LastPass Blog

I would be more impressed if they found issues the Apple password service or 1Password, you always have to assume that no software is complete secure but personal I only trust those two especially after the Lastpass hack https://blog.lastpass.com/posts/security-incident-update-recommended-a…

> By migrating from one to the other, aren't you exposing yourself to the exact same risk? My main gripe with LastPass is that they did not encrypt everything. Vast amounts of important information (email addresses, billing addresses, telephone numbers, IP addresses, website URLS [0]) were not encrypted on user's local machines with the master password, and subsequently have fallen into the hands of a malicious actor. I would feel much better about LastPass if the security genuinely was safeguarded by a strong master password. But they've demonstrated that it's not. Other password managers, as far as I can see, provide much greater protection in terms of encrypting everything. That's why I'd feel better about using them. [0] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

I've had a thought for a while about how to share the master key to my password manager when I die (so family can access bank accounts, etc.). One thing I thought of was to use Google's 'inactive account' feature to give access to a file someone I know when my account is inactive for 90 days. But that's such a long time period, and my loved ones might need that data in the meantime. Another thought I had was to use some secret sharding scheme like this, but the venn diagram of people that I trust with the data, and the people who could competently carry out guarding and then revealing the secret is too small. Looks like Lastpass has a solution[0], but it also involves a waiting period. And I'd love something that's open source and self hosted. Does anyone have a good solution? [0] https://blog.lastpass.com/2016/07/how-to-get-started-with-lastpass-eme…

You're wrong. you can exploit browser extensions without escaping sandbox. In fact, LastPass and others had some pretty embarrassing vulnerabilities that can be exploited due to being an extension. There's no question that a local PM has a significantly lower attack surface. Here are some stories: https://blog.lastpass.com/2019/09/lastpass-bug-reported-resolved/ https://www.csis.dk/newsroom-blog-overview/2021/moserpass-supply-chain… There were several classic web vulnerabilities for 1password and bitwarden when it comes to extensions.

Worth mentioning the security incident involving LastPass user data back from 2015: https://blog.lastpass.com/2015/06/lastpass-security-notice.html/

If you want to sync your 2FA keys in the cloud, you may be better off with LastPass Authenticator: https://blog.lastpass.com/2017/05/announcing-cloud-backup-for-lastpass… I would still say it's not recommend to backup those keys in the cloud, and I hope LastPass at least has the common sense not to keep those keys on the same server as the LastPass passwords. However, a middle ground may be backing up the keys before you change/reset your phone, and then disabling the feature (I'm not sure if they actually wipe or reset those keys every time you disable the backup feature, though, but I hope they do that).

LastPass issued a security warning in June 2015 that was originally triggered by their having detected network activity from an unknown source. For what it's worth, their handling of this event was the reason I adopted LastPass. https://blog.lastpass.com/2015/06/lastpass-security-notice.html/

LastPass recommending https://blog.lastpass.com/2017/03/security-update-for-the-lastpass-ext… Use the LastPass Vault as a launch pad – Launch sites directly from the LastPass vault. This is the safest way to access your credentials and sites until this vulnerability is resolved. Two-Factor Authentication on any service that offers it – Whenever possible, turn on two-factor authentication with your accounts; many websites now offer this option for added security. Beware of Phishing Attacks – Always be vigilant to avoid phishing attempts. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies. Take a look at our phishing primer.

And did you know that Lastpass for mobile is now free? I use Lastpass too and love it. Was also paying $12 but this was a nice little gift. You have to go into your prefs and switch off automatic payments if you want to switch to a free account. https://blog.lastpass.com/2016/11/get-lastpass-everywhere-multi-device…

I trust LastPass for 3 reasons: 1) LastPass has a history of taking ownership of vulnerabilities and taking appropriate measures. They do this publicly and provide a level of detail that demonstrates their expertise[1]. 2) They're working under the same constraints as Google with the same caliber of engineering strength. 3) Most importantly, their business depends on delivering a secure product. It's in their best interest to continue providing a secure product. [1] https://blog.lastpass.com/2015/06/lastpass-security-notice.html/

