In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious…
TLDR;
In November 2022, LastPass, a password manager service, suffered a data breach in which hackers stole password vaults containing encrypted and plaintext data for over 25 million users. Since then, there has been a series of cryptocurrency thefts targeting individuals in the tech industry, totaling more than $35 million. These thefts primarily targeted individuals deeply integrated into the cryptocurrency ecosystem, including employees of crypto organizations and venture capitalists.
Researchers, led by Taylor Monahan, CEO of MetaMask, have identified a common factor among these victims: they had previously used LastPass to store their “seed phrase,” which is a critical private key for accessing their cryptocurrency investments. Armed with this seed phrase, attackers can instantly access and transfer the victim’s cryptocurrency holdings.
The LastPass breach exposed vulnerabilities in its security, particularly related to the master passwords and encryption settings. LastPass users who stored important passwords, especially for cryptocurrency accounts, are urged to change their credentials immediately and migrate their crypto holdings to offline hardware wallets. Alternatives like 1Password, which offer additional security layers like a Secret Key, are recommended.
While the research suggests a strong link between the LastPass breach and the cryptocurrency thefts, it’s challenging to definitively prove causation. Nonetheless, security experts advise taking immediate action to protect digital assets.
it’s a bad idea to have all your passwords centralized but for me it’s still an upgrade in security compared to remembering a few different passwords. I understand security is very important but I want to be able to appreciate convenience and not have to write all my random passwords on a book that I would have to bring with me all the time and look at every time I want to type a password. there’s no such thing as bulletproof security. I’m quite happy to have reduced my attack vectors to nearly one single point so I can focus on defending that one single point.
Password vaults are great! Giving them to a central authority is… a little risky though. LP has a pretty decent history other than this, so I don’t fault anyone for using them. But after that breach, it’s probably good to consider those creds burned and recycle them.
A good self-hosted alternative might be something like Keepass on Syncthing. Though a downside of that is that you might be even less likely to know of a vault exfil than a service like LP.
Either way you go, it’s good to recognize the limiations and act accordingly.
If you used weak passwords, gave them to a third party, the third party had their data stolen, and you didn’t rotate them, it’s your own fault.
And this is why you don’t want cloud based password storage systems. If you want to use a password manager, use something entirely local like KeePassXC. The database it creates is so small you could fit it on a floppy so it’s immensely portable.
Cloud based systems can be perfectly sound. You can read how other managers do it, which are also audited by security experts. It’s just LastPass being bad.
And sure, local can be more secure, but you’re then at higher risk of losing access to it, should the worst happen.
They are a real treasure trove though. Those crypto token thefts show there’s much money in that. I wouldn’t bet my most sensitive data they covered every single attack vector - external or internal. You managing your password locally may be much less secure but it’s also much less likely you’re directly targeted.
The accounts they’re breaking the encryption on were never configured properly. These are old accounts from when LastPass had weak defaults and neither the user or LastPass updated those settings on old accounts. Those settings have always existed though and could have been improved by the user.
The problem is more that LastPass’ system is bad. 1password (and probably others) mitigate a possible hack by having the keyring encrypted by something in addition to the password.
deleted by creator
Yes, definitely. It instigated a lot of turmoil and a gamut of spicy takes regarding the fundamental question of whether password managers as a model “work”. On the one hand some people laughed at the idea of putting your password on the cloud and touted post-it notes for being a more secure alternative. On the other hand people extolled the virtues of the cryptographic model at the base of password managers, claiming that even if tomorrow the entire LastPass executive org went rogue, your password would still be safe.
As far as I understand, the truth is more nuanced. Consider that this breach took place 9 months ago, but you’re only reading about cracked passwords now. It seems like the model did what it was supposed to do, and people behind the breach had to patiently brute-force victim master passwords. This means they got to the least secure passwords first: If you picked “19 deranged geese obliterating a succulent dutch honey jar at high noon” or whatever, you’re probably safe. But it doesn’t strike me as too wise to get complacent on account of this, either. Suppose next time the attackers get enough access to “tweak” the LastPass chrome extension to exfiltrate passwords. Now what?
The thing is we’re stuck between a rock and a hard place with passwords. We already know it’s impractical to ask users to remember 50 different secure passwords. So assuming we solve this using a password vault, there’s no optimal place to keep it. On the cloud you get incidents like this. Outside of the cloud one day you’re going to lose your thumb drive, your machine, your whatever. “So keep a backup” but who out of your normie relatives is honestly going to do this, and do you really trust a backup you haven’t used in 5 years to work in the moment of truth? I don’t know if there is any proper solution in the immediately visible solution space, and if there is, I don’t know if anyone has the financial incentive to implement it, sell it, buy it. People say the future is in passwordless authentication, FIDO2 etc, but try to google actually using one of these for your 5 most-used accounts, you’re not going to come out of the experience very thrilled.
These online password manager services are all half-baked scams that get away scot-free in any event of a breach (whichever the ones they just cannot silently hide away).
Only when/if they offer a minimum compensation backed by third party reputable Surety Insurance of at least US$5000 for every single breach for each compromised password/key/wallet/service for each effected customers would I even consider take a gander at their “unbreakable/unhackable” password manager service.
Until such a day arrives, I will continue to use FIDO2 hardware keys (Yubikey), asymmetric certificate pairs (gpg2, SSH, TLS, etc…) and the good old remember all my darn long passwords in my brain for symmetric ciphers (rjindael, serpent, chacha20, etc…) with the added help of Argon2id whenever implemented/available.
I sure hope companies becomes financially liable and accountable for all their privacy/security breaches unlike the last few decades of no consequence or just getting away with a negotiable fine.
