Cloud-Based Password Manager LastPass Hacked

Password managers are a very attractive target for hackers
Image via Shutterstock

One of the most popular password managers, LastPass, announced today that their network has been compromised.

In a blog post at their website, CEO Joe Siegrist stated they have no evidence encrypted user vaults were stolen, or that any user accounts were accessed. However, the attackers did manage to grab account email addresses, password reminders, and authentication hashes and salts — so this is potentially quite serious, especially for people who didn’t use strong master passwords.

The possibility of an attack like this is one big reason why I prefer to use 1Password as my own password management system, with the password vault only stored locally on my system and shared with my various devices (computer, iPhone, tablet) only via wifi. It’s a little less convenient this way, but this hack shows it’s probably worth the slight extra hassle.

Here’s the full statement from Joe Siegrist; if you’re a LastPass user you should definitely follow the advice herein:

We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.

We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.

Nonetheless, we are taking additional measures to ensure that your data remains secure, and users will be notified via email. We are requiring that all users who are logging in from a new device or IP address first verify their account by email, unless you have multifactor authentication enabled. As an added precaution, we will also be prompting users to update their master password.

If you have a weak master password or if you have reused your master password on any other website, please update it immediately. Then replace the passwords on those other websites.

Because encrypted user data was not taken, you do not need to change your passwords on sites stored in your LastPass vault. As always, we also recommend enabling multifactor authentication for added protection for your LastPass account.

Security and privacy are our top concerns here at LastPass. Over the years, we have been and continue to be dedicated to transparency and proactive measures to protect our users. In addition to the above steps, we’re working with the authorities and security forensic experts.

We apologize for the extra steps of verifying your account and updating your master password, but ultimately believe this will provide you better protection. Thank you for your understanding and support.

Joe Siegrist
& the LastPass Team

Jump to top

Create a PageThis is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.
Or... you can just click this button to open the Pages posting window right away.
Last updated: 2016-01-01 10:29 am PST
LGF User's Guide RSS Feeds Tweet

Help support Little Green Footballs!

Subscribe now for ad-free access!Register and sign in to a free LGF account before subscribing, and your ad-free access will be automatically enabled.

Recent PagesClick to refresh
Manchester: Defiant and Proud Everybody reading this will have some connection to Manchester. Whether it's music you love (*waves at Charles*), football you enjoy, science you respect or that radical tradition you've read of, Manchester is a World City we all have some ...
Paul Canning
3 hours, 20 minutes ago
Views: 287 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Inclusive Approaches to Preventing Violent Extremism - Carter Center Violent extremism fractures communities, fosters division, and exacerbates political conflicts. It knows no religious, national, or ethnic boundaries. Violent extremist movements continue to fuel the world’s most violent wars in Africa and the Middle East, and right-wing ethno-nationalist extremism ...
Birth Control Works
4 hours, 40 minutes ago
Views: 168 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 1
Comments: 0
: 1
Five Truths About Voter Suppression - Center for American Progress The United States has a troubled history of voter suppression. Prior to the passage of the Voting Rights Act of 1965, many states used policies such as poll taxes and literacy tests to prevent African Americans from voting. Even ...
Birth Control Works
4 hours, 53 minutes ago
Views: 186 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Love It or Hate It-What Saudi Arabia Is Buying in Its $110 Billion Arms Deal Huge deals with israel, and Saudi Arabia. Our industrial war machine grows apace. TanksSaudi Arabia is expecting 153 M1A1/A2 tank structures, which will be turned into 133 Saudi-specification M1A2S main battle tanks. Twenty additional tanks will replace those from ...
Unshaken Defiance
5 hours, 33 minutes ago
Views: 198 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
On Trump and RussiaPresident Trump’s remarks regarding Russia as a candidate for President of the United States should have alarmed Americans regardless of party. Candidate Trump went out of his way to praise Vladimir Putin’s Russia, while simultaneously belittling the President of the ...
HappyWarrior
22 hours, 31 minutes ago
Views: 193 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Work, Not Sex? the Real Reason Chinese Women Bound Their Feet Girls who had their feet bound didn't lead a life of idle beauty but rather served a crucial economic purpose, especially in the countryside, where girls as young as 7 weaved, spun and did work by hand, Bossen said.Read ...
Birth Control Works
1 day, 6 hours ago
Views: 302 • Comments: 2 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Why Are All the Anti-Abortion Democrats Men? A troubling pattern emerges if you start looking at who in the Democratic Party supports women's reproductive rights and who doesn't. Though disappointing, it's far from surprising that all of the anti-abortion Democrats are men. Let me put that ...
Birth Control Works
1 day, 6 hours ago
Views: 389 • Comments: 1 • Rating: 1
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Virtual Reality Can Help You Feel More Empathy for Women Harassed at Abortion Clinics It's hard to understand what it feels like to be confronted or bullied outside a women's health center — until it happens to you. I'd never had that experience until last year, while reporting on the Supreme Court case ...
Birth Control Works
1 day, 6 hours ago
Views: 400 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Families of Chechen Gay Men Pressured to Sign ‘No Complaint’ Documents, Org Says The existence of anti-gay pogroms in Chechnya first surfaced in the independent Russian newspaper Novaya Gazet in April, reporting that hundreds of people had been detained and at least three are now thought to have died. Since then, police ...
Birth Control Works
1 day, 7 hours ago
Views: 293 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Indonesia’s Mass Rape Victims Are Waiting for Justice That May Never Come On July 15, 1998, then president BJ Habibie condemned the violence against women in a formal government apology. His new Reformasi government established a fact-finding committee to investigate the riots shortly after Suharto's fall. The National Commission on Violence ...
Birth Control Works
1 day, 7 hours ago
Views: 313 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0