If you use LastPass as a secure password-managing service, things might not be as secure as you think. Earlier this year in August, the password keeper disclosed that it had been breached, with an unknown hacker having gained access to LastPass' source code and proprietary data. At the time, the company stressed that despite this, customers were unaffected by the hack, and that their data was safe. Now, for the second time this year, LastPass is having to announce that they have been hacked for a second time this year, and that in this incident, customer data has indeed been accessed and stolen.

According to an internal investigation, that same hacker used the data (cloud storage access and dual storage container decryption keys from August in order to get ahold of a backup of LastPass customer data. This means that the individual was able to access billing addresses, telephone numbers, IP addresses, and email addresses saved to users' accounts. That isn't the end of the breach, though, because the hacker also copied a backup of vault data, which contains the most sensitive info; usernames, passwords, and saved form-field data. LastPass claims that no credit card data was accessed, as the service does not store complete credit card numbers and information.

While the information like email addresses and telephone numbers were not encrypted, the password vaults were, with a 256-bit AES encryption, requiring a special key in the form of a user's master password to access. So despite having this information, LastPass claims that this would make it incredibly difficult for the hacker to actually obtain the data from the customer vault. That being said, there is the potential for someone to either brute force the master password, or eventually decrypt the data.

The threat actor may also target customers with phishing attacks, credential stuffing, or other brute force attacks against online accounts associated with your LastPass vault. In order to protect yourself against social engineering or phishing attacks, it is important to know that LastPass will never call, email, or text you and ask you to click on a link to verify your personal information. Other than when signing into your vault from a LastPass client, LastPass will never ask you for your master password.

With all this in mind, LastPass says that there isn't a need to take action at this time, unless your master password was not as secure as recommended. This is just the latest in a string of numerous hacks that the password managing service has suffered over the past few years, with incidents taking place in 2015, 2017, and 2019, all resulting in customer data being accessed by hackers.

Source

 

[Kioku]

Unhackable passwords is the solution.

What exactly constitutes as "unhackable"?

 

[I_g_o_r]

What exactly constitutes as "unhackable"?

Unhackable means that there is no place from which they can be hacked.

Post automatically merged: Jan 10, 2023

Other options are stateless passwords, dynamical passwords, generated on demand passwords.

 

[Kioku]

Unhackable means that there is no place from which they can be hacked.

Post automatically merged: Jan 10, 2023

Other options are stateless passwords, dynamical passwords, generated on demand passwords.

I'd rather have a physical security key than the last two password options...

 

[I_g_o_r]

I'd rather have a physical security key than the last two password options...

physical security keys can be broken, stolen, damaged, confiscated, etc.

Some of them rely on encryption.
Researchers claim that they can break encryption with 372 qubits quantum computer
IBM has 433 qubits quantum computer
In 2023 IBM will have 1000 qubits quantum computer and promises 4000 qubits quantum computer in 2025.

 

[Kioku]

physical security keys can be broken, stolen, damaged, confiscated, etc.

Some of them rely on encryption.
Researchers claim that they can break encryption with 372 qubits quantum computer
IBM has 433 qubits quantum computer
In 2023 IBM will have 1000 qubits quantum computer and promises 4000 qubits quantum computer in 2025.

Nothing is "unhackable".. That's kind of the point, ain't it?

Also, what generates "on demand" passwords if not a physical device? Can that not be stolen? There are holes in virtually every security "solution"... Most 2FA can be circumvented just by taking someone's phone...

 

[nubman33]

I'm pretty sure the damage is done. I don't use them, but I'm sure they lost alot of trust.

you could say the same thing about when psn got hacked in 2011. lost a lot of trust, but millions still use it.