Incident 2 – Additional details of the attack

This actually makes me feel better (overall) about Lastpass! as a company. That they can go into some detail shows confidence and an openness that I didn't previously experience. That said, their admission that they have lots of old credentials lying around is not good. Most of the things they changed have been pretty standard AWS recommendations for years now.

Side note, as a DevOps engineer this article does give me some additional pause in my everyday work. I try very hard to keep "work" relegated to my work computer and "home" stuff relegated to my home computer(s). However, sometimes the two do meet; generally when testing something. The upside is that I'm going to (try to) be a bit more careful in the future. I'm also going to install some additional AWS checks/balances on my accounts[0], just to make sure.

[0] https://github.com/zoph-io/aws-security-survival-kit