LastPass: Notice of Recent Security Incident

Re:LastPass: Notice of Recent Security Incident by mhss on Thursday December 22, 2022 @06:25PM (#34100352)

When I worked at LogMeIn (previous owners of LastPass), I relocated to Budapest and worked in the same building as LastPass' engineering (I was in another division though). Getting a sneak peek of how the sausage is made gave me the hibbie jibbies and I switched to 1Password there and then. It appears like I dodged a bullet.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by __turbobrew__ on Thursday December 22, 2022 @06:50PM (#34100576)

What did you see?

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by mhss on Thursday December 22, 2022 @07:19PM (#34100799)

I cannot talk about specifics obviously since I was an employee. I can only say I did not see the sw engineering and infrastructure rigour I'd expect from a service that is managing very sensitive information.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by semicolon_storm on Thursday December 22, 2022 @09:00PM (#34101506)

Sounds about right. Awhile back I noticed the LastPass password generator was not in fact outputting a random password but that at least a few characters of the password followed a predictable pattern.

I reported it and it was fixed, but it's beyond me how a supposedly security focused company can let such a severe bug in such an important yet simple feature get to production.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by EspadaV9 on Thursday December 22, 2022 @07:09PM (#34100723)

How sausages were made, apparently.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by intelVISA on Thursday December 22, 2022 @07:09PM (#34100722)

Zero Knowledge Architecture(tm)

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by Obscurity4340 on Friday December 23, 2022 @04:59AM (#34104060)

™

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by Beltalowda on Thursday December 22, 2022 @09:44PM (#34101792)

> Getting a sneak peek of how the sausage is made gave me the hibbie jibbies and I switched to 1Password there and then

The big question with this is of course if 1Password's sausage is made any better.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by berniedurfee on Thursday December 22, 2022 @11:12PM (#34102261)

I hope 1Password is watching this closely and can learn from mistakes made by LastPass.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by mhss on Friday December 23, 2022 @02:00AM (#34103015)

Yeah I thought the same. I don't think 1Password is immune to security issues. However, after seeing several things I did not like in LastPass development, I decided 1Password was the safer bet. Knock on wood, they claim they've never been hacked and I hope it stays that way.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by acdha on Friday December 23, 2022 @09:06AM (#34105916)

They haven’t had the history of security problems that LastPass has had, and they’ve taken steps to handle this kind of situation by including an extra per-user key to stymie password guessing if someone does get the vaults:

https://support.1password.com/secret-key/

I stopped using them when they switched to subscription-only but I think it’s in their favor that they have planned for a nightmare scenario rather than assuming it won’t happen.

[ Parent | on HN ]

Re:LastPass: Notice of Recent Security Incident by dpacmittal on Friday December 23, 2022 @11:14AM (#34107372)

Moving from one cloud based password manager to another is hardly a solution. Use password managers which locally store the file and then sync them with gdrive/Dropbox. You can also add another layer of encryption to the file to be extra safe.

[ Parent | on HN ]