{"id":26565,"date":"2022-12-29T20:38:00","date_gmt":"2022-12-29T20:38:00","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/29\/lastpass-slammed-over-hacked-password-security-claims-review-geek\/"},"modified":"2022-12-29T20:38:00","modified_gmt":"2022-12-29T20:38:00","slug":"lastpass-slammed-over-hacked-password-security-claims-review-geek","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/29\/lastpass-slammed-over-hacked-password-security-claims-review-geek\/","title":{"rendered":"LastPass Slammed Over Hacked Password Security Claims \u2013 Review Geek"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\"A
Maor_Winetrob\/Shutterstock<\/a><\/span><\/figcaption><\/figure>\n

Password manager LastPass has been embroiled in a data-leak scandal, with each update worsening the situation. In its most recent post<\/a>, the company assured users their passwords were safe so long as they followed LastPass\u2019s guidelines. Today, competitor 1Password released a scathing rebuttal.<\/p>\n

To summarize the data-breach scandal, back in August<\/a>, LastPass informed users that it suffered a data breach, but that customer data and accounts were safe. However, at the beginning of December<\/a>, the company admitted that the hackers were \u201cable to gain access to certain elements of customer information\u201d but didn\u2019t specify what kind of information that might be. And last week<\/a>, the company revealed that the hackers obtained a \u201cbackup of customer vault data\u201d but that the information contained in the backup would be inaccessible if customers had a strong master password.<\/p>\n

Specifically, LastPass claimed that if users followed the best practices, it would take the hackers \u201cmillions of years\u201d to guess a master password.<\/p>\n

LastPass\u2019s competitor (and our top pick for password managers<\/a>), 1Password<\/a>, took issue with that claim. In a blog post<\/a>, the company\u2019s Principal Security Architect, Jeffrey Goldberg, broke down why it\u2019s misleading to claim that a user-generated master password would take millions of years to guess.<\/p>\n

He points out that user-generated passwords are inherently more crackable than their machine-generated counterparts because humans don\u2019t generate passwords randomly as computers do. And that sophisticated hackers wouldn\u2019t try to decrypt computer-generated passwords first. As humans generally use mnemonic devices<\/a>\u00a0to remember passwords, hackers will try to guess those types of passwords first.<\/p>\n

To make things more straightforward, Goldberg employed what he calls a \u201csilly analogy\u201d (which is actually quite apt to understanding the claim). Suppose you went to the movies and forgot where you parked your car. The first place you would look for your vehicle would be the theater parking lot, not the whole surface of the Earth. In the analogy, the theater parking lot represents the user-generated mnemonic master passwords, and the whole surface of the Earth represents computer-generated random master passwords.<\/p>\n

If they\u2019re smart (and probably are), the hackers will go after the weaker user-generated passwords first rather than trying to break the stronger randomly-generated passwords. And they have unlimited tries for every single user in the backup database.<\/p>\n

Needless to say, things still don\u2019t look good for LastPass. And unfortunately, if your information is part of that data breach and you used a non-random method to craft your master password, you should look into ways to protect yourself from potential cybercrime.<\/p>\n

Source: 1Password<\/a><\/small><\/p>\n<\/div>\n