The LastPass Hack Has Gotten Worse: What to Do to Protect Yourself

[@KathyZant]

After extensive research, I’m switching to NordPass. You can watch my research video here: kzbin.info/www/bejne/eaLcY5poorqjmaM And I've got a deal for you! Get 2 years of NordPass with 1 month free for a personal account: www.nordpass.com/kathyzant Or, use code kathyzant at the checkout

[@uncle0eric]

Thanks for this informative and helpful video! I've used LastPass for ages, and I have to say I'm really disappointed in their apparent lack of full disclosure.

[@wisenber]

AES-256 would require a small server farm several days to crack without special characters. That means the hackers would probably want to identify which users would potentially be worth the effort prior to allocating those resources. For security purposes, I give all of my pets highly complex names with special characters. It's confusing to my dogs, but offers more security.

[@KathyZant]

Hilarious! And yeah, the unencrypted data that came with this dump could definitely be used to identify which users might just be using a password manager because someone hollered at them to do so versus someone taking their security seriously. Please give your dog X6h#f109b$f10o a pet for me.

[@wisenber]

@@KathyZant Great. Now I have to reset my dog's name.

[@ronaldhofman1726]

I have a password that was more then double from the guidelines , so am not worried , but it's thte feeling that i got from this that made me to switch over to a other password manager, deleted lastpass , it's about trust and that is gone.

[@maestrostevens]

This sucks as a heavy LastPass user but I'm grateful you pointed it out so I can make the decision of where I want to switch to. Thank you Kathy!

[@KathyZant]

Thank you, Maestro! I hope you have a blessed and happy 2023! Looking forward to working with you more!

[@MichaelStrother]

Thanks for this video. On top of all the other headaches, I've discovered that some entries in my LastPass account have not been exported into the CSV. Good times.

[@KathyZant]

Oh no. Sorry to hear it. Definitely not a good way to start the year, but it's good that you are taking swift action to protect your digital life.

[@SerDunk-224]

Thanks for the video, Kathy! I've been having problems with LastPass lately, such as having to close the app and reopen it on mobile, as it would hang in the logo screen, or having to re login when on the browser, because the passwords pages would become unresponsive, the fact that they only allow you to use the account on mobile OR on PC, but not both (you have 3 switches available), and the latest hack was the last straw for LastPass =P I'm now trying Bitwarden, as 1Password doesn't have a free account option, only a free trial; and I have completely deleted my LastPass account.

[@KathyZant]

Smart moves, @serdunk. I'm sorry you had so many issues with LastPass. I hate throwing companies under the bus for a breach because it can happen to anyone. How they handle it really matters. And this was not handled with the customers' best interest at heart. It's sad, really. BitWarden is something many of my security-conscious friends use, and it looks to be very promising. Thanks for your comment.

[@TheBigBlueMarble]

You do not need to assume everything is compromised. A strong master password (at least 12 characters of mixed character types) means the likelihood that your vault can be accessed by a brute force attack is incredibly small and would require computing power that is not readily available. Even with access to super computer-like power it would take years of processing to crack just 1 of the tens of thousands of vaults taken. The initial breach happened months ago but data taken at that time was inconsequential to users. It was only much later, after a LastPass employee was successfully phished, that encrypted vault data was taken.

[@KathyZant]

An important distinction: the initial compromise happened months ago, but the disclosure at that time led us to believe that the breach was inconsequential. We found out later that the initial breach was QUITE consequential and that LastPass did not disclose that vaults were compromised for 5 months. Unfortunately, many users did not use a complex 12-character master password. I highly recommend this read: blog.1password.com/not-in-a-million-years/

[@nqkoi159]

At least we know that lastpass shares info about breaches. We don't even know if other competitors were hacked and did not mention it.

[@KathyZant]

In most jurisdictions, companies are required by law to disclose breaches. My concern, and the concern of many other security researchers, is how they've trickled out information rather than letting customers know immediately that malicious actors had gotten access to customer vaults. They dropped that information right before Christmas and didn't respond to multiple requests for clarification from reporters. More info: www.wired.com/story/lastpass-breach-vaults-password-managers/

[@slider9162]

I recently moved from LastPass to Keeper, and it's been an excellent password manager.

[@5canwalk]

Great reminder🎉 happy new year❤

[@KathyZant]

Happy New Year! Thanks for watching.

