News for hackers. Stuff that matters.
Re:Ask HN: How did my LastPass master password get leaked? by gregsadetsky on Monday December 27, 2021 @07:39PM (#29708826)
LastPass does send out an email every time that there is a new login attempt with the correct password from a new ip address. An included link from that email must be followed for the ip to be approved. Then, you can actually login from that ip. (and yes, that's annoying re: travel/ip changes...)

When a wrong password is entered, no email is sent.

I tested the above (using a new ip with correct password -> email; wrong password -> no email) and it also aligns with what my "Account History" shows. There's a list of bad password attempts, and there's a separate list of "Login Verification Email Sent" i.e. the password was correct (presumably -- or maybe its hash -- that's one theory going around) but it was from a new, un-verified-so-far ip.

There are no comments on this comment yet.