LastPass Login Attempted Activity Blocked – More Information

20 points by kevinslashslash 4 years ago | 12 comments

Just got this email from LastPass. I'm not satisfied with their explanation though.

As part of our ongoing commitment to security, we regularly monitor our services for actual, suspected, or attempted malicious or unusual activity. When our systems detect unusual login activity from different devices or locations we send an automated email for you to confirm the activity. Recently, you may have received one of these emails from us.

If the login attempt was you, and if you haven’t done so already, please make sure to verify your device and/or location. You’ll continue to receive emails like this when, for example, you log in from new devices or locations in our effort to keep your information secure. We also encourage you to reference our blog for best practices for keeping your account secure.

If the login attempt was not you, allow us to explain what happened. We recently received reports of an uptick of users receiving blocked access emails. Our investigation found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved.

At this time, there is no indication that your LastPass account or your credentials were breached or compromised. However, out of an abundance of caution, we recommend, if the login attempt was not you, that you reset your Master Password.

Lastly, it is important to remember that LastPass utilizes a zero-knowledge security model that is designed to ensure that customer data remains protected. When a LastPass user creates their Master Password, it’s used to generate a unique encryption key. The Master Password and the encryption key stay local on the user’s device – they are never sent to or shared with LastPass.

We apologize for any concern or inconvenience that these alerts may have caused. LastPass was built with security in mind and includes various features, including notifications for failed logins, trusted device verification, account recovery, and more. Read more about them on our blog.

Thank you for being a valued LastPass customer.

max002 4 years ago |

Im sorry, but im really missing concept of any cloud/online password manager. I believe this one was hacked some time ago. Obviously the whole thing being online increases attack surface.

Im using KeePassX, when i know i will move/use it on other machine i just transfer it via gdrive or whatever and delete that afterwards.

So... Unless you change your machines constantly or travel all the time and use different machines whats the real benefit of using online password manager? Its not a "nasty" question, im just curious of benefits and hope to get enlighted by people who use it.

dfdz 4 years ago | |

> im really missing concept of any cloud/online password manager ... im just curious of benefits and hope to get enlighted by people who use it.

Since you are curious, here are two reasons:

1) I regularly use multiple devices, and it is convenient. For example, lately local business require online orders/reservations. If you set up an account up using your laptop, then you can immediately login to the account on your phone.

2) I trust the math behind online password managers. For example, see this white paper describing 1password https://1passwordstatic.com/files/security/1password-white-p... In particular, see pages 10-11 (two-secret key derivation 2skd) and page 18 (How Vault Items Are Secured). As long as the 2skd protocol is implemented correctly, then it should not matter if the password manager is hacked. Presumably the few dollars a month you pay for the service is used to pay someone to carefully check this code.

Edit: In theory 2) reduces the "attack surface" to just the code implementing the 2skd protocol

infotropy 4 years ago | |

For me, it’s multiple machines. 2 iPhones, 3 iPads, 3 laptops, a couple of raspberries, and a couple of work machines. I tried to do it with a synced KeePass DB, but getting it to synch properly was nightmarish.

otachack 4 years ago | | |

I use Resilio Sync which used to be proprietary and it's been seamless. I do sometimes have to make sure the active device I'm on is synced before accessing the database but most of the time it's fine. I use my phone, laptop, and desktop as devices. With Resilio, there's a nifty option to have an encrypted store for devices you don't trust to read but trust enough to store (think like your parents computer or work computer)

SyncThing may also work for a open source solution, but doesn't have that nifty latter option I stated above, at least not out of the box.

varjolintu 4 years ago | |

Please don't use KeePassX. The development stopped already in 2016. Switch to a more active alternative. See: https://www.keepassx.org/index.html%3Fp=636.html

max002 4 years ago | | |

Thank you very much for bringing me up to speed. And as well to others who provided me with their responses, i kind of get it if you have many machines and even though i'd still try to find best way to sync i understand and appreciate your point of view. I will do read up on links on vaults provided and everything else. Thank you again.

notemaker 4 years ago |

Fwiw I also received this email, even though I deleted my account (faced with the now infamous error message "something went wrong: A").

I did not receive a confirmation that my account was deleted, the only evidence of that is that I can't log in anymore.

cirenehc 4 years ago |

Why are you not satisfied? Do you have additional data on why this could be a real vulnerability on their end?

SahAssar 4 years ago | |

Considering the many reports in https://news.ycombinator.com/item?id=29705957 of login attempts using the master password it seems like the full story has yet to be told. Saying that they "were likely triggered in error" does not say much to me, and the inclusion of the word "likely" sounds like they themselves don't know what triggered it.

bromuro 4 years ago | | |

Which answer would make you happy? I don’t understand the hype lately about LastPass.

kevinslashslash 4 years ago | |

The original response was essentially blaming affected users, saying it was credential stuffing. Now they changed their story. If there is any credibility to the credential stuffing story, they should ask all users that received the email change password, not just say change it out of an abundance of caution.

Obviously something changed as the emails just started going out recently. Maybe it was a recent code change introducing a bug on their end, that's fine software has bugs, but they could explain it. Maybe attackers are doing something different, which is triggering an old bug causing incorrect emails. Or maybe LastPass still doesn't really know and is just giving a potential reason, like they did earlier saying it was credential stuffing.

I'd already stopped using LastPass years ago and deleted my account when this current mess started, so they weren't really going to win me back anyway. But the (current) response to this incident leaves plenty of unanswered questions.