[@GadgetGal_]

Great video and wonderful advice. In addition to a very long master password and SMS/2FA, I suggest the double blind password strategy and increasing the PBKDF2 iteration. Both are super easy. In BitWarden I set my PBKDF2 to 1,000,000 and may go higher. I feel safer now when with LP.

[@KathyZant]

Exceptional tip, Ana. Thanks for sharing.

[@jjnlucky]

@@KathyZant how to remember these extra long passwords though? I switched to 1Password which also has a master password. It's set to ask me for it after 4 hours -- my friend has hers set to never --- maybe I shouldn't worry with leaving it to be logged into all of the time -- guess I don't have that much critical stuff. I've got one that is 15 characters that I can remember but, dang, typing it in without making a mistake is a challenge at times (esp. when my reading glasses are in the other room).

[@KathyZant]

@@jjnlucky The best part of having it ask you regularly is that it will help you remember it. Writing it down on the printout that 1password gives you and storing it with your other sensitive documents (in a safe or safe place) makes sense, too. Passkeys are starting to roll out which will make a lot of this frustrating nonsense obsolete soon. I'll do a video on that VERY soon, I am super excited about it.

[@KathyZant]

@@bigjonradio I read that too. Very concerning. Also read that they were instructing employees to refer to this breach as an incident and not to use the word breach. Just boggles me.

[@PeterPan-qi8oc]

Hi Kathy, thank you for putting this helpful video. This breach exposed people's email address among many other sensitive data. Do you think it is okay to use that same email address to setup service with another password manager knowing that hacker probably has that email or should people start from scratch & change email they have used extensively for many years which can be hard? it's easy to setup new email but it adds more complexity or room for error by having multiple emails etc. your take on this?? 2fa and strong password all way of course

[@KathyZant]

I wouldn't worry so much about the email being exposed. If you go to haveibeenpwned.com and put in your email, you can see how many other breaches have exposed your email to malicious actors. I'm going to bet that your email is there. There's not much an attacker can do with your email except phish you, and it's incredibly important to remain vigilant against those attacks.

[@2much2see2]

Great video. Thank You. I’m a bit confused about your mention of using “email username variety”. Are saying to go to the account and change the username to your email with the added word? If I’m changing the username, why use my email? Can you clarify? Thank you.

[@KathyZant]

Hi James. Should your credentials ever be in a breach, that email address is useless to attacker's scripts to attack other accounts. So [e-mail] would be useless in an attackers script going after your PayPal account. Another viewer had a great suggestion too about double-blind passwords. For example you have a strong 16-character password stored in your PW manager, but you have a phrase that you always add to your passwords only known to you. So you use your password manager for the most complex part, but 4 digits are always in your head and no one else knows those. Should the password manager vault be compromised, it would be useless to attackers' scripts. It's rare (unless you are a celeb, politician, CEO, or apparently a LastPass dev, lol) to get spearphished in a targeted attack. Most people are exposed simply because they're in a breach and a script looping through stolen credentials does the work. So it's not hard to put a speedbump on a script.

[@2much2see2]

@@KathyZant Thank you!

[@KathyZant]

@@2much2see2 You're welcome!

[@vibrusi]

Do you recommend NordPass as an option?

[@rjhikes6248]

My main issue with 1Password is that it only supports authenticator apps for MFA. Its better than SMS but it's still weak tea. The paid version of Bitwarden allows physical security keys as well as Duo which does still offer a free version. Since you only have to remember one password with a password manager, make it a good one. I don't like pass phrases composed of dictionary words. Acronyms that have a meaning only to you are easy to remember and hard to guess.

[@PeterPan-qi8oc]

Hi Kathy, Is it safe to import the password vault csv from lastpass like you showed in the video and put in onto new password manager? makes me little nervous taking "any" data from lastpass system and using it in new one - would it be infected or cause something bad to happen? i might be overthinking it. it does make it lot easier to take download csv and upload when someone has 100s of password changes needed - doing it by hand would be just too much. would love to get your input. greatly appreciated. thanks

[@KathyZant]

We're not hearing any signs of intrusion into LP systems, just a leak out from their systems to malicious attackers. As such, the CSV you download is going to be ok. Download and import into your new PW manager, then start prioritizing those immediate changes (email, banks, cellphone, etc.) and work down from those highest priority accounts. Adding 2-factor authentication while you're at it is a great next step.

[@Windows98R]

It’s easy to swap providers when it comes to password managers (one thing all of these guys have been good at), there’s always a export button built in.

