Password managers can be a smart way to keep a track of the codes you’ve assigned to various websites — until they get hacked. In what is a serious breach of privacy, one of the popular managers, LastPass, has fallen victim to hackers. The company “discovered and blocked suspicious activity” last week on Friday, and has requested users to change their passwords.
LastPass however claims that no passwords were compromised in the attacks. That however doesn’t mean nothing was taken. It says,
In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.
The company claims that it’s not easy for hackers to crack the encrypted passwords, unless they have the user’s master password. “We are confident that our encryption measures are sufficient to protect the vast majority of users,” LastPass CEO and co-founder Joe Siegrist wrote in the blog post.
It requests every user to change and set a stronger master password just in case. As a further measure of security, LastPass has also asked users to set up two-factor authentication.
LastPass’ blog post warning of the breach follows.
We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.
We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.
Nonetheless, we are taking additional measures to ensure that your data remains secure. We are requiring that all users who are logging in from a new device or IP address first verify their account by email, unless you have multifactor authentication enabled. As an added precaution, we will also be prompting users to update their master password.
An email is also being sent to all users regarding this security incident. We will also be prompting all users to change their master passwords. You do not need to update your master password until you see our prompt. However, if you have reused your master password on any other website, you should replace the passwords on those other websites.
Because encrypted user data was not taken, you do not need to change your passwords on sites stored in your LastPass vault. As always, we also recommend enabling multifactor authentication for added protection for your LastPass account.
Security and privacy are our top concerns here at LastPass. Over the years, we have been and continue to be dedicated to transparency and proactive measures to protect our users. In addition to the above steps, we’re working with the authorities and security forensic experts.
We apologize for the extra steps of verifying your account and updating your master password, but ultimately believe this will provide you better protection. Thank you for your understanding and support.
Joe Siegrist & the LastPass Team