A breach at LastPass has password lessons for all of us

While many of us disconnected from the Internet to spend time with loved ones over the holidays, LastPass, the creator of a popular security program for managing digital passwords, delivered the most unwanted gift. . He published details of a recent security breach in which cybercriminals obtained copies of customers’ password vaults, potentially exposing millions of people’s online information.

From a hacker’s perspective, this is equivalent to hitting the jackpot.

When you use a password manager like LastPass or 1Password, it stores a list of all usernames and passwords for the sites and apps you use, including bank accounts, healthcare accounts, messaging and social networks. It keeps track of this list, called a vault, in its online cloud so you have easy access to your passwords from any device. LastPass said the hackers stole copies of each customer’s list of usernames and passwords from the company’s servers.

This breach was one of the worst things that could happen to a security product designed to take care of your passwords. But aside from the obvious next step – changing all of your passwords if you’ve used LastPass – there are some important lessons we can learn from this debacle, including that security products aren’t foolproof, especially when they store our sensitive data in the cloud.

First, it’s important to understand what happened: the company said intruders gained access to its cloud database and obtained a copy of the data vaults of tens of millions of customers in using credentials and keys stolen from a LastPass employee.

LastPass, which published details of the breach in a blog post on Dec. 22, tried to reassure its users that their information was likely safe. He said some parts of people’s safes — like the web addresses of sites they logged into — weren’t encrypted, but sensitive data, including usernames and passwords, were encrypted. This would suggest that hackers might know the banking website someone is using, but not have the username and password required to log into that person’s account.

More importantly, the master passwords that users have set up to unlock their LastPass vaults have also been encrypted. This means hackers would then have to crack the encrypted master passwords to get the rest of the passwords in each vault, which would be hard to do as long as people used a unique and complex master password.

Karim Toubba, chief executive of LastPass, declined to be interviewed, but wrote in an emailed statement that the incident demonstrated the strength of the company’s system architecture, which he said kept the sensitive vault data encrypted and secure. He also said it was the users’ responsibility to “practice good password hygiene.”

Many security experts disagreed with Mr. Toubba’s optimistic spin and said that every LastPass user should change all their passwords.

“It’s very serious,” said Sinan Eren, an executive at Barracuda, a security company. “I consider all of these managed passwords to be compromised.”

Casey Ellis, chief technology officer of security firm Bugcrowd, said it was significant that intruders had access to address lists of websites people were using.

“Let’s say I come after you,” Mr. Ellis said. “I can view all of the websites for which you have recorded information and use it to plan an attack. Every LastPass user now has that data in the hands of an adversary.

Here are the lessons we can all learn from this breach to stay safe online.

Prevention is better than treatment.

The LastPass breach reminds us that it’s easier to put protections in place for our most sensitive accounts before a breach occurs than to try to protect ourselves afterwards. Here are some best practices we should all follow for our passwords; any LastPass user who had taken these steps in advance would have been relatively safe during this recent breach.

• Create a complex and unique password for each account. A strong password should be long and difficult for someone to guess. For example, take these sentences: “My name is Inigo Montoya. You killed my father. Prepare to die.” And convert them to this, using initials for each word and an exclamation point for the I’s: “Mn!! m.Ykmf.Ptd.”

  For those using a password manager, this rule of thumb is of paramount importance for the master password to unlock your vault. Never reuse this password for another application or another site.

• For your most sensitive accounts, add a additional layer of security with two-factor authentication. This setting consists of generating a temporary code that must be entered in addition to your username and password before you can log in to your accounts.

  Most banking sites allow you to set up your mobile phone number or email address to receive a message containing a temporary code to log in. Some apps, like Twitter and Instagram, let you use so-called authenticator apps like Google Authenticator and Authy to generate temporary codes. .

But remember, it’s not your fault.

Let’s get one thing clear: every time a company’s servers are hacked and customer data is stolen, it’s the company’s fault for not protecting you.

LastPass’s public response to the incident puts the blame on the user, but we don’t have to accept it. While it’s true that practicing “good password hygiene” would have helped keep an account more secure in the event of a breach, that doesn’t absolve the company of liability.

There are risks for the cloud.

While the LastPass breach may seem overwhelming, password managers in general are a useful tool because they make it easier to generate and store complex and unique passwords for our many internet accounts.

Internet security often involves weighing convenience against risk. Bugcrowd’s Mr Ellis said the challenge with password security was that whenever best practices were too complicated, people defaulted to what was easier – for example, using passwords easily guessable and by repeating them on the sites.

So don’t rule out password managers. But remember, the LastPass breach demonstrates that you’re still taking a risk when you have a company store your sensitive data in their cloud, as convenient as having your password vault accessible on the go. any of your devices.

Barracuda’s Eren recommends skipping password managers that store the database on their cloud and choosing one that stores your password vault on your own devices, like KeePass.

Have an exit strategy.

This brings us to my final piece of advice, which can be applied to any online service: always have a plan to extract your data – in this case, your password vault – in case something happens. that would make you want to leave.

For LastPass, the company lists the steps on its website for exporting a copy of your vault to a spreadsheet. Then you can import this list of passwords into another password manager. Or you can keep the spreadsheet file for yourself, stored somewhere safe and convenient for you.

I take a hybrid approach. I use a password manager that does not store my data in its cloud. Instead, I keep my own copy of my vault on my computer and in a cloud drive that I control myself. You can do this using a cloud service such as iCloud or Dropbox. These methods aren’t foolproof either, but they are less likely than a company’s database to be targeted by hackers.