How did LastPass master passwords get compromised?

Re:How did LastPass master passwords get compromised? by buck4roo on Friday December 31, 2021 @04:01AM (#29746191)

I haven't seen any mentions discussing HTTP request smuggling try. This could cause LP's internal or external load balancers to misdirect requests/responses.

Thoughts on this as a possible root cause?

[ Parent | on HN ]

Re:How did LastPass master passwords get compromised? by palant on Friday December 31, 2021 @10:18AM (#29748761)

I’ve given this some thought, but I think that this scenario still requires someone to attempt a login with correct credentials. It cannot be the legitimate owner however if the account hasn’t been touched for a year.

[ Parent | on HN ]