored in some server logs somewhere, rather than in a database row directly linked to your vault.

EDIT: It is in fact done locally. :) see: https://support.1password.com/watchtower-privacy/

BitWarden and other self-hostable open source solutions do allow you to verify everything is encrypted, though you have to self-host to truly verify it (since it's always possible the official hosting service runs different software)

Does this affect customers who deleted their account before the breach ? I can't find info on LastPass

I have the same question. I migrated away from LastPass 2 years ago and wonder if I’m still breached

After they've already been shown to have been dishonest previously, and after they chose to make an additional disclosure on the last working day (for most) before Christmas, I think you have to assume your data is at risk, and act accordingly. I certainly would.

Do you trust them to tell the truth about whether all your data was reliably, securely, and permanently deleted? Can they tell you when and how?

You’re right I’m assuming my account was breached and I’m resetting my passwords.I already started noticing hack attempts (e.g. reset password attempts) this week, so that indicates it’s likely to have been breached.

I used lastpass reluctantly, knowing the risk but also knowing it was better than re-using passwords.

What a fun way to spend christmas holiday resetting passwords

page is dead; im surprised folks are still posting on and hot-linking to twitter. got any got a mastadon alt-link?

Weird.

New URL is at : https://twitter.com/jsrailton/status/1606195077939744768 apparently, and it worked for me just now.

maybe the ghostintheshell did not like the end number being 69

Whats even better is that at the time i'm writing this the hn post hast 69 votes.

I use moolipass with a couple passwords on yubikey I carry with me.

Feels very robust and I get to be in control of my own data and passwords.

Reply on news.ycombinator.com