If I leave a service like LastPass, does my data stay online?
Hi, everyone. Leo Notenboom here for
Askleo.com.
I am reluctant to do yet another LastPass related article.
In a lot of ways, I feel that the whole
LastPass issue has pretty much been beaten to death.
However, I'm still coming across questions and situations that basically highlight
the fact that there are still lessons to be learned,
not specifically with LastPass, but with every online service you use.
Remember, when you use an online service, again, whatever it might be,
LastPass in this case, you've placed some amount of data online
and you are trusting that service to handle your data properly.
Now, as we saw with LastPass, that might not have been completely the case.
To be clear, there's still zero reports of an actual password being exposed
because of the LastPass breach, but there was a breach
and other information was exposed that probably should not have been.
So one of the things that a lot of folks,
including myself, have either been recommending or actually
doing is leaving LastPass and switching to other solutions.
In my case, I've personally switched over to 1Password.
Other folks have switched over to Bitwarden.
But again, this is much more than about just password managers.
This is about any service you use online.
The most important take away, I think,
is that it is not enough to set up shop somewhere else.
Yes, I moved from LastPass to 1Password. What did that mean?
It means that I've been rebuilding my password database in 1Password.
But my data, if I do nothing, is still over in LastPass.
So there are a couple of approaches
that you might consider when you're doing this.
One, and a lot of people are doing this, close the account.
Once you've got everything migrated to whatever other service you're using,
close the original account that you no longer need to have access to.
Or in the case of something like LastPass,
you can delete individual entries so that those individual entries are no
longer part of the current LastPass database.
And again, same is true for any service that you might use.
Here's the problem.
It might be too late.
Remember that after a breach, no matter what you do at that service,
stay, leave, modify, complain, whatever, the data has already been stolen.
It's already been copied.
It's already in the hands of the hackers.
And there is nothing you or I or even the service can do to claw it back.
That implies that your information is out there.
It's too late.
What does that mean?
Well, what it means you need to do is either of, honestly, two things.
Secure what's been stolen is one approach.
That is the scenario I recommend,
for example, if your bank account was in LastPass.
Again, there's no data that says any password has actually been exposed.
Nonetheless, for important accounts, securing your data means going
in and changing those passwords, maybe adding two factor authentication.
In other words, doing something that ultimately
invalidates the information that the hackers have.
Now, they may have your name and your
email address and your social security number, whatever.
That's the stuff you can't change.
But the key to your kingdom is your password.
And whether or not they have it, they have it hashed.
They may not be able to crack it.
But nonetheless, that's something you can
change and something you probably should change.
The other scenario is to do nothing.
You may elect not to change your passwords.
You may elect to change only some of your passwords and leave the rest alone.
Honestly, it's what I've been doing.
When I learned of the breach,
I went through and I changed my banking, my finance, my other passwords related
to basically everything important, including my primary email account,
because that's where all the password recovery stuff would go.
But there's a ton of other accounts.
I had 600 entries in LastPass.
There's a ton of other accounts for which
I'm not going to take the time to change every single password because ultimately
they're not really that important and they're already pretty darn secure.
By that I mean, for those accounts, I already have long, strong passwords.
And again, passwords were not exposed in the last pass breach.
Changing them for your important accounts is a belt and suspenders thing.
It's an extra layer of safety.
But for the unimportant accounts, you may not really be at risk.
Let's say that everything is okay.
There's been no hack.
Let's say you're using a service that hasn't been hacked.
Everything is operating the way it should,
and yet there is still stuff that's out of your control.
Let's say for whatever reason you elect to use a service, you use it for a while,
you upload a bunch of information to that service, and then you decide you're done.
You want to leave that service.
Well, you either close your account or you delete your data.
To be safe, I would recommend deleting your data and then closing your account.
But that's still not enough. Why?
Because if those services have been doing things properly,
they've been backing up your data and deleting your data,
what you have access to, does not remove it from their backups.
What that means is that while the service
certainly isn't going to pull their backups for you if you were to come back
to them, they may be required to pull
the information out of their backups in response to, say, law enforcement.
That could be a problem for some people.
It's not for me, I don't care. But for some people,
if you're doing something sensitive like that, then yeah, you need to understand
that even removing your data from these services may not be enough.
That's a solution where you probably want
to have it uploaded, encrypted in the first place.
But if you haven't done that,
if your data has been uploaded unencrypted, then you can be certain
that it's in a backup somewhere that is not encrypted.
How long do they keep the backups?
We don't know.
They're not saying.
And it differs from one company to the next, from one service to the next.
So be aware that that is what's going on.
All of this may sound like I'm making this
horrible argument that you should never put any of your information online.
That is absolutely not the case.
Online services are wonderful.
I use so many.
I do use 1Password.
I've got my passwords online for the convenience, for the usability.
I feel perfectly secure because I've set
it up securely because I trust this particular organization.
The fact is, stuff happens.
One of the things we need to be aware of when stuff happens is what is
the exposure, what's really happening, and what should we do about it?
In general, reputable services, they're doing things right.
They're not getting hacked.
They're not exposing your data.
Even the engineer in the data center
who theoretically could access your data, he's got better things to do.
And most of us, I would hope, are not of interest to our local governments.
So they're not coming to these services
with search warrants or anything like that.
But the bottom line is be aware.
Be aware that when you put data online, an aspect of it
absolutely is out of your control and you need to understand
the ramifications of that should that data be important to you.
Hope that helps clarify what I think you
need to do when you're leaving an online service.
For updates, for comments,
for links related to this topic and more, visit
Askleo.com/157731.
I'm Leo Notenboom and this is Askleo.com.
Thanks for watching.