{"id":25632,"date":"2022-12-23T16:49:59","date_gmt":"2022-12-23T16:49:59","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/23\/you-should-stop-using-lastpass\/"},"modified":"2022-12-23T16:49:59","modified_gmt":"2022-12-23T16:49:59","slug":"you-should-stop-using-lastpass","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/23\/you-should-stop-using-lastpass\/","title":{"rendered":"You Should Stop Using LastPass"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\"LastPass
LastPass<\/span><\/figcaption><\/figure>\n

LastPass used to be one of the best password managers<\/a>, but more recently, its reputation has taken a hit from multiple security breaches. Now the company has confirmed the last one was really<\/em> bad.<\/p>\n

LastPass suffered a security breach<\/a> back in August, when a hacker gained access to development environments and was able to steal source code and other proprietary information. Later in December, LastPass confirmed<\/a> a hacker was able to use that data to \u201cgain access to certain elements of our customers\u2019 information.\u201d The company didn\u2019t clarify what \u201ccertain elements\u201d meant, until now.<\/p>\n

LastPass just disclosed the full scope of the attack, following an \u201congoing investigation.\u201d The hacker was able to access a cloud storage environment using data from the August security breach, which included \u201cbasic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.\u201d Credit card information was apparently not accessed.<\/p>\n

The worst part is that the hacker successfully copied vault data from LastPass, though the company called it \u201ca backup,\u201d so it\u2019s not clear how old the data is. The company claims the actual passwords are still safe, because they use\u00a0256-bit AES encryption based on a person\u2019s master password. However, if someone\u2019s master password can be obtained (for example, with a\u00a0phishing email<\/a>\u00a0mimicking a LastPass login page), it could be possible to unlock the encrypted data and see all of someone\u2019s passwords.<\/p>\n

Even without the master password, the leaked data could be damaging for some LastPass users. Names and billing addresses can be used in more attacks, and the website addresses for stored passwords were not encrypted. Someone with the leaked data would be able to see all the websites that were associated with passwords, then use that for more targeted phishing. For example, if someone has a password for Bank of America\u2019s website, they might have an account there, and would be an excellent target for phishing emails that look like account alerts from the bank.<\/p>\n

This is just about the worst possible security incident imaginable for a password manager like LastPass \u2014 nearly all data in the company\u2019s possession has been copied. Client-side encryption saved every password from being stolen, but as previously mentioned, all it takes is a weak master password or a phishing attack to unlock that data for an account. That, along with a poor track record of responding to security problems<\/a> and multiple other recent breaches, is a good justification to stop using LastPass.<\/p>\n

If you do use LastPass, you should change your master password as soon as possible, and be on the lookout for sketchy-looking emails for the coming weeks and months. You may also want to consider changing every password stored in LastPass \u2014 hackers now (probably) have that data too, they just can\u2019t unlock it right now.<\/p>\n

Source: LastPass<\/a><\/small><\/p>\n<\/div>\n