LastPass Breached, Customers’ Password Vaults Stolen ⇥ palant.info
We recently notified you that an unauthorized party gained access to a third-party cloud-based storage service, which LastPass uses to store archived backups of our production data. In keeping with our commitment to transparency, we want to provide you with an update regarding our ongoing investigation.
Paul Ducklin, of Sophos’ Naked Security blog:
To be fair to LastPass, the company didn’t repeat its original claim that no password vaults had been stolen, referring merely to “customers’ information” being pilfered.
But in its previous breach notifications, the company had carefully spoken about customer data (which makes most of us think of information such as address, phone number, payment card details, and so on) and encrypted password vaults as two distinct categories.
This time, however, “customers’ information” turns out to include both customer data, in the sense above, and password databases.
Simon Sharwood, the Register:
That file “is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.”
Which means the attackers have users’ passwords. But thankfully those passwords are encrypted with “256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password”.
Wladimir Palant, creator of Pain-Free Passwords, poured cold water on any relief that assurance may have provided:
I’ll translate: “If you’ve done everything right, nothing can happen to you.” This again prepares the ground for blaming the customers. One would assume that people who “test the latest password cracking technologies” would know better than that. As I’ve calculated, even guessing a truly random password meeting their complexity criteria would take less than a million years on average using a single graphics card.
But human-chosen passwords are far from being random. Most people have trouble even remembering a truly random twelve-character password. An older survey found the average password to have 40 bits of entropy. Such passwords could be guessed in slightly more than two months on the same graphics card. Even an unusually strong password with 50 bits of entropy would take 200 years on average – not unrealistic for a high value target that somebody would throw more hardware on.
Jeremi M. Gosney also has concerns about LastPass’ track record.
This breach will be catastrophic for an unknown but non-zero number of people and businesses. When it was spun off by LogMeIn as an independent company in December 2021, the press release said it had over thirty million users and tens of thousands of business customers. Some of those, particularly corporate clients, will be high-value targets, and they will now be expected to change all of their passwords. I am not sure what is a typical number of records, but anyone I know who uses a password manager has hundreds. I sympathize with anyone dedicating days of work to correct for LastPass’ failure to protect their customers’ data.
A password-less future cannot come soon enough.