Hi, having just read the full extent of the two data breaches, I'm slowly going through and updating 320 passwords which are a mix of both personal and work passwords. Not to mention the secure notes, passport info, driving license information, social security numbers and credit card information.
Having just written the last sentence I feel I have placed too much confidence in the security of LastPass. Now you can talk all you want about AES256 encryption, of zero knowledge data architectures and the low probability of someone reverse-engineering my master password. But, at the end of the day I'm left with updating all passwords in my vault, creating a new master password and a keeping my fingers crossed that my master password was strong enough to prevent anyone gaining access to my driving license information and social security information and other secure notes.
So what's LastPass doing about this - I don't recall reading anything other than telling us not to worry.
If on average it takes around 5 minutes per account to change the password, and verify that the updated password has been saved correctly, that's 26 hours of time that I'm going to lose and not be compensted for. The annoying. part is that my auto-renewal was taken on Dec22nd. I had I read the blog post I would be spending the 26 hours emptying my vault and moving to another password manager, who implements stricter security measures for their developers.
At a minimum I feel that LastPass should be at a minimum provide one years free subscription charges or refunding all subscriptions that were paid after the breach was discovered, not to mention five years of free credit monitoring.
I'd love to hear how others are feeling as more news is released on the breach and just how far and wide it went - at least from those users who are staying with LastPass and not jumping to an alternate provider.
