In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious…

  • Zeron@lemmy.world
    link
    fedilink
    English
    arrow-up
    14
    ·
    1 year ago

    And this is why you don’t want cloud based password storage systems. If you want to use a password manager, use something entirely local like KeePassXC. The database it creates is so small you could fit it on a floppy so it’s immensely portable.

    • SkyeStarfall
      link
      fedilink
      English
      arrow-up
      26
      ·
      1 year ago

      Cloud based systems can be perfectly sound. You can read how other managers do it, which are also audited by security experts. It’s just LastPass being bad.

      And sure, local can be more secure, but you’re then at higher risk of losing access to it, should the worst happen.

      • GigglyBobble@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        They are a real treasure trove though. Those crypto token thefts show there’s much money in that. I wouldn’t bet my most sensitive data they covered every single attack vector - external or internal. You managing your password locally may be much less secure but it’s also much less likely you’re directly targeted.

        • MaxHardwood@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          The accounts they’re breaking the encryption on were never configured properly. These are old accounts from when LastPass had weak defaults and neither the user or LastPass updated those settings on old accounts. Those settings have always existed though and could have been improved by the user.

    • ExcessiveAardvark@lemmy.world
      link
      fedilink
      English
      arrow-up
      15
      ·
      1 year ago

      The problem is more that LastPass’ system is bad. 1password (and probably others) mitigate a possible hack by having the keyring encrypted by something in addition to the password.