Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.computer.security > #6289

Re: LastPass Vault Breached via Employee's Home Computer

Cross-posted to 2 groups.

Show all headers | View raw

On 28 Feb 2023, The Stuff of Legend
<Use-Author-Supplied-Address-Header@[127.1]> posted some
news:20230301062102.BA2BA1200C3@fleegle.mixmin.net: 

> On Tue, 28 Feb 2023 20:04:06 -0600, mike@notyahooie.com said in 
> Message-ID: <9gctvhheefdqp9ria0p1kh5gh41gqqjm9d@4ax.com>: 
> 
>> https://pjmedia.com/news-and-politics/gregbyrnes/2023/02/28/lastpass-v
>> ault-breached-via-employees-home-computer-giving-keys-to-the-kingdom-t
>> o-hackers-n1674308 
>> 
>> "Millions of LastPass users may be at risk after a major breach of
>> the home computer of one of their top employees. This employee was
>> only one of four people in the company with access to their corporate
>> vault. The breach may have come through a home Plex media account,
>> according to Ars Technica*, and appears to have been perpetrated by
>> the same hackers who breached LastPass security on a smaller scale
>> last August. At about the same time, Plex’s security was also
>> breached."
>> 
>> *https://arstechnica.com/information-technology/2023/02/lastpass-hacke
>> rs-infected-employees-home-computer-and-stole-corporate-vault/ 
>> 
>> This is wjy I don't use password mangagers.  I keep my
>> passwords/phrases in a PGP file on my comp. 
>> Yeah, I gotta copy paste after opening the PGP, but it is safer than
>> using password "protector" dumbware like LastPass.
> 
> The problem isn't password managers, per-se -- the problem is relying
> on a cloud- based provider like LastPass. BTW, using PGP is a *great*
> idea for protecting your passwords and other confidential data,
> especially if you use symmetric encryption to do so, using a
> Diceware™ passphrase. 

Sucks when you die and your executor must settle your estate.  You just 
handed a government the majority, if not all of your hard earned assets 
because nobody could access your financials for lack of password details.  

The government doesn't care.  They will wait the seven years to gleefully 
take your money.  Of course you won't care that your family was destitute 
or even homeless because you're dead.

> Back in the day, in a moment of madness, I seriously considered using
> LastPass, but ultimately what turned me off, and made me change my
> mind, was the cloud- based nature of the service. I just don't feel
> comfortable storing /any/ data in the cloud, regardless of its'
> sensitivity. 

Oh come on.  You know India managed cloud resources are safe.  Just ask 
IBM, HPE, Dell and Kyndryl.  They will tell you so.

Back to alt.computer.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

LastPass Vault Breached via Employee's Home Computer mike@notyahooie.com - 2023-02-28 20:04 -0600
  Re: LastPass Vault Breached via Employee's Home Computer The Stuff of Legend <Use-Author-Supplied-Address-Header@[127.1]> - 2023-03-01 06:21 +0000
    Re: LastPass Vault Breached via Employee's Home Computer mike@notyahooie.com - 2023-03-01 13:22 -0600
    Re: LastPass Vault Breached via Employee's Home Computer anonymous <anon@anon.anon> - 2023-03-01 21:03 +0100
      Re: LastPass Vault Breached via Employee's Home Computer The Stuff of Legend <Use-Author-Supplied-Address-Header@[127.1]> - 2023-03-01 23:26 +0000
  Re: LastPass Vault Breached via Employee's Home Computer No Soy <no@soy.invalid> - 2023-03-01 00:55 -0600
    Re: LastPass Vault Breached via Employee's Home Computer Nomen Nescio <nobody@dizum.com> - 2023-03-01 17:15 +0100
      Re: LastPass Vault Breached via Employee's Home Computer mike@notyahooie.com - 2023-03-01 13:17 -0600
  Re: LastPass Vault Breached via Employee's Home Computer peter <peterb@posteo.net> - 2023-03-10 14:30 +0100

csiph-web