Info Second LastPass data breach in 2022 (security incident)

[SynoMan]

Another security incident occurred at LastPass. The first happened in August and the second three months later.

We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.

Read more in a blog post from Karim Toubba, LastPass CEO.

Notice of Recent Security Incident - The LastPass Blog

We are working diligently to understand the scope of the incident and identify what specific information has been accessed.

blog.lastpass.com

Don't forget, you can self-host Bitwarden in Docker on your NAS:

Docker - BitWarden - self hosted password manager using vaultwarden/server image

UPDATE (30/04/2021) Changed the article to reflect on using the new vaultwarden/server image UPDATE (03/12/2019): Added SMTP parameters UPDATE (10/08/2019): Added steps for activating LiveSync item feature UPDATE (28/05/2019): Edited name...

www.synoforum.com

 

[Telos]

Don't forget, you can self-host Bitwarden in Docker on your NAS

... and another reason to avoid C2 Password!

 

[ed.j]

I would suspect that Lastpass have better security measures, and redundancy in place, than your average Syno user.......

 

[RogerA]

Can BitWarden be used/accessed outside my LAN through QuickConnect?

 

[Telos]

Can BitWarden be used/accessed outside my LAN through QuickConnect?

As QC routes through Synology servers, I would not risk exposing my "secrets" in such a away.

 

[Schewa]

Can BitWarden be used/accessed outside my LAN through QuickConnect?

Maybe it might be an option to use wireguard?
Not sure, just want to trigger a conversation and maybe show another option, since I am still learning on that matter.

Best Regards,
Schewa

 

[Rusty]

Maybe it might be an option to use wireguard?
Not sure, just want to trigger a conversation and maybe show another option, since I am still learning on that matter.

Best Regards,
Schewa

you can but the BW address still need to be covered with https protocol and a valid tls cert

 

[SynoMan]

Update as of Thursday, December 22, 2022

Notice of Recent Security Incident - The LastPass Blog

We are working diligently to understand the scope of the incident and identify what specific information has been accessed.

blog.lastpass.com

 

[leriak]

Update as of Thursday, December 22, 2022

Well, they obtained encrypted vaults... that's as deep as they can get to.

I don't know what value can LastPass offer anymore...

 

[leriak]

A couple of thoughts in case someone may relate

From the blog post:

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data

I had a LastPass account until 2 years ago when I bought the synology nas and spun up a vaultwarden instance.

At that time I exported my passwords, deleted them from the LastPass vault and then deleted the LastPass account.

But they (baddies) managed to obtain encrypted vaults from a BACKUP... was my data there?

I don't know, and no longer having an account I doubt LastPass would notify me... If they did it would mean they clearly did not delete the account (or at least part of it). At this point I don't think I trust anything they say or don't say...

So, since I keep a copy of the export of the vault at the time, I will have to review and change all those passwords I deem important.

My second thought is about a post I initiated some time ago here:

TOTP keys in Bitwarden

I've been using bitwarden for a while now (maybe a year?) and I just recently realized that it can store TOTP keys for 2 factor authentication. Just curious, does anyone use this functionality? IMO it doesn't seem very good practice to put passwords and the means to obtain 2FA codes on the...

www.synoforum.com

I don't know if LastPass offers to store TOTP secrets like Bitwarden, but if they do and someone happens to have them stored there, then 2FA will be of no use if they crack the stolen vault...

 

[RonV42]

I am so glad I moved away from LastPass two years ago after they stated that they had a breech. I originally went with Bitwarden in the cloud then moved to a local instance.

 

[Telos]

Death Knell for LastPass? Hackers stole customers’ password vaults

The cache of customer password vaults is stored in a “proprietary binary format” that contains both unencrypted and encrypted vault data, but technical and security details of this proprietary format weren’t specified. Read on... Odd though that TechCrunch says... The good news is that any...

www.synoforum.com