Home

LastPass Security Incident Answers

ChrisFerguson

I'm trying to understand if the "notes" field within the "password" item is encrypted.

A list of encrypted/non-encrypted fields would be very handy in order to see how exposed we are.

(Note I am NOT asking about "secure notes" that are encrypted)

Thanks

Chris

Find more posts tagged with

Comments

confuoco03

NOTICE

Sorry to OP, but I can't post new topics to the community, and I can't get LastPass or GoTo to help me with that or with my original security bulletin questions, so I'm forced, after many emails and surveys stating the issues, to post my question here.

TOPIC BACKGROUND

The recent security bulletin mentions premium features that will be available to Free users in the coming weeks. (see example "Task 3.1: Review your overall password strength using the Security Dashboard)

TOPIC QUESTION

When will those features come available? It has been weeks.

drag0nn

What measures should we adopt after the Security Incident

1) Was the content of the secure notes accessible by the attacker?

Should we worry if we have annotations or passwords in our secure notes?

2) Did the attacker access the content of the vault, URL user and passwords? should we change them?

should we change the passwords of all websites?

3) should we change the google authenticator 2FA?

4) Should we change the master password?

I THINK IT WOULD BE USEFUL to send an email to all those affected to change passwords, notes, 2fa, master password, if this is necessary. in a clear way, not with a bulletin that people with little knowledge do not know what to do.

Thanks

2Spiffy

See the comparison table at https://1password.com/switch/

It's self-interested but the first two rows are important security features.

Chiaramaioni

Oh I am just waiting to be back in. Trust me, in less than one year i had wayyyy too many issue for this lovely “ paid service “ …. But for now .. I MUST GET IN!!! Any reco of other serious passwords managers companies when i finally will manage to get in?

2Spiffy

Yes. Change all this info and store it somewhere else.

Stay vigilant about spear-fishing attacks that appear to come from LastPass, your specific bank branches, and other companies. The hackers have your website URLs and your IP address history.

Also be careful with offers received to join class action lawsuits.

https://www.extremetech.com/internet/342030-lastpass-hit-with-class-action-lawsuit-following-data-breach

wild-spokane

Please do yourself a favor - STOP USING LASTPASS and move to another password manager such as 1Password or Bitwarden.

• Change ALL of your passwords
o DO NOT save the new password in LastPass, save it in your new password manager
• If possible, create a new email address and re-associate the accounts you have in LastPass to the new email address
• Enable two-factor authentication on all of your accounts if available
• If you had any credit cards, debit cards, or store charge cards saved in LastPass, contact the issuer, and tell them you lost your card and have them send you a new card with a new account number. You should be able to request a new card on the issuer’s website. Remember to say the card was "lost", otherwise they might just send you a "new" card, but with the same account number. (This happened to me, so I had to make a new request and said the card was "lost" and they sent me a new card with a new account number.)
• If you saved any Wi-Fi connection information in LastPass, change all the information that you saved. It's highly improbable that someone would sit outside your house and siphon your internet connection - they could... So, why take the chance?
• If you saved any Windows BitLocker or Apple device recovery keys in LastPass, you should regenerate new recovery keys, then save them in your new password manager
• Most credit and debit cards allow you to "lock" the card to prevent any purchases, except for existing reoccurring charges. Lock all your cards when they are not being used. You can lock and unlock cards via the issuer’s website, and the setting takes effect immediately. So, should you need to use your card, log in to the website, unlock the card, and you will be able to use the card. Just remember to lock it when you're done. If you have a daily use card, it "should" be safe to keep this card unlocked. Additionally, most card providers have a mobile app that will allow you to perform card locks/unlocks.

I have spent hours upon hours over the past few weeks changing passwords, email addresses, Wi-Fi router information, and requesting new credit/debit/store cards. I still have more to do and expect this whole process to take a few more weeks as long as I stay focused. However, all my most critical accounts have been updated. Anything relating to email and financial accounts were the first to be updated. Then any utility accounts that I use for my home. Now working on the rest.

RonWeasley

@Testtinejsv

Why do you say that? It is encrypted.

Testtinejsv

Appears no

Marko3

well I've been with LP for 3 years now and I hope everything is ok... my old password was strong so just be safe I generated a new master that's very strong.. I did not have any information like credit cards and address etc etc so basically I'm only using LP just for a password manager just be careful if you get any emails claiming that there LP support or anything fishy ... if you wanna know if your email has been breached or password just check the link below ..I hope that the CEO or someone can take measure and let us know what going on with the truth ..I'm just reading and watching before I jump ship

https://haveibeenpwned.com/

RonWeasley

Former Member

1. As far as I know, only 1 breach where customer data was taken and that was copies of backups as of September 22nd. LastPass have not confirmed what exactly those backups comprised, i.e. were they snapshots of that day or backups with multiple copies going back days/weeks/months?

