In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults.

  • shortwavesurfer
    link
    fedilink
    English
    arrow-up
    20
    ·
    1 year ago

    I was a lastpass user until ~2020 when i moved to KeePass and deleted my account. However, my master passphrase was close to 20 characters long. An 8 character password is laughable. I have my password manager generate 32 character or 64 character passwords with ~150 bits of entropy or 300 bits of entropy. My master password has also grown in length to the mid 20s area.

    • frog 🐸@beehaw.org
      link
      fedilink
      English
      arrow-up
      14
      ·
      1 year ago

      Yep, +1 for KeePass. I didn’t even know much about open source software back when I started using it, I was just suspicious of the idea of having a vault containing all my passwords sitting online where criminals would know where to find it.

      What consistently annoys me is how many sites still won’t let me use passwords longer than 16 characters, or still won’t let me use non-alphanumeric characters (or worse, both!) At least they’re not finance-related, I suppose.

      • flatbield@beehaw.org
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        KeePass has its vulnerabilities too. The good thing though is that it is not networked so one has to break into your device or your backups to even start an attack.

        • frog 🐸@beehaw.org
          link
          fedilink
          English
          arrow-up
          6
          ·
          1 year ago

          Exactly. Every password manager has its vulnerabilities, so there’s always a trade-off between different security measures. The lack of networking is KeePass’s big draw.

          • flatbield@beehaw.org
            link
            fedilink
            English
            arrow-up
            4
            ·
            edit-2
            1 year ago

            The big issue I have is syncing. Do you happen to know if there are any differencing tools keepass.

            I like to have only various subsets of my data on some devices and accounts. So way to partition, difference, and merge would be nice.

      • shortwavesurfer
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 year ago

        I will be happy when KeePass can store and use passkeys so public/private key cryptography to the rescue.

    • Melody Fwygon@lemmy.one
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I was similarly not particularly concerned by this breach; my iterations value was set much higher a long time ago, my master password was bordering on insane; as in greater than 16 characters, Mixed Case, includes symbols, has XKCD-Style word patterns and contained non-english/unexpected words/patterns.

      I also had migrated away from lastpass and prior to the breach had Deleted my account.

  • redcalcium@lemmy.instituteOP
    link
    fedilink
    arrow-up
    16
    ·
    1 year ago

    Man, I can’t believe I have to change the password of my important accounts. I had >700 entries in my lastpass account. A good chunk of them are probably accounts from dead websites but I’ll still have to wade through them.

  • Melody Fwygon@lemmy.one
    link
    fedilink
    English
    arrow-up
    10
    ·
    1 year ago

    Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry

    Seems they only targeted potentially accounts that might’ve contained some MONEY (Cryptocurrency)

    Then on Aug. 28, Monahan said she’d concluded that the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments.

    It seems that in particular “Secure Notes” containing crypto seed phrases seem to have been compromised. It’s pretty silly to have not migrated your old crypto wallets by now though.

    In a December 2022 blog post, Palant explained that the crackability of the LastPass master passwords depends largely on two things: The complexity of the master password, and the default settings for LastPass users, which appear to have varied quite a bit based on when those users began patronizing the service.

    …If you have/had an older account with potentially a very weak Master Password… Your password would be considered Weak if it was Less than 12 characters & did not not contain Uppercase, Lowercase and Symbols & was not an XKCD style password that *isn’t * “Correct Horse Battery Staple” or some other combination of those exact four words…

    But Palant said while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum.

    …Older than 2018…

    Palant noted last year that for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000.

    …Or worse yet, 2013…and you didn’t change the iterations setting(s), which most people probably did not.

    • bedrooms@kbin.social
      link
      fedilink
      arrow-up
      9
      ·
      1 year ago

      Meanwhile, websites in my country don’t allow symbols for fear of code injection attacks, and the allowed max length is 8 characters. You read it right. Fucking hell, it’s Japan…

    • redcalcium@lemmy.instituteOP
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      By 2013, new LastPass customers were given 5,000 iterations by default

      Uh, I made my lastpass account in 2012. If the iterations setting on 2013 was 5000, then the iterations setting the older accounts are probably even worse. I may or may not upgrade the iteration, I can’t remember at all.

  • 👁️👄👁️@lemm.ee
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    Wow, crypto bros who rely on open source, rely on a closed source password manager. Did they not realize where the security and development of crypto stuff came from?

  • HubertManne@kbin.social
    link
    fedilink
    arrow-up
    7
    ·
    1 year ago

    I did not even know about the lastpass breach. I had one years ago and the vault should have been gone but im always paranoid about that.

  • bedrooms@kbin.social
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    I feared things can go bad since LogMeIn acquired Lastpass. However, I didn’t imagine things go actually THIS bad.