I didn't say it was easy; it's usually pretty hard/expensive to do it right. But there are known best practices, and it looks like those weren't followed (at the very least, have a good password policy and salt the goddammed passwords before hashing). here are two examples of companies doing security right: [1] http://blog.lastpass.com/2011/05/lastpass-security-notification.html [2] http://arstechnica.com/gaming/news/2011/11/valve-confirms-steam-hack-c…

> the hugely negative perception of virus-laden wildlands on Android I... don't see this in real life? There have always been San Bernadino-emboldened Apple customers that love to dunk on Android security, but recently that's gone away. Trojan horses are making it through[0] Apple's manual review, NSO Group has working exploits more often than not, the US government has wiretapped Push Notifications[1] and Apple has seemingly slowed their persecution of organized hacking groups. iOS is in a post-Pegasus world. Android was perceived to be vulnerable if you downloaded the wrong app; iOS was proven to be vulnerable if you received an SMS payload from any user. And Apple has admitted that they cannot even really detect it[2] anymore. Neither educated users nor common people are associating Apple with security, especially now. [0] https://blog.lastpass.com/posts/warning-fraudulent-app-impersonating-l… [1] https://arstechnica.com/tech-policy/2023/12/apple-admits-to-secretly-g… [2] https://9to5mac.com/2025/02/20/apple-currently-only-able-to-detect-peg…

From the Last Pass blog about a recent incident: Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model and can only be decrypted with a unique encryption key derived from each user’s master password. As a reminder, end user master passwords are never known to LastPass and are not stored or maintained by LastPass – therefore, they were not included in the exfiltrated data. https://blog.lastpass.com/2023/03/security-incident-update-recommended… In other words, the thieves went to the bank vault a d stole your safety deposit box but can't access it because they need your key, which only you posses. If I can store my passkeys in 1password (or lastpass etc) then nobody needs access to my physical phone. They just need access to my password manager's password. I agree that for many many people password managers are way better than alternatives. But they don't magically make everything safe. It's like MFA. "it is all safe now because we will send you a code via SMS" and the people fall for social engineering attacks that make them disclose the code the attacker just had the bank send to them. I doubt such people will be a le to safely use a password…

> The MFA reset shouldn't be related to the increase in hash rounds, those are unrelated. So they must suspect the MFA seeds were also stolen, but aren't saying it, right? They were stolen but weren't very clear about it. From their summary of their latest security incident[1] it says attackers stole: > Backup of LastPass MFA/Federation Database – contained copies of LastPass Authenticator seeds, telephone numbers used for the MFA backup option (if enabled), as well as a split knowledge component (the K2 “key”) used for LastPass federation (if enabled). This database was encrypted, but the separately-stored decryption key was included in the secrets stolen by the threat actor during the second incident. This summary links to a page[2] with more information, but actually on this page they give less information, saying only: > [Customer Secrets accessed includes] Multifactor Authentication (MFA) seeds - MFA seeds assigned to the user when they first registered their multifactor authenticator of choice to authenticate to the LastPass vault. 1: https://blog.lastpass.com/2023/03/security-incident-update-recommended… 2: https://support.lastpass.com/help/what-data-was-accessed

The poster states: >"If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key is derived. So older users likely still have a pretty low number of pbkdf2 rounds which makes them more vulnerable to brute forcing" Can someone say about how long would it take for an attacker to brute force a pbkdf2 master key with 5000 or 10000 rounds? Looking at their blog post from a few days ago they state: >"The threat actor may attempt to use brute force to guess your master password and decrypt the copies of vault data they took. Because of the hashing and encryption methods we use to protect our customers, it would be extremely difficult to attempt to brute force guess master passwords for those customers who follow our password best practices. We routinely test the latest password cracking technologies against our algorithms to keep pace with and improve upon our cryptographic controls."[1] Can someone say did they notify customers who had legacy accounts that used 5000 or 10000 iteration pbkdf2 master keys? They sure don't seem to mention anything remotely like that in their incident report.[1] In the above paragraph "best practices" is a link to the URL that fails to mention anything about selecting or periodically increasing the number of pbkdf2 iterations.[2]. If this weren't bad enough you are interrupted from reading their important incident report by a pop up asking you to sign up for their…

