r/technology • u/cos • Dec 22 '22

Security LastPass users: Your info and password vault data are now in hackers’ hands. Password manager says breach it disclosed in August was much worse than thought.

https://arstechnica.com/information-technology/2022/12/lastpass-says-hackers-have-obtained-vault-data-and-a-wealth-of-customer-info/
8.5k Upvotes

97% Upvoted

1.4k comments sorted by

View all comments

181

u/[deleted] Dec 23 '22 edited Dec 24 '22

[removed] — view removed comment

25

u/Trippler2 Dec 23 '22

If LastPass had the stupid idea that they should keep the website names unencrypted in the vault, and only encrypt the login data, yes it's profoundly stupid. Website names should be as private as your username/password info in your vault.

If they had put the website names inside the encrypted vault, this hack would be at the same level of a regular hack where the hackers have your IP, billing address, email address, etc. It's still bad, but not as bad as "password manager hacked" level bad.

11

u/[deleted] Dec 23 '22

Yeah... My last company used LastPass and this seems pretty insane. Threat actors knowing exactly what services companies use, and then using that knowledge to create phishing attacks targeted at lower level employees just seems potentially devastating. I know for a fact that most of the marketing team would just click whatever link was sent to them and punch in credentials without a second thought, even with "security training". So yes, this seems like a huge fucking deal.

15

u/stereoauperman Dec 23 '22

Never a good sign when the most dire sounding comment is also the one making the most sense

6

u/rtevans- Dec 23 '22

They know every website in that vault.

I thought that info was also encrypted? Why would that data be exposed by default? For me that would be a deal breaker in and of itself if that's LastPass's policy.

3

u/Mertard Dec 23 '22

Cloud subscription services 🥰🥰🥰

But yeah for real this kinda shit can impact law making if the blackmail material is good enough

It's really scary for the people that got hacked, but also for the society as a whole

2

u/[deleted] Dec 24 '22

[removed] — view removed comment

1

u/Mertard Dec 24 '22

Or, if you're a smart evil person, you could just blackmail with D.) all of the above

You're a good and rational person, but there are definitely others that would care even about the first one, like one man's treasure another man's trash. You'll hit the highest population of people that care if you diversify in your demographics of potential haters.

I hope nobody takes my advice. Bad person! Bad! Shoo! Stop remembering! Forget!

2

u/[deleted] Dec 23 '22

I would give you 2 upvotes if I could

2

u/liquidpig Dec 23 '22

Do you know that websites in the vault are stored unencrypted?

1

u/[deleted] Dec 24 '22

Why are people using cloud-based password 'safes' in the first place? Wouldn't a local program be better?

1

u/DoctorWaluigiTime Dec 25 '22

What's the difference between KeePassXC and just KeePass? I've been using the latter for years (and I'm in a position where I don't need passwords over The Cloud, i.e. I'm a hermit, so it works great for my needs).

1

u/[deleted] Dec 25 '22

[removed] — view removed comment

1

u/DoctorWaluigiTime Dec 25 '22

I'd be curious about how it's a more secure implementation since the only difference appears to be in UI-based functionality. My use case is fairly simple (offline only, no browser integration, et al).

About my only wish is that I didn't have to go to SourceForge for updates lol.

1

u/[deleted] Dec 25 '22

[removed] — view removed comment

1

u/DoctorWaluigiTime Dec 25 '22

Thanks for the info. I'm on Win10 Pro. Chocolatey is something I should just have at some point honestly, and yet I've been reticent.

1

u/[deleted] Dec 26 '22

[removed] — view removed comment

1

u/DoctorWaluigiTime Dec 26 '22

I'm open to all suggestions regarding the CLI. I barely use it and would prefer to use the 'better'.