Aiden

LastPass Leak Update: Encrypted Vaults Leaked, AND **URLs are not encrypted in LastPass**, so all URLs in your vault should be considered public information now, linked to your name and information. Goodbye LastPass, that's crazy bad by design.

Looking forward to Steve and @leo take on this in SN.

https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

Security Incident December 2022 Update - LastPass

We are working diligently to understand the scope of the incident and identify what specific information has been accessed.

The LastPass Blog
Dec 22, 2022 at 9:10pmWeb
Show threadChris GlassDec 22, 2022

@aiden56 @leo What's the saying, fool me 5 times, shame on you?

I guess some people will still keep giving them one more chance.

Show threadPepijn SchmitzDec 23, 2022
@TheChrisGlass @aiden56 @leo It's not such an easy decision. Yes, that was bad design, but at least they are being very transparent about it, which speaks *for* them. With competing services you have no idea what their design is like, and whether they would be as transparent. Better the devil you know, as they say.
Show threadJose MunozDec 22, 2022
@aiden56 @leo it’s gonna be a pain to switch somewhere else and change all those passwords. Ugh.
Show threadAidenDec 22, 2022
@ringslinger @leo I'm thinking Bitwarden, but want confirmation that they do actually encrypt URLs first (and everything else for that matter).
Show threadRodolfo SaccaniDec 22, 2022
@aiden56 @ringslinger @leo check out how the key is derived. If it’s not just for yourself you may want to consider solutions that don’t rely solely on the entropy of the password chosen by the user.
Show threadRebe+lovesNYC @SanityorVanityDec 22, 2022

@aiden56 @leo

My former employer loved LastPass and I hated it so very much. I never felt safe using it.

Show threadTim MaliyilDec 22, 2022
@aiden56 @leo Holy crap!
Show threadMichael Kizer Dec 22, 2022

@aiden56 @leo It's certainly concerning since the point at which LastPass captures URLs is typically during account creation and poorly coded sites might be passing all kinds of "data" in that URL.

I usually let LastPass automatically save new credentials, but I try to go back into it later and strip the URL down to the base domain.

I'm assuming they don't encrypt the URLs since they are used for matching the site you are on in the browser, but there could be another technical consideration.

Show threadAidenDec 22, 2022
@mkizer @leo - if it's speed they want, they should just decrypt and cache all URLs locally on your device when you login.
Show threadZate 🦘🇦🇺Dec 22, 2022

@aiden56 @leo

I guess we'll do round two of the hot takes on this stuff.

So, generally many, many websites use your email address to log you in. some use a username, but it's more the norm to use your email.

The same email that has been in countless leaks for years and years is on countless "consolidated" lists etc, and is likely run against all manner of websites as part of the standard billions-long email stuffing lists.

Given that so many websites have email enumeration issues, that is it is sort of hard to both allow a user to lookup if their email exists or not when registering and make it not able to tell the same thing to a massively distributed, slow attack coming from residential IP's .. then they are going to know quickly if you are on a site.

they actually likely just don't care. The list of URLs your email is associated with is unlikely to really give any of these big operations any kind of advantage. They already factor in that knowledge.

So then, I assume you're going to jump ship to some other password provider, of which there are many. Of which, just about all are or will be, under attack at some point. If you think you are going to jump to a provider who can protect your stuff 100%, then that's funny.

I know, I know, we can/should all host our passwords on our own self-hosted service or only locally in our systems, and sure, that likely does provide a certain measure of security, I guess? But I already do that. It's an encrypted block here locally that I just ask LastPass to store and backup.

The thing is, for this kind of thing, you have to factor in Shannon's maxim / Kerckhoffs's principle in that the enemy knows the system. Assume they can get to the encrypted blob, and assume they can know your username on a site. The controls still hold secure in this case.

Show threadDave ByrneDec 22, 2022
@aiden56 @leo Shame, was a customer but won’t be again. Time to find a new vendor.
Show threadAlex HansfordDec 22, 2022
@aiden56
Is there a better option? I've had lastpass subscription at least as long as they sponsored TWiT. Would move the family over if I had to, but I'm waiting for some guidance on where to go!
@leo
Show threadAidenDec 22, 2022
@alexhansford @leo Bitwarden is the current sponsor, but I'm waiting for them to confirm they *do* encrypt URLs.
Show threadBrett KosinskiDec 23, 2022

@alexhansford @aiden56 @leo I personally use KeepassXC plus Syncthing for peer-to-peer syncing of the vault. That way no third party is in possession of my password database.

But it definitely loses out to something like LastPass as far as convenience goes.

