Tech warning - Hack at LastPass worse than admitted/realized

[ATCclears]

LastPass is a password manager.

LastPass users: Your info and password vault data are now in hackers’ hands

Password manager says breach it disclosed in August was much worse than thought.

arstechnica.com

Read More

 

[ATCclears]

@Moderators could you move this to the Off Topic section?

 

[Joe Link]

Wow, thanks for sharing

For those who are looking for a new password manager, I highly recommend Bitwarden

Bitwarden Open Source Password Manager | Bitwarden

Bitwarden is an integrated open source password management solution for individuals, teams, and business organizations

bitwarden.com

 

[gryghin]

As an IT professional for the last 17 years, I've only used an offline password keeper.

I don't care how secure they say... it's always hackable when humans are part of the security.

 

[albin25]

I wonder if there's a novel entitled …
… "The Cloud" ?

My wife and I use the "novel" password security system …
…. We selected a crappy, dull, unpopular classic novel and highlight as many "password phrases" as we need on a page. Every couple of months or so, we just move to the next page and repeat the process. It's quick, easy, and we have a record of old passwords. We select which letters become caps with a dot above the letter or a number with a dot below the letter. One page can yield as many passwords as needed. And a 400 page snoozer of a novel will easily yield 30 years of totally random passwords. A bookmark lists the sites in alphabetical order, the passwords on the page follow that order.
ie., "was a dark and stormy night"yields …
… daRkand5tormy

Sounds (reads) more complicated than it is in practice.

I imagine some old, long, legal document filled with pages of boiler plate and kept in a file called "colonoscopy lawsuit" and kept in a file cabinet with your parole papers and paternity suits would also work.

 

[pdxjimbo]

Brilliant

 

[Member 74756]

ONLY use offline pswmngers, just saying..

 

[Nosferatu]

This isn't the first major breach they have had.

Steer clear of them.

 

[Member 5605]

Good luck getting/cracking my master password….

 

[ATCclears]

LastPass owner GoTo says hackers stole customers' backups

LastPass' parent company says intruders stole the company's encryption key for securing its customers' backed up data.

techcrunch.com

 

[ATCclears]

Another hack at LastPass.


Although an initial intrusion into LastPass ended on August 12, officials with the leading password manager said the threat actor "was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activity" from August 12 to August 26. In the process, the unknown threat actor was able to steal valid credentials from a senior DevOps engineer and access the contents of a LastPass data vault. Among other things, the vault gave access to a shared cloud-storage environment that contained the encryption keys for customer vault backups stored in Amazon S3 buckets.

LastPass says employee’s home computer was hacked and corporate vault taken

Already smarting from a breach that stole customer vaults, LastPass has more bad news.

arstechnica.com