[@mattbosley3531]

My master password is over 20 characters long, not a dictionary word(s), contains capital and non-capital letters, special characters and numbers. Nobody will ever guess it or brute force it. Even my shortest passwords on most web sites are ten characters with capital and non-caps, special characters and numbers. That's why I need something like LastPass to remember them all. If I forget my master password it's stored on my phone with double fingerprint protection in a hidden folder.

[@KathyZant]

Sounds like you're doing passwords right! That being said, I'd use anything other than LastPass. Some of the other information that has come out includes the fact that most of the identifying information they have (including how you're using your passwords) was not encrypted. The sites you're using, whether or not it was an auto-generated password, and more. BitWarden or 1Password; please do consider using a password manager OTHER than LastPass.

[@PeterPan-qi8oc]

Hi Kathy, what are you thoughts on using a local password manager and avoid putting it on the cloud? wouldn't that be a much more secure for a simple home user who has one computer they use and not need for mobile or cross device syncing etc? what am i missing? i am sure there are other risks for local password manager. would love to get your thoughts and maybe recommendation on some good local password managers. thank you again

[@KathyZant]

The most secure data is in a physical vault buried in your backyard under 6 feet of dirt, not connected to the internet. But that security comes with a price. All security is a continuum and we just have to make decisions on what is going to work for us in both ease of access and strong security. If I didn't have mobile access to my passwords, I'd have issues, so I have to be able to access from both my computer and phone. But if that works for you, it's definitely more secure. And yeah, I fought Pw managers for a long time for these very reasons. Thanks for the questions!

[@PeterPan-qi8oc]

@@KathyZant do you have suggestion on any good local password managers that's simple to set up? Do i need my own hosting server rack for somethign like? i am not super techy to host my own server and the upkeep of IT infrastructure. but if it's something that can be installed on my laptop easily and does the job....i'd give it a test & see :)

[@KathyZant]

For local password management, take a look at keepass.info/ I know a few people who use this. Of course, storing locally means you have to ensure you've got good backups!

[@christiankrueger8048]

Thank you!

[@KathyZant]

You're welcome!

[@Lcvds]

@KZ what about those Lastpass customers with ¨good passwords¨ and also have two factor authentication and a Lastpass master password . If that master password is compromised and breached is two factor authentication by app or hard key Really going to HOLD the line on these password vaults???

[@KathyZant]

In this particular instance, your "good password" for a master password is the only protection you have. If you had a strong and long, random, only used once password for your master password, the likelihood of your vault being compromised is low, but no zero. 2FA won't help here because that only secures the LastPass login, not the vault itself and attackers got the data behind that login, if you know what I mean. To be safe, change passwords on the accounts that matter most first, and as you have time change the rest. Some people have argued that "well they have had this data for 5 months, so if you haven't been hacked yet, you aren't going to be." I would point to the Twitter dump of 200M+ email addresses that was over a year old that just showed up. Hacker gonna hack, hackers are also incredibly patient and persistent.

[@Lcvds]

@@KathyZant thanks for clearing this up. It means a lot. Take care

[@KathyZant]

@@Lcvds thanks for watching. If you have more questions, let me know, I'll do my best to answer.

[@libbyd1001]

If your LastPass account is secured with a 2FA key (ie. YubiKey), would that be enough to feel relieved? I've already switched to a different PW manager anyway, but asking for the technical aspects of it. I'm certainly no pro at this stuff.

[@KathyZant]

Unfortunately, no. While 2FA is wonderful, if the vendor has a breach where an attacker gets access to the data itself (as in this case), 2FA does nothing. It's like they got the files downloaded from LastPass' system and 2FA doesn't matter. They just have to brute force the master password to unlock the vault. To add insult to this, data has come out showing that a majority of data wasn't encrypted including customer info, URLs, and how passwords were generated, most recently used... all of that unencrypted data can help attackers figure out where to target phishing campaigns and more. It is, in so many ways, a terrible breach with wide reaching ramifications.

[@TreeLuvBurdpu]

LastPass has the feature were they tell you it's your password was in a breach.

[@KathyZant]

1Password has something similar, called "Watchtower" that is integrated with haveibeenpwned.com. LastPass used to have a service called Sentry that integrated with PwnedList, but PwnedList got hacked at one point and shut down. They say they've got Dark Web and breach monitoring, it would be interesting to learn how that works.

[@BrianRouse]

I'm going through the process to move all of my accounts and passwords off of Last Pass to Apple's password manager. What's shocking is the number of usernames and passwords I have to move.