I stopped using Lastpass in 2017 after the second breach that year that allowed remote code execution: https://en.wikipedia.org/wiki/LastPass#2017_security_incidents It wasn't so much that that happened, but rather their response: https://blog.lastpass.com/2017/03/important-security-updates-for-our-u… - "Our investigation to date has not indicated that any sensitive user data was lost or compromised" - "No master password change is required" - "No site credential passwords need to be changed" Given the fact that an attacker could run code in a user's browser extension without any communication with Lastpass servers, there was no way for them to know whether the master or site passwords had been stolen. The only responsible thing for them to do at that point in my view was to recommend everyone change all their passwords. Instead they completely played it down. So they completely lost my trust and I spend the next several days moving off Lastpass and changing the passwords for hundreds of websites...I feel for all of you finding yourselves in that situation now. :-(

I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authenticat… EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-wa… Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.

Source: https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpas…

https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpas… > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.

So there's no scamming happening in Apple's fully walled garden, "Only approved apps allowed" system, right? https://blog.lastpass.com/posts/warning-fraudulent-app-impersonating-l… Oh, turns out they just let you pretend to be the real company to sell your scam app. What a load of good that "Approval" process does.

> I know they have insanely high and probably unreasonable standards for their app store [2022] https://lifehacker.com/great-now-the-apple-app-store-has-malware-too-1… [2022] https://www.darkreading.com/cyberattacks-data-breaches/malicious-apps-… [2024] Fraudulent LastPass-impersonating app allowed in App Store: https://blog.lastpass.com/posts/2024/02/warning-fraudulent-app-imperso… [2024] "Scammed by the top result for 'Bitcoin wallet' in Apple App Store": https://news.ycombinator.com/item?id=39685272 [2020] Scam subscriptions: https://blog.lockdownprivacy.com/2020/11/25/how-to-make-80000.html [2015] Thousands of malware-containing apps built using infected version of XCode slip through App Store review: https://www.bbc.com/news/technology-34338362

If you reviewed at the fraud listing[1] and had no knowledge of the LastPass app, I'm not sure you would know it was a copy. I worked on the App Store and Music at Apple, but I have no idea about the app review process. 1. https://blog.lastpass.com/wp-content/uploads/sites/20/2024/0...

https://blog.lastpass.com/2024/02/warning-fraudulent-app-impersonating… > LastPass would like to alert our customers to a fraudulent app attempting to impersonate our LastPass app on the Apple App Store. The app in question is called “LassPass Password Manager” and lists Parvati Patel as the developer.

It's not difficult to imagine possible threats just by looking at the comparison screenshots alone: https://blog.lastpass.com/2024/02/warning-fraudulent-app-impersonating…

I'm not sure about #1. Password managers are a centralized place where a lot of your world lives. They have had issues and leaks in the past. I do not trust password managers or key vaults. For example: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

Yes "that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data." https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

The hackers got access to their dev environment and source code back in August and used that information to hit them harder this time around: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ We may not be seeing the whole picture yet, but very concerning that the dev environment had access to Production database backups stored in a manner that was easily decrypt-able :/ The whole point of a Dev environment in a security focused company is that you reduce the surface area for access and failure.

It seems that it was a social engineering attack. From their notice: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ > some source code and technical information were stolen from our development environment and used to target another employee

Not passwords, but the hackers have some unencrypted data because LastPass did not encrypt all vault data client-side: "The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs" - https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ The "such as..." without enumerating everything is very ominous as well.

This appears to just be a copy and paste from LastPass’s own update on this incident? [1] This has been covered LOTS in the last 24 hours already in HN [2], with most of the conversation happening on this post [3]. [1] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ [2] https://hn.algolia.com/?dateRange=pastWeek&page=0&prefix=false… [3] https://news.ycombinator.com/item?id=34097142