Is it safe to use LastPass Password Manager?

LastPass has been in the news a lot lately. Whether you’re already a LastPass user or considering a subscription, you’re probably wondering if it’s safe to use after recent hacks.

The short answer is no, but that’s only partly because of the 2022 hacks.

As a password manager that holds all of your logins – perhaps including usernames and passwords for online banking and other critical services – it has to be completely reliable.

While we’re wary of any online or cloud-based service claiming to be 100% secure and hacker-proof, that’s really not a good look if you’re managing the passwords of millions of users and suffer repeated violations.

In the past, we’ve given LastPass the benefit of the doubt on numerous occasions. It was hacked in 2015 when users’ email addresses and password reminders were accessed.

Then, in 2017, a vulnerability was discovered in its browser extension that could have been used to steal your passwords. This has been fixed, but a similar thing happened in 2019 where the last used password was vulnerable.

Then, in August 2022, LastPass posted on its blog that a machine used for development had been compromised but there was no evidence that customer data or passwords had been accessed.

LastPass said no action was required because the master password and encrypted vaults (containing logins and passwords) remained safe.

Unfortunately, that turned out to be too optimistic: a few months later, hackers used the information they had obtained in August to hack LastPass again, this time gaining access to email addresses, phone numbers, and IP addresses. users.

They did this by scamming a LastPass employee and managing to obtain the information needed to access cloud storage that LastPass uses to hold customer data and password vaults.

Passwords, usernames, and all notes in these vaults are, of course, encrypted, but not all data is: LastPass has confirmed that they also contain unencrypted website URLs.

Hackers would need to guess your master password to crack the information in these safes, but since they can use software to speed up this process, it’s only a matter of time before they do. to crack some of them, especially if you used a weaker password. with less than 12 characters – something that is possible if you haven’t changed it since before 2018.

I am a LastPass user. What should I do?

If you’re using a strong password, you should be okay – says LastPass – because generally available software would take “millions of years” to crack it.

“Due to the hashing and encryption methods we use to protect our customers, it would be extremely difficult to attempt to brute force master passwords for customers who follow our password best practices. We are testing regularly the latest password cracking technologies against our algorithms to track and improve our cryptographic controls.

The threat actor may also target customers with phishing, credential stuffing, or other brute force attacks against online accounts associated with your LastPass Vault. To help protect against social engineering or phishing attacks, it’s important to know that LastPass will never call, email, or text you asking you to click on a link to verify your information. personal. Except when logging into your vault from a LastPass client, LastPass will never prompt you for your master password.

The problem is that if hackers already have a copy of your vault, which is encrypted with your old password, then change your LastPass master password now won’t make any difference as it will only change the encryption of the version stored by LastPass, not the copy the bad guys have.

This means that your only option is to change passwords for accounts in the vault so that if hackers manage to crack your vault, the passwords they obtain will no longer work.

It’s very complicated and time-consuming to change hundreds (or even dozens) of passwords, but it’s obviously worth doing for any bank or other account related to your finances to mitigate the risk. . This includes accounts from all online shopping sites that store your payment information, such as Amazon, and don’t forget PayPal and others.

Should I still use LastPass?

No. It is simply impossible to recommend that you continue to use it. The story of breaches and vulnerabilities was bad enough, but the fact that the bad guys have now managed to get their hands on encrypted password vaults is the straw that broke the camel’s back.

There’s also the fact that the LastPass code is “closed source.” Unlike open source software, this means no one outside of LastPass can inspect the code it uses for vulnerabilities. There are open source password managers, including Bitwarden and KeePass.

We’ve already said that you should change all important financial account passwords, but you should find another password manager and migrate your passwords to it.

Most password managers work like LastPass and store your password vault in the cloud. They do this to make it easier to sync these connections between all your devices, but some offer a “self-hosted” option where you can store your vault locally on your device. It’s better from a security perspective, but it tends to mean that it’s not as easy to sync new logins and password changes across all the devices you use.

But security and convenience rarely go hand in hand, so it really depends on how much you want to keep your passwords safe whether or not you trust a cloud-based password manager.

Related stories