jagstangxl

I was never able to successfully trigger the false positive last night but I believe the most recent explanation from LastPass is in line with what I have been seeing. Intermittent false positive emails.

https://www.techradar.com/au/news/lastpass-accidentally-scar...

I was just able to trigger the email again on a bad password. Going to figure out the exact 123’s and screen record.

They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.

Correct, at 10:20 eastern I did receive the verify device/location email using an invalid password but it is no longer sending the email.

Interesting. I tested twice before with the wrong password and vpn and it generated the email but was not able to get in. I assume it would still show in account history because that event is the login verification email event.

It isn’t sending that email for me at this point so maybe something has been corrected and LastPass will acknowledge something soon.

I received the alert of a blocked login attempt yesterday from 168.81.33.157 (Mumbai, India).

I don’t use LastPass often and wasn’t 100% on my master so I tried logging in and also received the block login alter from my attempt. I verified the new location/device and then tried again and it told me the password was invalid. Tried again and got in fine.

Could it be that master passwords are not actually compromised but they are sending the unrecognized device/location on any login attempt regardless of correct master?

Can someone else verify blocked login from unknown device/location using a wrong master password?