Another LastPass Security Incident

Manbatius · 23 Dec 2022 at 20:29

Eurgh moved to bitwarden a while ago.

There's too much in there for me to change the passwords. I'll do the important ones. Think my pass is 18+ digits.

They're surely done after this, right ?
It may just be me but I find it interesting it's happened after they started charging everyone.

Sin_Chase · 23 Dec 2022 at 20:47

Manbatius said:
Eurgh moved to bitwarden a while ago.

There's too much in there for me to change the passwords. I'll do the important ones. Think my pass is 18+ digits.

They're surely done after this, right ?
It may just be me but I find it interesting it's happened after they started charging everyone.

Done to anyone who researches thier product choice.

Im sure they will retain a customer base with vague langauge in their reporting and marketing campaigns.

Bitwarden user here. Every single detail about thier offering is available on their website in a transparent way.

The fact Lastpass even had access to certain customer personal data on their severs is all you need to know to avoid them.

Skynet5 · 23 Dec 2022 at 21:01

So if master password was "password" I'm in trouble?

It isn't.

Sin_Chase · 23 Dec 2022 at 21:34

lnoton said:
So if master password was "password" I'm in trouble?

It isn't.

You joke...but I reckon a huge amount of master passwords will be determined because of their simplicity

Skynet5 · 23 Dec 2022 at 22:02

Sin_Chase said:
You joke...but I reckon a huge amount of master passwords will be determined because of their simplicity

To be fair mine is reasonable simple it's a word phrase (alpha only) with mixed case.

It wouldn't be in a rainbow table or anything though.

ajf · 23 Dec 2022 at 22:11

The one thing I found slightly concerning was they say backups were accessed.
Presumably these would continue to use the old vault password even if it was changed after the breach?

I might change to something else, or not. Any accounts of real value have 2fa added as well. Most are single sign ins for random forums over the years, or shops, for which I would use PayPal anyway.
Are any alternatives REALLY any safer long term though?
Any system like this is surely a juicy target?

Eddie99 · 23 Dec 2022 at 22:19

lnoton said:
To be fair mine is reasonable simple it's a word phrase (alpha only) with mixed case.

It wouldn't be in a rainbow table or anything though.

How long is it? I would try this with the same structure and length but different words.

How Secure Is My Password? | Password Strength Checker

Passwords are the bloodline of data and online security, but our research on the password habits in the U.S. shows that less than half of Americans feel

www.security.org

Sin_Chase · 23 Dec 2022 at 22:27

ajf said:
Are any alternatives REALLY any safer long term though?
Any system like this is surely a juicy target?

Yes, products which dont store any of your data unencrypted (except the limites data they required to in order to actually deliver the service)

Skynet5 · 23 Dec 2022 at 22:29

Eddie99 said:
How long is it? I would try this with the same structure and length but different words.

How Secure Is My Password? | Password Strength Checker

Passwords are the bloodline of data and online security, but our research on the password habits in the U.S. shows that less than half of Americans feel

www.security.org

Blimey 19 hours.

Skynet5 · 23 Dec 2022 at 22:32

ajf said:
The one thing I found slightly concerning was they say backups were accessed.
Presumably these would continue to use the old vault password even if it was changed after the breach?

I might change to something else, or not. Any accounts of real value have 2fa added as well. Most are single sign ins for random forums over the years, or shops, for which I would use PayPal anyway.
Are any alternatives REALLY any safer long term though?
Any system like this is surely a juicy target?

This was my thought when I read the email. Although I think I'll upgrade my strength of Master password and simply run through the hundred sites and change the passwords.

Shouldn't take too long hahha.

Then I'll plan my exit to something else perhaps.

Eddie99 · 23 Dec 2022 at 22:35

lnoton said:
Blimey 19 hours.

Yep you're definitely in trouble. I'd assume they have access to your vault and change all your passwords asap.

You can create a strong master passphrase with dice.

EFF Dice-Generated Passphrases

Create strong passphrases with EFF's new random number generators! This page includes information about passwords, different wordlists, and EFF's suggested method for passphrase generation. Use the directions below with any set of dice.And now, a message from internationally renowned security...

www.eff.org

NotAGolf · 23 Dec 2022 at 23:04

lnoton said:
Blimey 19 hours.

