LastPass Update: They're Under Attack, Too

Please see UPDATEs below.

Yesterday I mentioned that I'd found both convenience and (increased) security in the LastPass system for handling online passwords.

Late yesterday, LastPass announced that its engineers had detected a "network traffic anomaly" for which they could not immediately identify the "root cause." Then they found another small anomaly. As explained now on its blog:

"Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.

"If you have a strong, non-dictionary based password or pass phrase, this shouldn't impact you - the potential threat here is brute forcing your master password using dictionary words, then going to LastPass with that password to get your data. Unfortunately not everyone picks a master password that's immune to brute forcing.

"To counter that potential threat, we're going to force everyone to change their master passwords. Additionally, we're going to want an indication that you're you, by either ensuring that you're coming from an IP block you've used before or by validating your email address. The reason is that if an attacker had your master password through a brute force method, LastPass still wouldn't give access to this theoretical attacker because they wouldn't have access to your email account or your IP."

I am headed to an airport again and don't have time to explain "salted password hashes" etc just now. The take-home messages of the LastPass announcement are:
a) All LastPass users will have to change their "master password," which is not that onerous -- and LastPass will check to be sure that the change is coming from a recognized address or user;

b) People who choose "dictionary words" for their passwords -- ie, normal words that a hacker could just try at random, in a "brute force" attack, to see if one is accepted -- are at greater risk than those who mix the passwords up. The mixing up can include numbers, special characters, multi-word phrases, etc -- password construction is a topic for another time, but mainly this is a reminder not to have things like "password" or "123456" as your special phrase.

c) At first glance, the company seems to be erring on the side of being quick; transparent (in explaining just what happened, and the risks); and protective of their users (better safe than sorry, so everyone must change their passwords now) in its response. Speed, transparency, and a tragic imagination about what might go wrong are very important elements of survival in the cloud era. Based on what I know now, and how the company has responded, I feel good about still using them as a password protector. We'll see what comes next.
_____
UPDATE: from an airport, the comments on the LastPass site suggest a real range of experiences. Some users are reporting the problem mentioned in the email below: that after a user changes the master password, as now required by LastPass, all the other stored passwords are rendered into gibberish. Which is a whole new nightmare. Other users indicate no problems. The note quoted below suggests making a local copy of all the stored passwords before doing anything with the LP account. I can't vet or fully check this out at the moment, but in the spirit of real-time update, this is an important cautionary note. A reader writes:

>>WARNING:
1.       They have a blog post about a possible hack and advice they intend to give to warn people to change their master password
2.       I changed mine ahead of getting a note from them, though I may not have needed to (I use a Yubikey for 2 factor authentication). A harmless precaution I thought.
3.       As soon as I did so all of my records (hundreds) became complete gibberish
4.       I cannot even log into the support forum as I could - I'll have to create a new account
5.       But... others are posting the same problem
Looks like a disaster, and a great pity as this was working so well, so being deprived of it is a huge inconvenience.
I think the operative advice is to download all one's passwords before changing the master password. I don't keep my banking or other critical passwords online (I use and recommend KeepassX) and there's now a way of loading Lastpass passwords into this for safekeeping, which I haven't got around to yet.
I do have a backup stored in my own creation: a TiddlyFolio (a Tiddlwiki than can encrypt key data and which lives on a USB stick on my key ring): http://tiddlyfolio.tiddlyspot.com, but it's not as up to date as I'd like.<<

Some of the most recent comments on the blog itself have similar protective advice. We're all in the middle of figuring out the proper long-term cloud security protocols.

UPDATE^2: And a technically sophisticated user makes a case in support of LastPass's handling of the case and its long-term security.

About the Author

James Fallows is a national correspondent for The Atlantic and has written for the magazine since the late 1970s. He has reported extensively from outside the United States and once worked as President Carter's chief speechwriter. His latest book is China Airborne.

President Trump is reportedly considering drastic action to end the Russia investigation.

Why do Donald Trump and his advisors keep floating the possibility of firing Robert Mueller, an act that would spark the greatest constitutional crisis since Watergate, perhaps the greatest in modern American history?

Partly, it’s simple rage. Mueller threatens Trump. And when Trump sees someone as a threat, he tries to discredit and destroy them—conventional norms of propriety, decency and legality be damned.

But there’s another, more calculated, reason. Trump and his advisors may genuinely believe that firing Mueller is a smart move. And if you put morality aside, and see the question in nakedly political terms, they may be right.

The chances that Mueller will uncover something damning seem very high. Trump has already admitted to firing former FBI Director James Comey over the Russia investigation. Donald Trump Jr. has already admitted to welcoming the opportunity to get dirt on Hillary Clinton from people he believed were representatives of the Russian government. Even if Mueller doesn’t accuse anyone of a crime, he’s likely to paint a brutal picture. And that’s just on the question of election collusion and obstruction of justice. If Mueller uses Russia to segue into Trump’s business dealings, who knows what he might find. An all-star team of legal and financial sleuths, with unlimited time and money, and the ability to subpoena documents and people, have been let loose on the affairs of a man whose own autobiographer called him a “sociopath.” No wonder Trump is scared.