[@KathyZant]

You're not alone! A lot of people are going through the same process. It's a good time for security checkups, closing old accounts you don't use, and rotating passwords anyway, but definitely a lot more fun to do it when you choose to rather than being forced to. Thanks for watching.

[@crseabrk]

What is the likelihood that the export function has been manipulated? I imagine a hacker that gets users running for the door, that function would be the optimal target. If they got to the source is it possible the current code was compromised?

[@KathyZant]

The export function that is built into the LastPass app is just one method of connecting to your vault. The vault itself is a database (or part of a database) stored on a server somewhere. The hackers got into the raw database(s) that contain customer vaults. As such, the export feature in the app is of little importance. To use the export feature, someone would need to have an app installed and be logged in as a particular user pointed at a specific vault. These hackers got the vaults. They're likely not using apps to address the vaults and rather are likely attempting access from some command line access. Once they've got the access figured out from the command line, they'll script something to brute force in directly to the vaults and not use the LastPass app at all.

[@crseabrk]

@@KathyZant I understood that they also got to the source code. Were there any updates to the app since the breach? If they cause people to lose faith and export their information in the clear ( csv file) and this is transmitted parallel to the download / export, then they wouldn’t have to go to the trouble of cracking the passwords , they’d be delivered. Since last pass isn’t open source, who can tell. The whole db heist could just be a diversion. I would just go to my websites or whatever and do a password recovery for each.

[@crseabrk]

@@KathyZant BTW excellent video!

[@moshegrinberg7661]

What about those who used Azure IDP to login, since day 1? Are they safe?

[@KathyZant]

Based on the research found in this reddit thread, it looks like federated azure logins were stored separately and appear to be safe. That being said, I'd definitely investigate your set up to ensure that you are indeed using the federated logins and not a master PW. More details in this thread. I hope this helps. www.reddit.com/r/Lastpass/comments/zvv0tk/lastpass_breach_question_about_azure_federated/

[@moshegrinberg7661]

@@KathyZant I'm the one who setup our environment so it's definitely federated access and with no Master Password

[@NotARegularLurker]

Tfw hackers can access my LastPass account but I can't because I totally forgot master password 😂

[@KathyZant]

Well then let's hope that the hackers have fun with those passwords. (Still change them, and use something else!)

[@bigjonradio]

You can get LP to email you your password hint. Otherwise you can try an account recovery. You may also be able to reset the LP Master Password if you log in from a 'known' browser with the LP extension installed.

[@mrpcakes]

is there a way to find out who's vault were taken ?

[@KathyZant]

Unfortunately no. And LastPass has not been forthright in letting us know what happened initially. Maybe they didn't know that customer vaults were stolen at the time? But the timing of the disclosure that they were stolen, right before the Christmas holiday, has me wondering if this was done in an attempt to lessen attention on the extent of the breach. We're also finding out that LastPass had stored 32 out of 38 pieces of information for each user/pass pair unencrypted. So, we're finding that the URL of the site, password creation time, last time changed, last access time, whether or not the PW was auto-generated, along with your personally identifiable info (name, email, etc.) unencrypted, so hackers have that. That information can be used to phish, brute force, and more. It's just a bad situation all the way around. If you are a LastPass customer, assume your vault is in the attackers' hands and that your credentials are vulnerable. Start changing the passwords you stored in LastPass, starting with your email, cellphone, banks, and work down in priority from there. Also, while you're at it, add two-factor authentication to your most important accounts to protect them.

[@bigjonradio]

Assume all. All personal, family & enterprise account vaults.

[@stevet3217]

i have a Lass pass account, i also use Yubi key for authentifacation and have a vpn on 24 7 what is my option ? change company

[@KathyZant]

At this point the biggest concern is that LastPass is likely not going to recover from this. The best option is to switch companies and change all passwords. The attackers got a hold of the backed up vaults, so it is just a matter of time before master passwords are brute forced. In this situation, two factor authentication won’t help us with our vaults.

[@KathyZant]

I just posted an updated video with more details about this breach. I highly recommend watching. kzbin.info/www/bejne/gJCxkpeieMR-rJI

[@gttechlife]

You mentioned long randomized passwords being less able to be brute forced. I had been told multiple random dictionary words was more secure than random

[@KathyZant]

I think that the goal with long multiple random dictionary words has always been to provide something that can be memorized. I typically go with the randomized approach, but long 16+ characters and randomized. Unfortunately, we've seen that many people are using very crackable passwords, even to this day. The five most common passwords are 123456, 123456789, picture1, password and 12345678, according to 2020 research from NordPass. And less than 30% of people are using two-factor authentication on key accounts. It will be good when passkeys is more implemented. Passwords are rather broken these days, and 2FA is just adopted enough by end users.