1 hundred septillion years here. Feeling mildly smug

That's my master password for bitwarden, which I have 2FA enabled on. I still don't feel particularly confident relying so heavily on a single provider like I am, but if I didn't then I I know my passwords would be far weaker, or I'd reuse them, or I'd just forget them all.

Malevolence · 23 Dec 2022 at 23:09

Ice Tea · 23 Dec 2022 at 23:09

Sin_Chase said:
Anyone defending LastPass needs to reread the article and extent of the breach.

Personal Data and URLs were taken in an unencrypted form. This makes weaponising the breach so much easier and more potent.

The update also states the source code and other data stolen would have allowed futher exploitation and access to and decryption of cloud data.

Its generally accepted that data gets stolen, and as long as you used a strong master password the encrypted data lost isn't likely to be decrypted. Getting unencrypted data taken which can be used in phising and other attacks to decrypt the encrypted data is shocking.

Data loss aside there is a Privacy Question to ask - LastPass states they had a Zero Knowledge environment. They dont. (They have a readable list of all your services saved in their vault)

South Staffs Water reveals data hack

Account numbers used for direct debit payments could have been hacked, South Staffordshire PLC says.

www.bbc.co.uk

Cambridge Water: Chief apologises for customer bank details leak

Customers received letters saying their names, addresses and contacts had appeared on the dark web.

www.bbc.co.uk

Would moving to a different area and a different water company suddenly make the customer data safe (and will the new company be as transparent) and if the company had been open source would that have stopped the hackers when it's been proven beyond doubt via the ongoing exploits of OpenSLL that open source code doesn't do jack **** for security?

All password mangers are a target and all password managers store the data on cloud unless you self host so now as the bitwarden user base grows it will become a higher value target to hackers and open source code exploits.

In my opinion.

Skynet5 · 23 Dec 2022 at 23:56

Eddie99 said:
Yep you're definitely in trouble. I'd assume they have access to your vault and change all your passwords asap.

You can create a strong master passphrase with dice.

EFF Dice-Generated Passphrases

Create strong passphrases with EFF's new random number generators! This page includes information about passwords, different wordlists, and EFF's suggested method for passphrase generation. Use the directions below with any set of dice.And now, a message from internationally renowned security...

www.eff.org

I'll be starting tomorrow morning. I'll print the list off and go through them.

Meh. Silly me. Still. I doubt they'll ge round to me..plus all important stuff is 2fa anyway

gEd · 24 Dec 2022 at 00:34

Ice Tea said:
South Staffs Water reveals data hack

Account numbers used for direct debit payments could have been hacked, South Staffordshire PLC says.

www.bbc.co.uk

Cambridge Water: Chief apologises for customer bank details leak

Customers received letters saying their names, addresses and contacts had appeared on the dark web.

www.bbc.co.uk

The problem with all these water companies is that all of their assets are cloud-based........

SixTwoSix · 24 Dec 2022 at 04:56

Eddie99 said:
How long is it? I would try this with the same structure and length but different words.

How Secure Is My Password? | Password Strength Checker

Passwords are the bloodline of data and online security, but our research on the password habits in the U.S. shows that less than half of Americans feel

www.security.org

Oh, nice

It would take a computer about

4 trestrigintillion years

to crack your password

Ice Tea · 24 Dec 2022 at 07:36

gEd said:
The problem with all these water companies is that all of their assets are cloud-based........

It's sad that it took me a couple of minutes before the penny dropped.

Semple · 24 Dec 2022 at 08:08

Mine will take about 3 billion years, still a significant buffer considering the development rate of supercomputers. I may have to change it in 10 years when that might drop to a few thousand years.

Manbatius · 24 Dec 2022 at 08:10

7 quadrillion years.

As still going to change the important ones though, double check 2fa is enabled on everything. hah.

Can you close your lastpass account ? I've been "trialling" bitwarden since the previous breach. Suppose you could just delete all passwords it you can't.