Re:LastPass users warned their master passwords are compromised
by gregsadetsky on Tuesday December 28, 2021 @06:41PM
(#29719718)
I agree that's a possibility i.e. false positive emails.
Counterpoints:
- LastPass officially responded to this story by saying that all of our passwords were compromised elsewhere and then someone attempted to login with those i.e credentials stuffing.
If it was a false positive email, it would have been easier to say that and a lesser reputation hit on them. Right now, they're saying "oh yeah those passwords were valid -- it's just that the attacker got them somewhere else, we weren't breached."
- The (now 3!) twitter reports mentioned in https://news.ycombinator.com/item?id=29719033 point out that someone attempted to login again after they changed their password. They received the "Someone just used your master password" email a 2nd time.
If those emails are not false positives (per LastPass), how could that have happened?
Counterpoints:
- LastPass officially responded to this story by saying that all of our passwords were compromised elsewhere and then someone attempted to login with those i.e credentials stuffing.
If it was a false positive email, it would have been easier to say that and a lesser reputation hit on them. Right now, they're saying "oh yeah those passwords were valid -- it's just that the attacker got them somewhere else, we weren't breached."
- The (now 3!) twitter reports mentioned in https://news.ycombinator.com/item?id=29719033 point out that someone attempted to login again after they changed their password. They received the "Someone just used your master password" email a 2nd time.
If those emails are not false positives (per LastPass), how could that have happened?