2. Yes, backups of ALL users were taken - free, premium, business, teams. families. Everyone and everything.

3. It wasn't a subset. As far as I know LP have not contacted anyone directly about this.

4. No. 2FA only protects login access to your online vault. The offline vault backups are only protected by your master password.

5. Very good question. Seems like LP have been "economical with the truth" about this being a zero-knowledge encrypted vault. Seems like it's not a vault at all, just a collection of fields, some encrypted and others not. A shocking revelation!

And in terms of LP telling people what they should do? Well they have given advice and whereas they perhaps exaggerate how safe your data is if you have a strong master password, the advice is probably still valid. i.e. if you do have a strong master password, you probably don't have much to worry about. However, if you do not, you should change all of your passwords. I think it's prudent to do that anyway, starting with your email account(s) - since they are the most damaging to be hacked - and then your financial accounts; then any shopping sites, especially with credit card data stored; and finally everything else. You can probably taken your time over this, i.e. do it progressively over the coming weeks. 25m+ "vaults" have been taken so you'd be pretty unlucky if the hackers started trying to hack yours first!

Personally, I think 1password is the best alternative. They are the only ones who have security baked in so that you're super-safe EVEN IF you have a weak password and EVEN IF they get hacked and your vault is stolen.

MEJ2

Friend, here's the 50,000 foot level / only answers you need:
1_ You can't mitigate the damage of what's already been leaked thats unencrypted. So stop worrying about it.

2_ The security of your encrypted data is unknown, because the hackers got Lastpass's source code as well

3_LastPass the company cannot be trusted. Staying with them is not an option, esp. given #2 above

Get yourself onto Bitwarden, pay the $10 for their premium service, change your passwords in descending order of their potential impact if hacked. Oh. and cancel your Lastpass subscription, then delete your LP vault.

unknown

Based on the recent security breaches at LastPass I have some questions that I am hoping I can get answers to on the community.

I have read through the recent blog and other internet articles and I did try to contact support via the call back option (I'm sure that there used to be an email option?) and was basically told what was in the blog post with a load of techno babble so I realised that I'm no clearer on the answers to my questions. I have already updated my LastPass Master password and taken steps to make sure my email accounts and some other accounts are secure and I plan to switch from LastPass as my password manager before it comes to renewing my subscription since I think they've handled this incident badly, but before I go any further I want to find out how concerned I should be and if I do need to change all of my passwords.

Just to note my previous Master Password was a strong password of around 17 characters with a mix of upper and lower case characters, numbers and symbols and I also have always had 2FA enabled on my account since joining LastPass.

Anyway here are the questions I have:

Has there been more than one data breach? I remember reading something earlier last year about a data breach at LastPass that told us nothing had been stolen so if the data was stolen in that breach why has it taken LastPass so long to inform us? And if there have been two breaches then how can we trust LastPass to keep our data secure when they have had two breaches within months of each other?
Does this affect all LastPass users? Were backups of every users vaults stolen or was it a subset of the LastPass users?
If it was just a subset of users have they been contacted to let them know that their data has been stolen (it would be good to know before I go any further in changing passwords if any of my data was actually stolen and I'm sure other LastPass customers feel the same)?
As mentioned above I have 2FA on my account so if the hackers did somehow manage to unencrypt the data would the 2FA prevent them from accessing the backups i.e. if they somehow crack my old password would that mean they have access or would they need authorising via 2FA as well? On the same note I'm assuming that updating my Master Password won't do anything to make the data stolen any more secure since it will be encrypted based on my old password?
Why is any of the data in the vault unencrypted? I was under the impression when I joined LastPass that all of the data in my vault would be encrypted and would only be visible to myself when I've logged on, but reading through various articles it sounds like some of the data such as URL's is not encrypted - is this the case? If so, what data will the hackers have access to without needed to unencrypt the backups?

And most importantly why is LastPass telling us that there is no need to worry rather than giving good advice on what actions should be taken in the event that the hackers do somehow manage to access the data that has been stolen?

Also, a general question on recommendations for a new Password Manager - I've heard 1Password is meant to be good and was reading in an article that recommended Bitwarden but was wondering if anyone had any other thoughts on this.

dcvr

No answer for what seems to be such a simple question?

