LastPass Update: They're Under Attack, Too

Please see UPDATEs below.

Yesterday I mentioned that I'd found both convenience and (increased) security in the LastPass system for handling online passwords.

Late yesterday, LastPass announced that its engineers had detected a "network traffic anomaly" for which they could not immediately identify the "root cause." Then they found another small anomaly. As explained now on its blog:

"Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.

"If you have a strong, non-dictionary based password or pass phrase, this shouldn't impact you - the potential threat here is brute forcing your master password using dictionary words, then going to LastPass with that password to get your data. Unfortunately not everyone picks a master password that's immune to brute forcing.

"To counter that potential threat, we're going to force everyone to change their master passwords. Additionally, we're going to want an indication that you're you, by either ensuring that you're coming from an IP block you've used before or by validating your email address. The reason is that if an attacker had your master password through a brute force method, LastPass still wouldn't give access to this theoretical attacker because they wouldn't have access to your email account or your IP."

I am headed to an airport again and don't have time to explain "salted password hashes" etc just now. The take-home messages of the LastPass announcement are:
a) All LastPass users will have to change their "master password," which is not that onerous -- and LastPass will check to be sure that the change is coming from a recognized address or user;

b) People who choose "dictionary words" for their passwords -- ie, normal words that a hacker could just try at random, in a "brute force" attack, to see if one is accepted -- are at greater risk than those who mix the passwords up. The mixing up can include numbers, special characters, multi-word phrases, etc -- password construction is a topic for another time, but mainly this is a reminder not to have things like "password" or "123456" as your special phrase.

c) At first glance, the company seems to be erring on the side of being quick; transparent (in explaining just what happened, and the risks); and protective of their users (better safe than sorry, so everyone must change their passwords now) in its response. Speed, transparency, and a tragic imagination about what might go wrong are very important elements of survival in the cloud era. Based on what I know now, and how the company has responded, I feel good about still using them as a password protector. We'll see what comes next.
_____
UPDATE: from an airport, the comments on the LastPass site suggest a real range of experiences. Some users are reporting the problem mentioned in the email below: that after a user changes the master password, as now required by LastPass, all the other stored passwords are rendered into gibberish. Which is a whole new nightmare. Other users indicate no problems. The note quoted below suggests making a local copy of all the stored passwords before doing anything with the LP account. I can't vet or fully check this out at the moment, but in the spirit of real-time update, this is an important cautionary note. A reader writes:

>>WARNING:
1.       They have a blog post about a possible hack and advice they intend to give to warn people to change their master password
2.       I changed mine ahead of getting a note from them, though I may not have needed to (I use a Yubikey for 2 factor authentication). A harmless precaution I thought.
3.       As soon as I did so all of my records (hundreds) became complete gibberish
4.       I cannot even log into the support forum as I could - I'll have to create a new account
5.       But... others are posting the same problem
Looks like a disaster, and a great pity as this was working so well, so being deprived of it is a huge inconvenience.
I think the operative advice is to download all one's passwords before changing the master password. I don't keep my banking or other critical passwords online (I use and recommend KeepassX) and there's now a way of loading Lastpass passwords into this for safekeeping, which I haven't got around to yet.
I do have a backup stored in my own creation: a TiddlyFolio (a Tiddlwiki than can encrypt key data and which lives on a USB stick on my key ring): http://tiddlyfolio.tiddlyspot.com, but it's not as up to date as I'd like.<<

Some of the most recent comments on the blog itself have similar protective advice. We're all in the middle of figuring out the proper long-term cloud security protocols.

UPDATE^2: And a technically sophisticated user makes a case in support of LastPass's handling of the case and its long-term security.

About the Author

James Fallows is a national correspondent for The Atlantic and has written for the magazine since the late 1970s. He has reported extensively from outside the United States and once worked as President Carter's chief speechwriter. He, and his wife Deborah Fallows, are the authors of the forthcoming book, Our Towns.

The company is facing multiple lawsuits from brands who say it does not do enough to prevent fakes from being listed on its website.

A decade ago, when I was a reporter for the Los Angeles Times, I tagged along with Chris Johnson, an attorney representing True Religion jeans, as he searched for counterfeits in the stores of Santee Alley, Los Angeles’s hub for knockoffs. We’d go into a store undercover, look around, and ask if they sold any True Religion jeans. The store owner would sometimes lead us into a back room where the fakes were kept, and Johnson would buy them, and then inspect the jeans and see if they were indeed counterfeit.

Today, though, the process of finding people and businesses selling counterfeit versions of your product is much, much more difficult. The rise of e-commerce sites like Amazon and eBay have essentially helped created millions of such stores online—a seemingly infinite number of doors to knock on to check for fakes. Shut down one storefront for selling counterfeits, and the seller can just create a new account and open a new store. “Amazon has made it extraordinarily difficult to enforce against counterfeiters,” Johnson, who now works on online anti-piracy cases with the law firm Johnson and Pham, told me recently.