12/23/2022
I feel like I need to say something about Lastpass in the wake of the recent events since I recommended it to so many people, and continue to recommend similar technology.
I got an email from lastpass Dec 1st announcing they had a "security incident" and hackers accessed data in August 2022, and they were still trying to figure out exactly what hackers had accessed.
Yesterday, I got another email from lastpass, and they are basically saying it's almost a worst case scenario. They said hackers accessed EVERYTHING the company stores, including the encrypted version of our password vaults.
The main reason I ever trusted lastpass, is because I knew if a scenario like THIS ever happened, hackers STILL wouldn't be able to read our password vaults. I remain confident hackers can NOT read our password vaults.
The only way to decrypt a password vault is with the master password, and lastpass never stored our master password. When we log into the lastpass website, the lastpass browser plugin, or the lastpass app, our master password is never transmitted to lastpass. Since the company never had our master passwords, hackers don't either. The hackers didn't take anything that I wasn't already trusting the strangers working for lastpass with.
The only way hackers would be able to decrypt our vaults is if we were using a weak master password. Encrypted vaults are just one of the things hackers stole. They also stole data that was NOT encrypted, such as our names, email addresses, billing addresses, phone numbers, and the IP addresses we logged in from. To my surprise, it turns out the site names and URLs in our password vaults were not encrypted either. I suspect the company did this so they could spy on which websites we were using. Lastpass also collected unencrypted telemetry data about when we used each password record, and that was also stolen by hackers. I'm sure lastpass was selling this telemetry data to their "partners" so they could serve us more relevant ads.
I stopped using lastpass in Feb 2021 and switched to bitwarden, and I sent messages to all my customers that I knew used lastpass offering to help them migrate to bitwarden too.
The only possible way this could have been any worse is if hackers obtained the ability to modify the source code used in the website or app or browser plugin, and added extra code that collected our master passwords. I feel like there's less than a 1% chance that happened because this would have been noticeable by any security researcher that was keeping an eye on it, and hackers didn't take data from the lastpass servers anyway, they took it from a backup stored in a cloud storage bucket. I don't trust lastpass would be admitting it right now even if it did happen.
This does not change my stance on using password managers. I will still be recommending Bitwarden.