Is the 'NOTES' section within a password encrypted OR NOT?

mark117

LastPass were hacked and the vaults stolen. Apparently they didn't encrypt the entire vault and the URLS were not encrypted.

So if you have anything in the URL that might reveal information then consider it leaked.

euglena4057

From the Lastpass Blog announcement on the breach: "fully-encrypted sensitive fields such as website usernames and passwords, secure notes...These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password."

Secure Notes, yes, those are a separate category, (as are Driver's Licenses, and SSNs).

But what about THE NOTES SECTION WITHIN A PASSWORD??? Is that or is that not a "secure field"? (And what about before 2018, as has been raised?) We really do not have an answer on that, in writing anywhere that I can find.

MEJ2

"totally safe"?

Any website you have accounts on, that would be problematic if your employer, spouse, friends knew about them? (Do you have an account on DonaldTrumpIn2020.com? Any conservative websites? Any porn sites?)

Because the hackers have that list, tied to your name, phone number, and IP address - right now, thanks to LPs carelessness in not encrypting URLs for your accounts.

MEJ2

Guys.

LP's lack of transparency here is disturbing and understandable. If they were 100% transparent about the reality here, it would be the equivalent of closing up shop. There's only 2 key pieces of information to consider:

1) The hackers have LPs source code.

2) The root cause of this incident was a lack of rigor in the LP developer stream

That means the hackers can examine this code line by line for vulnerabilities, and are probably furiously at work doing so right now. It also means that this code is unlikely to be robust enough to withstand that scrutiny, since careless people (their developers) tend to be careless and take shortcuts (ie, like putting undocumented backdoors in their code)

There's only a few sensible moves here (some may not be possible for everyonee)
1) Change every single password you have immediately on your accounts.

2) Close any unnecessary accounts at the source
3) Change your primary email address immediately

Most importantly, Ditch LP. Its just a matter of time til the hackers either get at your sensitive information, or trap you with a phishing attack (you have to be perfect, they only have to be lucky 1x)

DB_PhD

Thanks for the update but given how LastPass have handled these disclosures, it's hard to take their word for anything.

tamas1

This is something that was bugging me as well. I went ahead and reached out to LastPass via the call me back option, and they stated on the phone that everything except for the URL is encrypted (including the "Notes" field for a password).

Of course, I'd love to see this corroborated by LastPass somewhere in writing as well, but so far this feels reassuring.

IWHBYD

As of at least 2018, the notes section IS encrypted.

However, pre-2018 we have no data and it's likely backed up vaults over X period have also been stolen.

These in theory could contain more plain text data as we now know for sure "zero-knowledge security" was just marketing BS.

Marko3

what do you mean that only the URL not encrypted ?

StuckInTheCloud

Since customer LastPass vaults have been stolen, is the "Notes" field for website entries in LastPass encrypted or not? To be clear, I am referring not to "Secure Notes", but the "Notes" field for website password records.

The breach notification states that URLs are unencrypted, and the passwords and secure notes are encrypted, but is silent about the Notes field within a website entry? Can't LastPass just tell us all fields which were UNENCRYPTED from our vaults? We may have information in the Notes field which is also sensitive-ish, and need to know whether that has to be removed or changed.

vnat

Ok good news. I put in a ticket with LastPass and spoke to someone today who confirmed that the ONLY data that is not encrypted is the URL.

Everything else is encrypted (the notes box in the password windows, as well as saved addresses, credit cards, etc) and of course secure notes.

DB_PhD

I thought the entire vault was encrypted and I'm shocked that to learn that it isn't.

However, when I look into it, I find that it has been well know for many at least 6 years that LP don't encrypt the URL and that they keep ip addresses.

This data gets requested a lot in US search warrants and could be why they do it. LP never reveal username or password.

Article from 6 years back https://hackernoon.com/psa-lastpass-does-not-encrypt-everything-in-your-vault-8722d69b2032

Mark80296

This is a disaster. It had never occurred to me--not even a glimmer--that there was ANYTHING in my vault that would be unencrypted. How is this possible? URLs, for example, are HIGHLY confidential! Am I supposed to be OK with a hacker learning where I do my banking, just because my password is (we'll assume, for now) securely encrypted? And the uncertainty about note fields is pretty much terrifying. This is NOT acceptable.

yesitsme

Lastpass: listen carefully to this thread, and please provide a clear answer for the average joe like me

deisner

I too would very much like an answer to this question from LastPass, including current and historical practices.