Show threadAlex HansfordDec 31, 2022
@brettk
I went with NordVPN in the end - I don't know Bitwarden and they seemed to offer a good set of features. Plus I already have 1password for work, so needed something different. Hope it works out! 🤞
@aiden56 @leo
Show threadTrifster Dec 22, 2022
@aiden56 @leo agree! I dumpped last pass years ago and pretty sure I deactivated/deleted my account. Really hope my data isn’t in this leak.
Show threadAndy (Old Account)Dec 22, 2022
@aiden56 @leo Yeah, wow. That's insane. You'd think they would have encrypted that…
Show threadBenDec 22, 2022
@aiden56 @leo oh balls. I need to make sure other fields like “Notes” were in fact encrypted and not *just* the password field.
Show threadMattDec 22, 2022
@MarkWillard it is rare I have any sort of emotional response to a security incident but I’d be lying if I said this wasn’t infuriating.
Show threadjeremyDec 23, 2022
@matt @MarkWillard I’m tech-savvy adjacent, only enough to know to use a password manager. If the one I was using was, say, LastPass, should I disassociate from my annual payment plan immediately? And what one or two would you recommend instead?
Show threadMattDec 23, 2022

@jeremy @MarkWillard I won’t speak for Mark, but they’ve had a number of much less impactful issues over the years but this would be the point I’d move on.

I personally use 1Password and am quite pleased with it.

Show threadMark Willard Dec 23, 2022
@matt @jeremy agreed with Matt on both points. I've been using 1Password for about a year now and am really, really happy with it. I don't have personal experience with it, but I've also heard very good things about Bitwarden; which has a somewhat similar feature set to 1Password but unlike 1Password is free for individuals.
Show threadParkscope Joe :RCID:Dec 23, 2022
@MarkWillard @matt @jeremy i've been using 1PW for over a decade now and love it.
Show threadcharlesDec 23, 2022
@MarkWillard @matt @jeremy I used to use Lastpass. I used 1Password briefly. I currently use Bitwarden and love it.
Show threadHastinDec 23, 2022
@charles @MarkWillard @matt @jeremy I'm lazyish and I use Microsoft Authenticator. Same password system as they use for their corporate auth, and I love that it can require a security key or my Windows Hello (Fingerprint/Face) login for unlocking. Solid Android app as well.
Show threadSteven ArenbergDec 23, 2022
@aiden56 @leo Can you help me understand the security issue with the site URL’s being exposed. What information is vulnerable as a result? My email address? I could wait for Steve Gibson’s take, but I’m curious now. Thanks.
Show threadAidenDec 23, 2022
@Sarenberg @leo - I see it as a) privacy (do you want people to know all the sites you are on) and b) makes password reuse checks much easier if any of your passwords have ever been leaked.
Show threadSteven ArenbergDec 23, 2022
@aiden56 @leo Yes. Good points. Thank you. I really like the LP UI, the emergency access feature, ease of sharing passwords, etc. But this does have me considering other options. I wonder how painful it is to switch password managers…
Show threadChris WilliamsDec 23, 2022

@aiden56 @Sarenberg @leo

Can someone explain why I should be concerned? Because my passwords were encrypted, and all of the passwords are long and complicated - basically indistinguishable from line noise. The URL to a site doesn't seem like particularly sensitive information.

Show threadAidenDec 23, 2022
@gaffa @Sarenberg @leo 'sensitive' depends on your own standards. It also means that people can brute force your vault password (perhaps not an issue if long and complicated) and of course 2FA is merely a server side check, not part of the encryption key, so that is skipped once they have the actual vault offline.
Show threadChris WilliamsDec 23, 2022

@aiden56 @Sarenberg @leo

All of my passwords are unique and at least 12 characters with a mixture of numbers, letters, cases & symbols.

So I'm not particularly worried that anybody is going to brute force any of them, and if they do, they're not going to succeed until the heat death of the universe.

I'm not going to drop LastPass, given that they are being honest.

Show threadAdamDec 23, 2022
@aiden56 @leo This doesn't surprise me. Best to stay away for such services.
Show threadMike WelchDec 23, 2022
@aiden56 @leo I wish I would have discovered Enpass sooner! It works like LastPass, 1Password, etc. but you run the server on a local machine inside your network. There is no cloud element. This also means no subscription. Check them out: https://enpass.io
Enpass: Secure Passkey & Password Manager That Keeps Your Data On Your Cloud Storage

With Enpass, choose where your passwords and passkeys are secured and synced – on your personal or business clouds (or even offline). Not on our servers

Enpass
Show threadJohn Bergquist 🍥Dec 23, 2022

@aiden56 @leo I personally don't care or mind that the password vault was leaked. That is the whole reason why I decided to use a vault that had a Trust No One policy. I knew that eventually the vault would have leaked. Everyone needs to understand and learn that, if the data is online, it's public. Sorry, no way around that. It is never an 'if' it leaks, it is always a 'When'.

What really disappointed me was that they decided to leave the URL unencrypted.

Show threadWarrenDec 23, 2022
@aiden56 @leo I wish they had the whole thing encrypted.
Show threadClive ThompsonDec 23, 2022

@leo @aiden56

Yeah, i’m a lastpass user and discovered this fact while reading their email and blog post explaining the leak

Astoundingly bad design

Show threadduaneinvaDec 23, 2022
@aiden56 @leo Oh my. I can't want to hear Steve's reaction to this. I never used Last Pass, and now I'm glad I didn't.