Researchers to reveal critical LastPass issues in November 2015

[frogboy]

Content source

http://www.ghacks.net/2015/09/15/researchers-to-reveal-critical-lastpass-issues-in-november-2015/

Password managers are great as they store a virtually unlimited number of important information, accounts, passwords, credit card numbers and other sensitive data. They keep you from having to memorize unique strong passwords, or use other means to remember them such as writing them down.

All the data is protected by a single master password, and, if supported, by additional means of protection such as two-factor authentication.

Security of the password manager and its database is of utmost importance, considering that attackers would gain access to all the data stored by a user if they somehow managed to gain access to the account.

That single access would give the attacker access to most of the accounts of that user and even data that is not linked directly to the Internet if it has been added to the vault as well.


Full article. Researchers to reveal critical LastPass issues in November 2015 - gHacks Tech News

 

[LabZero]

Maybe the best solution is to write the password on a piece of paper

 

[frogboy]

Maybe the best solution is to write the password on a piece of paper

Now that is real old school.

 

[Deleted member 178]

The best solution is to set your password as: "your password"

More seriously , 2 steps verification should be enough

 

[Sr. Normal]

Maybe the best solution is to write the password on a piece of paper

Now that is real old school.

And tracing paper for a backup

 

[Tony Cole]

Now I am worried, I have 2-step verification enabled but they can bypass this. I use the lastpass enterprise edition and the firefox plugin, should I remove that????

I think my auntie (who's 66) is right, it's too complicated, people can hack and the old way of pen and paper and money, not credit cards is the answer - she refuses to go online or have an email. I've had, on 5 occasions people trying to take money from my HSBC account.

 

[Ink]

Maybe the best solution is to write the password on a piece of paper

You'd be wrong, very wrong.
Watch Episode 1 about Hunted, Channel 4's new reality show, can you go Off-the-Grid for 28 days?

 

[Cats-4_Owners-2]

Now I am worried, I have 2-step verification enabled but they can bypass this. I use the lastpass enterprise edition and the firefox plugin, should I remove that????

I think my auntie (who's 66) is right, it's too complicated, people can hack and the old way of pen and paper and money, not credit cards is the answer - she refuses to go online or have an email. I've had, on 5 occasions people trying to take money from my HSBC account.

I wouldn't worry (yet) @Tony Cole, your auntie's method (& Klipsh's & Sr. Normal's) works because it is consistent but neither is it foolproof. Just keep a close eye on your bank accounts. I agree with Umbra, that your 2-step verification should be enough. If I were smarter, I'd stop being lazy & activate my own! It is too soon to jump ship from The H.M.S. Lastpass!

 

[Surtur]

That's why I'm a happy Sticky Password user.

 

[LabZero]

That's why I'm a happy Sticky Password user.

Well, all software are vulnerable. ...

 

[Surtur]

Well, all software are vulnerable. ...

You're right ! But I have not heard about any vulnerabilities in Sticky Password lately.

 

[379EXHD]

A look into LastPass - Martin Vigo

 

[Welldone]

LastPass Forums • View topic - Researchers to reveal critical LastPass issues in November 2

 

[Cats-4_Owners-2]

A look into LastPass - Martin Vigo

Thank you @379EXHD for this excellent, albeit Scary, adventure into LastPass' vulnerabilities with (Thank God) a happy ending!
*Spoiler note: For all those whom lack the patience or desire to read to the end, Do Not use the "Remember Password" feature!

 

[Tony Cole]

Thanks Cats-4_Owners-2 I only found out about two-step verification 2-3 months ago. It is scary, and as technology goes forth it will get worse - I hope California is treating you well, nice and warm - the UK is cold

 

[BoraMurdar]

I will quote LastPass forums Admin

One thing to keep in mind is that the attack is not against our cloud servers, it requires access to your machine. If your machine is pwned, then you have problems no matter which password manager you're using.
...Martin continues to present his findings at various conferences, although the title of his presentation is definitely clickbait. Please read the post on his site; he responsibly disclosed his findings to us, and there is no reason he wouldn't do so if there were anything new.

 

[OokamiCreed]

I'm always using LastPass. Just like I'm always using PIA VPN. I trust them. Simple as that. They know what they are doing. There is no "best" software. If there are no vulnerabilities, it just that they hide them from the public, or no one is willing to find them. LastPass ALWAYS tells you if there is a problem. Put trust in companies that are truthful. Not many of them left.