[@thomasmaughan4798]

Passwords are part of a SYSTEM. Long complicated passwords are essentially impossible to brute force, but also impossible to memorize, so people write them on something. That breaks the security of the system even though the password itself is essentially unbreakable. Consequently, a pair of ordinary words, unrelated to each other and to you (not your favorte color or your cat's name) enhances the security of the system. MFA or 2FA goes a long way to reducing risk of your password being compromised BUT at added inconvenience and assumes you will always have your device at hand.

[@bigjonradio]

Gary, take a look at DiceWare. Usually only a dictionary of 7000 words, but random passphrases can be generated by rolling 5 dice! My feeling is set passphrases with 5 or 6 words to increase entropy. Add in special characters between words, capitalise one or more words, add in numbers. Humans are less likely to come up with truly random words/phrases!

[@ronaldhofman1726]

Someone came up with the idea that i they use a server farm to brute force it, then it then the time is reduced to get access but is that possible?

[@KathyZant]

Weaker passwords can be brute forced faster, more complex/stronger passwords would take longer. To be as safe as possible, assume your passwords are compromised and move off of LastPass, change passwords, and add two-factor authentication. This breach happened in August, so attackers have had the vaults for 5 months already. Assume the worst and take steps to protect yourself. I recorded an updated video here with more details about the compromise: kzbin.info/www/bejne/gJCxkpeieMR-rJI

[@ronaldhofman1726]

@@KathyZant yeah that's the best appoach , changed the most important passwords ia have, but i have a lot of webshops , wil look at the video thanx.

[@ronaldhofman1726]

I am so angry at these morrons , have a lot to change right now , the most important one first what is the info worth of meeting the minimal guidelines of master password?, 5 months is a long time why did they wait so long before taking action and inform the clients about this ,33 milion poeple where using lastpass

[@ronaldhofman1726]

i switched to bitwarden , i am not affraid that the fault is compromised because my master password is long multi character and is a scentence and MFA (yubikey) , but because this the second time this happened and bitwarden is encrypting url;s also lastpass is not.

[@KathyZant]

Switching is definitely the best option.

[@ronaldhofman1726]

@@KathyZant i am going to ask lastpass if there's internal protection in de fault to prevent brute force iterations.

[@KathyZant]

@@ronaldhofman1726 The problem is that the attackers got copies of the vaults. So LastPass doesn't have control over those vaults anymore. There's no way for LP to protect further. Also, the fact that LP is not answering reporters questions (see the Wired article in my subsequent video) leads me to believe that they're not being forthright about this attack.

[@vanwrinkle-01]

So, a security company has been hacked and lost ENCRYPTED PASSWORD VAULTS. It isn't funny but I'm laughing. Kind of an oxymoron. However, I dropped LastPass immediately and reverted to my own form of encryption. I'll not make that mistake again.

[@KathyZant]

Smart move, Rip. Thanks for the watch!

[@patrickmchargue7122]

Something of a commercial to get off LastPass. The only real advice is "change all your passwords."

[@KathyZant]

Less a commercial and more of a PSA to protect yourself from companies that make bad decisions. Thanks for watching!

[@vsammy_poet]

I never have trusted these Password management services. these will be always hacked eventually.. 🤔

[@KathyZant]

I feel you. It is definitely a single point of failure. Security is a continuum, however, between freely accessible to everyone and buried 6 feet in the ground and not connected to the internet. We've all got to make our decisions and none of those decisions will be black and white. For many people who are using dictionary words, pets names, or even their zip codes as passwords (I've seen some bad ones), a password manager is definitely a step up. But LastPass has shown disregard for customer privacy & security and a blatant disregard to responsible disclosure. Betting that we will see some legal ramifications here as well as further breaches. Eventually, passkeys will replace the password, but we're all quite early to that game. It will be a few years before passkey usage is widespread. Passkeys uses public/private key encryption and solves a lot of the problems with passwords, and even 2FA. But yes, eventually there will be security issues with passkeys, too.

[@StephenIdaho]

Stephen Anthony 0 seconds ago LassPass...I'll Pass. go read my free Substack for secure implementation of KeePass with YubiKey and encrypted DB backup to AWS S3. Bits, Bytes & Security