{"id":26509,"date":"2022-12-29T17:19:12","date_gmt":"2022-12-29T17:19:12","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/29\/security-experts-say-lastpass-mislead-customers-in-august-data-breach-updates\/"},"modified":"2022-12-29T17:19:12","modified_gmt":"2022-12-29T17:19:12","slug":"security-experts-say-lastpass-mislead-customers-in-august-data-breach-updates","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/29\/security-experts-say-lastpass-mislead-customers-in-august-data-breach-updates\/","title":{"rendered":"Security experts say LastPass mislead customers in August data breach updates"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Security experts are calling LastPass out on its \u201cmisleading\u201d December security breach update.<\/p>\n

The breach originates from an incident in August that led to a subsequent breach in November,<\/a> where cyber criminals gained access to user password vaults. LastPass posted two updates since August, with the latter one coming earlier this month. The company said there was no cause for concern as passwords remain encrypted. While hackers could use brute force to access master passwords, LastPass said it \u201cwould take millions of years to guess\u201d if the company\u2019s best practices for passwords were followed.<\/p>\n

Jeffrey Goldberg, the Principal Security Architect at 1Password, said the \u201cclaim is highly misleading.\u201d The statement assumes users randomly generated their own master passwords, which Goldberg said people aren\u2019t very good at doing.<\/p>\n

\u201cUnless your password was created by a good password generator, it is trackable,\u201d Goldberg wrote in a blog post. The best practices LastPass mentions don\u2019t include anything about a password generator, which Goldberg insinuates is the way to create uncrackable passwords.<\/p>\n

It also isn\u2019t expensive to guess passwords, Goldberg wrote, with 10 billion guesses equaling $100 USD (roughly $135 Canadian).<\/p>\n

\u201cGiven that the attacker is starting with the most likely human-created passwords first, that $100 worth of effort is likely to get results unless the password was machine generated.\u201d<\/p>\n

LastPass\u2019 transparency claims have also been called out. Security researcher Wladimir Palant called out the company\u2019s \u201ccommitment to transparency.\u201d LastPass stated its updates were to remain transparent to its customers. However,\u00a0 Palant wrote in a blog post that LastPass has to share data breaches immediately under U.S. law.<\/p>\n

He further accused the company of portraying the August breach and November incident as two separate events. In reality, LastPass could not contain the August breach<\/a>. \u201cBecause of that failure, people\u2019s data is now gone,\u201d Palant wrote.<\/p>\n

Source: 1Password<\/a>, Wladimir Palant<\/a> Via: The Verge\u00a0<\/a><\/p>\n<\/p><\/div>\n