Can I still use LastPass safely?
Hi, everyone. Leo Notenboom here for
Askleo.com.
If you've got questions about security or just using your PC more effectively,
subscribe to my weekly newsletter, Confident Computing.
Askleo.com/newsletter for all the details.
Here's the question that I got just recently.
I understand your rationale regarding the use of LastPass,
but I am an unsophisticated user with minimal exposure to external threats.
I adopted LastPass after watching your review and I am pleased with the program.
Is it advisable to continue with LastPass
with perhaps a more dedicated commitment to care and caution?
So I honestly cannot say that it's advisable.
However, it's also not unusual in that you are absolutely not alone.
I think a lot of people are asking exactly this question, specifically because
switching password vaults feels like a daunting task.
It seems like it's a fair amount of work.
And while it doesn't have to be horrible,
it is yet another thing to do and another tool to learn how to use properly.
So I want to address a couple of different
issues and actually give you some guidance that may allow you to use LastPass.
I won't say safely, but I will say less unsafely.
So the one thing I do want to jump
on right away, of course, is this phrase, Minimal Exposure to external threats.
That's just flat out wrong.
If you are online, you are exposed.
All of the accounts, all of the anythings that you do online, they are after you.
Now, I've got an article that talks about
this, why you, yes, you are the target of hackers.
The pushback that I get is that a lot of people are saying, Well,
I don't do much online, or I don't have much online,
or I don't have anything in my bank account that they'd be interested in.
Hackers don't know any of that until after they've compromised your account.
And even after they've compromised your
account and find your bank account to already be empty,
they can still use the information that they've hacked into and retrieved
to do things like perform identity theft or just generally cause trouble.
So please do not minimize your exposure.
We are all exposed constantly.
Now, there is one thing specifically about
LastPass that I want you to check before you go any further.
There's what I call an obscure setting in LastPass called password iterations.
It controls the quality of the encryption being used by LastPass in several places.
The issue is that when LastPass originally was created, it set it to a number.
I'm not even sure what the number is.
But at some point,
they changed the default to increase the security of their
encryption because, let's face it, hardware has been getting better.
So they changed it, but they did not force a change to existing users.
What that means is that if you've had your LastPass account for a while,
it's very possible that this number is lower than it really should be.
Now,
if you go to your LastPass account online and look in the Advanced Settings,
you will see a setting there called password iterations.
Take a look at the number.
The number that you want is 600,000 or greater.
That is a number that will not only secure
what you have, but it will protect you for the foreseeable future.
Now, if you had to change the number,
if the number was already less than 600,000, then you're good.
You might consider changing your master
password, but we'll talk about that in a second.
If the number was already 600,000, I would recommend
you change it to something a little bit larger like 600,000 and one.
The reason is changing this number forces LastPass to reencrypt your vault.
That means that whatever gets stolen in the future is more properly secured.
Your encryption is as tight as it can be.
As it turns out, my understanding is that just changing
the master password does not actually reencrypt your entire vault.
There are very valid reasons for that.
But the bottom line that we need to understand right now here is that if we
want to actually cause LastPass to reencrypt the entire vault,
what we need to do is come in here and change this number.
Now, I hear a lot of advice saying, Okay, change your master password.
My recommendation is sure, why not?
It's really not that bad a thing to do.
You'll notice that I'm not harping on it.
Personally, I don't think it actually matters as much as the underlying
encryption that we've just been playing with.
However, change your master password.
Particularly if you just changed
that number, now is a good time to change your master password to ensure that it too
is properly encrypted in the LastPass vault.
Now we get to the painful part.
Everything we've done so far is specifically about LastPass itself
and honestly applies only if you're staying with LastPass.
What follows?
Honestly, it applies whether you're staying with LastPass or not.
First,
change the passwords for any of the important accounts you have
that were in your vault at the time of the breach.
That means things like your bank, any financial institutions,
the email address that you use as the recovery email for any other accounts
that may or may not be important or even moderately important.
Yep, this is the painful part because it really is a manual process.
You have to go visit those accounts and explicitly change the passwords
at those accounts and then make sure that LastPass is updated or whatever vault
you're using now is updated with the new password.
The issue is that the theft, the breach stole encrypted vault information.
In theory, that encrypted vault information should
not be able to be unencrypted by the hackers.
But regardless, it contains your old password.
So by changing your password to these
important accounts, it reduces the impact of the possibility
of a hacker someday unencrypting the vault that they stole from LastPass.
Now, add two factor authentication, please.
Even if you don't change your passwords, two factor authentication on all of these
important accounts, and that includes LastPass, by the way,
makes it so that even if the hackers know your password,
they still can't get in because they don't have the second factor.
Two factor authentication isn't as much of a burden as you might think.
You do it once on a machine in a browser, and then on that machine
and in that browser, you don't have to do it again until you
clear cookies or switch browsers or get a new machine or something like that.
The bottom line here is that it is really
simple and easy to do, and it is the number one recommended
technique to further secure your accounts from things like password vault theft.
As always, watch for account activity.
So let's say that you haven't changed your password and you're not going to add two
factor authentication because, well, grump.
Watch the account activities.
Make sure that there's nothing unexpected going on.
It's particularly true for your financial accounts, of course, but honestly,
it applies to all of them that may be included in that breach.
If you see unexpected activity, investigate it right away.
Challenge charges, change passwords,
do whatever is appropriate for the situation you find yourself in,
but make sure you're keeping an eye out for that unexpected activity.
The other thing that actually made it out
in the last past theft was that the hackers now know things like your
usernames and the sites that you happen to have stored.
They don't know your passwords, not unless they happen to break
the encryption, which to best of my knowledge, isn't happening.
But they will know that you have
an account at this service or that bank or who knows where.
This will allow them to create highly targeted phishing attacks.
They will be able to craft an email to you
that looks like it comes from, say, your bank and will include
information like your name that normal phishing attacks don't have.
Be very, very careful and make sure to avoid phishing attacks.
Again, this is something that you probably want to do, regardless of whether or not
you stay with LastPass, because that information is out there.
But either way,
this is perhaps one of the most important, and I'll call it the most pragmatic
results of the LastPass breach, is that phishing attempts will probably
become more targeted and potentially more successful in the future.
So the bottom line here is that you can continue to use LastPass.
I still recommend switching to a different password manager.
Lastpass has lost my trust for a variety of reasons, and you can read about
that in the other articles I've written about the topic.
But if you feel the need to
stay with LastPass, if it's just not worth it to you to switch to a different
password manager, then, well, I've given you a couple
of tips that are specific for LastPass to increase your security there.
And then everything else applies whether you switch or not.
You need to be careful,
you need to keep an eye out, you need to watch for phishing attempts and so forth.
But hopefully that gives you an idea of the situation that you're in.
Like I said, my bottom line recommendation
is to switch, but if you can't, I totally, totally understand.
For comments, for updates, and for links related to this article, visit
askleo.com/156488.
I'm Leo Notenboom and this is
Askleo.com. Thanks for watching.