Yes that is what is so weird about the whole thing.

1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. And I think it is reasonable to trust and assume Lastpass does not hold the masterpassword, as they have stated.

2. If it was browser extension, and clipboard sniffing, the scale would have been higher as well. But it is important to note there are many reports of those password have not been used for 3-4 years. They would have sat on a drove of password and decide today is the day. And yet report of these attacks, while scary, are still very very limited.

3. It is hard make a guess without everyone posting their OS, Computer, Browser, extensions, list of software, and even Router, Location, Network ( MITM ? ) etc.

4. We have tested the theory of Lastpass triggering the wrong email notification even with wrong password. So far doesn't seems to be the case here.

5. Nearly all reported cases are unique passwords. ( A few didn't specify )

6. There was a case where the whole Lastpass App and passcode was stored on an old laptop which hasn't been used for a long long time.

7. And yet there are also cases where account was only created in October / November this year. Meaning this activity is fairly recent. ( Doesn't rule out they could be two independent leaks or attack )

8. I was expecting someone working in InforSec would jump in, but I guess they are all on holiday at the moment.

9. This happened just after LogMeIn announced they will spin off Lastpass. I am thinking of the incident with Ubnt where the actual problem was internal, an employees hacking their own companies for bitcoin or something. Still I dont know how any Lastpass staff, without storing any Masterpassword could have gained access to it.

10. For now this doesn't seem like a coordinated PR attack on LastPass. If it was, seriously guys you need to do a better job with Social Media marketing. :P

Anyway It is an interesting thread to watch.

> 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't.

Wait wait, what do we know about the scale of the attack and how?

Even if the attacker had every single LP master password, that says nothing about how much resources they're spending hammering the service.

If the attacker only got a hold of password hashes or something, then it's true that they'll only be crack a limited amount. However, if that were the case you'd expect the people with easy passwords to get hit first, because an attacker would presumably go through the common words in the wordlist before the uncommon words, and finally a brute force search. Doing attacks in this manner would maxitimize the speed at which you gain access to accounts. However, this doesn't seem to be the case? You'd expect all the people with easy passwords "p4ssw0rd" or whatever to fall first, and in great numbers. This doesn't seem to be the case because many people seem to be swearing their passwords were unique/secure.

If the attacker got a hold of the raw passwords, then the speed of compromise could be easily thousands of accounts per hour. Just set up a bunch of TOR clients and bruteforce over that, or pay $10 for a few leaked VPN account credentials.

It's not a given that brute forcing is the strategy the attacker would choose. That might just lead to their Tor & VPN IPs getting quickly blocked, if they aren't already. There are only around 1500 Tor exit nodes and it's trivial to block them. Sometimes trying to stay under the radar might be the smarter choice.

Anyway, we still have no idea what the scale of the attack is or when exactly it started (IIRC someone reported this happening much earlier this month).

- Happy to vouch/solemnly declare that I have no financial interests in competing products, am not part of a PR campaign, etc. -- I prefer the title "Security Mensch", i.e. I'm just trying to fix problems when I see them :-) (I know you were saying it in jest! 0 offence taken)

- Thanks a lot for the great summary!

- To me, the hardest to understand is now 3 reports of people changing their passwords, and then receiving a new "Someone just used your master password to try to log in" email. That's mind boggling.

Specifically, if uBlock was compromised you'd expect widespread reports of cryptocurrency theft!

That's a good point.

I'm happy to delete my message if this way of finding out doesn't make sense.

Because it’s popular makes it an even bigger target.

Curious to know why you shortened 5M but not 10,000,000