Also, this is the first I'm hearing that not all of my vault data is encrypted with a key derived from my master password. Based on a straightforward reading of LastPass's description of their security architecture (https://www.lastpass.com/security/zero-knowledge-security), I concluded that "Encrypted Vault" meant my vault was encrypted. But, no, apparently some fields are, and some fields aren't.

This is misleading, and troubling. I use the "Notes:" field to save security questions and answers (for which I generate unique random strings ). Now I have to consider the possibility that these have been stored in plaintext (a "proprietary binary format" which is the same thing).

ChrisFerguson

So, I did do the test myself and (as others have said) the notes IS encrypted. If you look at the submitted data, this is indeed encrypted. The URL is simply hex. The "extra" field is fully encrypted.

SirWill

Yes I have 2FA but I'm not sure it makes a difference in this case. That is why I need more answers from LastPass.

ChrisFerguson

I've found this - LastPass Vault Format · cfbao/lastpass-vault-parser Wiki · GitHub

If this is correct, it seems the notes field is encrypted.

I would like this confirmed by Lastpass, however.

Goemon

Exactly my thought and I find it questionable, that in the blog post URLs are not considered sensitive.

If a URL turns up in the vault it means, that you have an account at the website and while websites like netflix.com or google.com don‘t say a lot about you, websites about a specific hobby, an illness, a political party or a sexual orientation do and I‘d prefer such information to be kept safe and private.

And in the end those information are now out there and in most cases associated with our real names, since for example I paid LP with my credit card. I trusted such sensitive information being in a secure vault (zero knowledge), but it turns out, that this „vault“ is covered with sticky notes…

My guess is, that LP is fully aware of the severity and what this means and it is likely no coincidence, that the blog post came now close to the holidays, their hope is probably, that this way this will have less coverage and most people forgot it when the holidays are over.

DB_PhD

I have the same question

Quoting the lastpass blog about the recent data breach https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

"The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords"

I was shaken to learn the URL field is not encrypted and I wonder which other fields are also not encrypted.
I personally have sensitive data in the notes field and I hope that it is encrypted.

borlorbao888

I need to know this also

Jack200

I've used LastPass for years and upgraded to the premium when that started. I have never had any problems, until updating to the premium. There have been many problems that have not been addressed. Now it's hacked.

It seems to me that the hacker already has all my passwords, even if they are, at this point, encrypted. If that's the case, even if I deleted my account, the hacker would still have the encrypted data. Is that right?

Management should answer this question honestly, rather than claiming the is no big deal. I am ready to switch to another password manager, if it's not too late.

Is it really true that the only way to assure I'm safe is to change ALL my passwords. That's over 150 passwords for me. Of course, then I would have to go to each site and change the password there, too. That would be extremely time consuming and should be unnecessary.

l0nEr

Curious did you have 2FA Enabled for those?

LookingForInfo

I have this same question. Now that it appears that personal data has been leaked, I believe we need to know exactly what fields of each area of the Application are encrypted.

The Notes Field Specifically of a Password would be a critical to know.

SG377

I have the same question. After reading this, I think the only safe way is to change every password I saved in Last Pass before the incident.

Disappointed. Not that much on the incident but more on the way they communicate. I have been their customer for many years. Sadly, I may not be able to trust them again.

Rastlore

I would feel more comfortable if I could change all my passwords and there used to be an easy way to change a bunch of passwords in LastPass, but I'm guessing it has been moved under Premium features.

Would it be possible to give us access to that feature for a month, or give people affected at least 1 month Premium features so we can change a passwords quickly to all our sites?

Baybuttke

So yeah, they did say that, and in August they said it wasnt an issue, and we were all good. I for one believed them, but for the past few months certain accounts of mine have been getting hit with random logins and some of them are accounts I've only used once. Last pass is the only one that has the password that Lastpass created. Last night someone logged into my 7 year old sons apple ID. Another account that Only last pass had saved and was rarely used. It's the PR guy's job to stop the bleeding and that what they are doing but you need to do what you need to do to ensure your security because the people who you paid to do it for you failed and waited 3 months to tell you otherwise.

LPFan22

I would guess that changing your password would not change anything. They have the hashed information encrypted with your master password. So if they can get through that, they get to the information. The only way to be totally safe would be to change every password in the vault.

I'm disappointed it took lastpass this long to tell us. That's why I'm not sure if I believe them when they say it would take years for someone to get through it.

