LastPass breach gets worse – reddit.com/r/sysadmin

Re:LastPass breach gets worse – reddit.com/r/sysadmin by deadfece on Wednesday January 25, 2023 @12:29PM (#34521277)

Export from LP and start migrating, starting with changing common social IdPs like Google, Facebook, Twitter, Github, Apple, Microsoft/Live/Xbox/Outlook. Update the password of remote access programs like Parsec, and your cell phone provider's password. Then go through your TOTP generator and start changing everything in your TOTP generator (especially since you might be using LP Authenticator - if you are, then move to a different authenticator at the same time). Next: banking, your work payroll, investment accounts, Tax/IRS, shopping. From here one out start going through the list by the amount of money involved. If you doubt that then go through them ordered by the amount of data involved.

If you get lost and stuff seems too hard, if your replacement product lets you sort by age then just sort by oldest and hit 5 today. Hit 5 more tomorrow. Keep chipping at it. At this point you might as well change one every single day.

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by azinman2 on Wednesday January 25, 2023 @12:41PM (#34521453)

I’ve always felt like there’s a startup in there that can reliably change all your passwords for you. Probably something like one time $299, which sounds expensive, until you realize the pain of doing this.

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by selykg on Wednesday January 25, 2023 @12:48PM (#34521559)

Ironically... isn't that something LastPass does for you?

https://www.pcworld.com/article/430756/nifty-new-lastpass-da...

This is an old article, no idea if the feature still exists or not.

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by ipaddr on Wednesday January 25, 2023 @06:24PM (#34525625)

More like does to you and forces you to do$ it yourself

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by ryandrake on Wednesday January 25, 2023 @12:52PM (#34521636)

Depending on how it was implemented, that could just increase the attack surface. Assuming it's a cloud service, now we have another company that has all your passwords, that can be breached. A better way would be desktop software that runs on your local machine and logs in to each web site by itself and changes all your passwords, without using any remote compute or storage, outputting a local file with all your new passwords (don't make the same mistake again using a cloud password manager).

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by azinman2 on Wednesday January 25, 2023 @12:54PM (#34521678)

I imagined this was local. I think it would be very difficult to trust it otherwise.

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by sorokod on Wednesday January 25, 2023 @02:40PM (#34523115)

Attack surface will increase regardless of implementation. It is another point that can be attacked, one that did not exist before.

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by artificial on Wednesday January 25, 2023 @12:48PM (#34521567)

Vault rotation++. I was bitten by this switching authenticators when one didn't have an export at the time. It was such a massive pain to login and remove, add, setup and annotate, store secrets and repeat.

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by deadfece on Wednesday January 25, 2023 @09:59PM (#34527233)

I love web scraping, maybe I can update this prior idea. With the high proliferation of botting, a lot of sites are now resistant to this type of scripting, but at this low volume of interaction, it may be doable with some effort like Undetected Chromedriver.

https://drewdevault.com/2017/05/11/Rotating-passwords.html

https://github.com/tsudoko/pass-rotate

[ Parent | on HN ]