{"id":387091,"date":"2021-12-28T19:53:41","date_gmt":"2021-12-28T16:53:41","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/lastpass-says-it-didnt-leak-your-master-password\/"},"modified":"2021-12-28T19:53:41","modified_gmt":"2021-12-28T16:53:41","slug":"lastpass-says-it-didnt-leak-your-master-password","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/lastpass-says-it-didnt-leak-your-master-password\/","title":{"rendered":"#LastPass Says It Didn\u2019t Leak Your Master Password"},"content":{"rendered":"

“#LastPass Says It Didn\u2019t Leak Your Master Password”<\/strong><\/p>\n

\n
\"LastPass
II.studio\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n

Several LastPass users claim that they\u2019re receiving emails from the company about unauthorized login attempts using their master passwords. Fortunately, LastPass has responded to the issue, and the password manager says it hasn\u2019t leaked any user information.<\/p>\n

Reports originated from Hacker News<\/a>, where a user said, \u201cLastPass blocked a login attempt from Brazil (it wasn\u2019t me). According to an email I received from LastPass, this login was using the LastPass account\u2019s master password. The email doesn\u2019t look like it\u2019s a phishing attempt.\u201d<\/p>\n

This led to speculation that LastPass may have somehow leaked master passwords, as these emails only arrive if the unauthorized person logs in with the correct password. However, this seemed unlikely, as LastPass makes it clear that it doesn\u2019t store master passwords on its servers<\/a> and that everything is done locally.<\/p>\n

We reached out to LastPass for comment, and a spokesperson confirmed our suspicions:<\/p>\n

LastPass investigated recent reports of blocked login attempts and determined the activity is related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services. It\u2019s important to note that we do not have any indication that accounts were successfully accessed or that the LastPass service was otherwise compromised by an unauthorized party.<\/strong> We regularly monitor for this type of activity and will continue to take steps designed to ensure that LastPass, its users, and their data remain protected and secure.<\/p>\n<\/blockquote>\n

It seems LastPass did exactly what it\u2019s supposed to do in this situation by blocking a login attempt that seemed suspicious.<\/p>\n

It sounds like the users who had their passwords stolen could have been the victim of a keylogger or other third-party form of attack. Their information could have also been leaked in an unrelated attack where they\u2019re using the same email address and password.<\/p>\n

Either way, if you\u2019re a LastPass user (or user of any sensitive tool like a password manager), it\u2019s a good idea to enable two-factor authentication\u00a0to make sure you\u2019re safe from anyone gaining unauthorized access to your account. It\u2019s also never a bad idea to change your password if you\u2019re worried it may be compromised for any reason.<\/p>\n

RELATED:<\/strong> What Is Two-Factor Authentication, and Why Do I Need It?<\/em><\/strong><\/p>\n<\/div>\n