I'm especially disappointed that customer service has gotten worse over the years. And I'm an original customer, so I've been paying $11 a year but we're notified that next year I have to pay the regular price. And I'm not happy to increase my price, when I know my stuff has been hacked.

vnat

I'm not asking about "Secure Notes", I'm referring to the notes area in a password entry (under the url/username/password area)

Is this part encrypted?

I'm confused by the statement here that seems to be saying that our ENTIRE vault is NOT encrypted and that only parts of it are:

https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

"The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data."

SirWill

They mentioned if you have a good strong password you should be OK.

My question is if we change our master password now will we be protected, or will they forever be able to get into the vault if they brute force their way in?

I'd like to put in a much stronger master password than I have now.

In the blog post today they never say anything about changing our master password which makes me think changing it won't happy. And if we have a weak password we are in jeopardy of our vaults being hacked.

Also does 2FA prevent them from accessing vault even if they brute force the password? I never thought I needed a super strong password there if I have 2FA on it.

What about rollback the password, would it then be advised to turn off roll back master password if I do change it to a super strong one and that protects it.

I know questions questions questions.

ChrisS1

Thanks ridiculousx.

Whilst I don't doubt that's what they said, why have they worded their latest update thus:-

"...that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields"

Why say "such as" when they are telling you " only" ??

Any chance you could clarify this with them (I can't seem to work out how to log a call but will have another go).

ChrisS1

I've just read the latest update on the incident and it differentiates between unencrypted fields such as URLs and encrypted fields - specifically mentioning secure notes. I suspect that this means the notes under normal entries are not encrypted and therefore should be considered hacked. Elsewhere in their blurb it says the whole vault is encrypted, but I suspect they will argue that these unencrypted fields are "not part of the vault". Why are they are not is making me angry just thinking about it.

I exported all my data and then ordered by notes field to see what was in there. I then went through all the entries with sensitive notes and reset things.

I suspect that LastPass don't want to answer my question as it would be too embarrassing (although for the sake of their customers they really should as this will surely come to bite many of them).

ridiculousx

Update: I received a call from support, and they notified me that, "The URL field was the only one unencrypted. All other fields, notes, password, folder, attachments are encrypted."

ridiculousx

Has anyone been able to get a clear answer on this?

The "Notes" section under a password being unencrypted could be putting many people at risk.

Lastpass: Is the "Notes" section within a "Password" entry unencrypted or encrypted?

Thank you.

Steviemac1

Anybody?

No one seems able to reply to the serious question here about the security breach. There doesn't seem to be an FAQ to, cover the point. There isn't a way to post a reply to the blog. The support for Lastpass on Twitter is ignoring the question and so far not replying neither.

I'm trying to decide if it's incredibly poor service, people not being allowed to respond to questions about the breach so the information released is carefully controlled, or perhaps no-one wants or is allowed to share a true answer as it might cause customer panic if the answer isn't favourable. If there wasn't a concern for customers I’d have thought LastPass would be swift to reassure and kill the concern, not feed it by ignoring the question.

Steviemac1

I don't know if tagging someone in here works and notifies them or not. Let's see...

@GlennD Do you know how I can get an answer to my question above. I’d have thought reassurance would be a priority in handling the breach issue. Or advice re the underlying issue so I can take more steps to protect.

MtSergio

I contacted my Account Manager and she stop answering my emails.

Steviemac1

That feels like plenty of time for someone from Last Pass to have responded. They do seem to look in here. It doesn’t feel like an answer anyone else in the community can provide.

How do I find out more?

Steviemac1

Hi,

In the blog re the hacking it says:

“We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted.”

The part in red raises a question for me. I have used the Notes section to record Passport information and National Insurance number. Is that safely encrypted or could that have been accessed and obtained by the hacker?

ChrisS1

I'm trying to log a call to get an answer, but the call logging on their website just errors.

midsts

How can we get a definitive answer to this question? I have recovery information stored in this notes field and other important information.

Esocs

I assume obnly password fields are with zero-knowledge encrypted ...

ChrisS1

Many sites have multiple items required to login, for instance an initial password then a longer authentication code from which you have to input certain characters. Plus I use a variety of answers to questions like "first pet" for different sites. I store all these in notes in a password entry in Lastpass (NOT in secure notes as I want to keep all items together for a site and secure notes will not auto-fill).

Are these "password notes" encrypted?

I'm concerned as someone may have accessed these during the latest security breach at LastPass.

Quick Links

Join the conversation!

If you found this discussion useful, why not register/sign-in? It only takes a minute to share your feedback, ask a question, or vote for a new feature!