What you need to do about the most recent LastPass hack.
Hi, everyone. Leo Notenboom
here for Askleo.com.
After the announcement that LastPass had
suffered some kind of a hack or a breach yeah, I started getting questions.
Since I've recommended LastPass for a very
long time, I've gotten questions that basically range from,
I'll be interested in your response to what do we use instead?
Right.
What I want to do is use this as an opportunity to understand why it's so
incredibly important to read beyond the headline.
If all you do is pay attention to headlines, you'll be living in fear
and making a lot of bad decisions, basically for the rest of your life.
But if you take the time to delve deeper, you can make some more informed decisions.
My informed decision is that, no, I'm not leaving LastPass.
In fact, there's nothing I need to do as a LastPass user and as someone
who continues to recommend LastPass, I'm not changing that recommendation either.
But we also have to recognize something
very important about password vaults, and that is trust.
Trust is important.
I say that because,
especially when it comes to something as important as a password vault,
if you don't trust the software, you are less likely to use it.
It's important that you use a password
vault, therefore, it's important that you use a password vault you trust.
Now, my trust in LastPass has not been eroded by this latest incident.
However, I can certainly understand that individuals paying attention
to perhaps only the headlines or not understanding the details that are
presented might feel that they just don't feel comfortable using LastPass anymore.
I get that. I don't think it's necessary,
but I understand it, and there are plenty of good alternatives.
I'll talk about them in a minute.
And I've got an article coming up soon that discusses some of them.
More important than sticking with the tool you've got or
listening to my recommendation, or what you might consider to be
my rationalization, is that you trust the software you use.
If you don't trust LastPass, then you should be using something else.
Now, the breach itself is interesting when you actually do get into the details.
The issue is that apparently a developer
working on LastPass had his account compromised.
That means that the hacker was apparently able to access some of LastPass's source
code that LastPass also said probably included sensitive information,
what I consider to be trade secrets, maybe information about how LastPass works
that they would prefer not to be made public.
But that's it.
That's what was taken.
That's what was breached.
Notice what's missing.
Pay very careful attention to what's missing.
Nowhere was any user information compromised.
My account credentials were not compromised.
My vault was not compromised.
Any information LastPass has about me was not compromised.
And none of the entries in my LastPass vault were compromised.
None.
I was not affected.
Now, LastPass did make the information public.
They have a pretty good blog entry
that basically goes over exactly what happened, what was compromised,
and includes a fact that basically underscores what I just said.
No user data was involved, period.
I don't see that as a risk for my personal data then.
In fact, if anything,
the fact that LastPass came forward and was open about this in public
actually increases my confidence in their commitment to security
and the likelihood that should something happen again sometime in the future,
LastPass will once again do the right thing.
So what is the risk?
Well, we do need to understand that, yeah, there is a risk.
The risk is simply this a hacker now has some of LastPass's source code.
They have not indicated what source code
they took, but they did indicate that the source code
probably had some kind of what I call trade secret information embedded in it.
That means that the hacker could examine the source code
and potentially maybe identify other vulnerabilities that we didn't know about
before and potentially take advantage of those vulnerabilities or write malware
that could take advantage of those vulnerabilities.
Just like open source software.
In a way, this particular piece
of Lastpasses software, their source code was unintentionally.
Open source only halfway, right?
Open source typically means
that individuals can use it, can contribute to it, to whatever.
None of that is happening, but the source code is visible.
One of the things that a lot of open source advocates
rightly claim is that by making the source code visible, then everybody can look
at it and identify vulnerabilities and make those issues known to the authors
or depending on the community, actually go in and fix them.
Well, yeah, that happens with open source,
and it looks like it happened with a piece of the LastPass source code.
I'm not terribly concerned still,
because the way that LastPass and to be honest, most password managers are
designed is that they don't know your password.
They know that you've typed it in correctly, but that's all they know.
They don't know what it is.
What that means is that LastPass could not
expose the contents of your vault even if they wanted to.
In other words, the hackers, if the hackers somehow
managed to actually get at an encrypted vault on the Last past servers,
which didn't happen and is really unlikely to happen from just a developer's account.
But even if they did, even if they got access to the encrypted
vault, that's all they have, an encrypted vault.
They can't see what's inside because it's encrypted.
And nowhere on the LastPass server is your password that would be used to decrypt it.
Nowhere. LastPass does not have your password.
Like I said, the technology used allows
them to confirm that you on your computer, typed in your password correctly.
But they do not know exactly what the password was and they can't.
So whatever a hacker, even if they managed to get all the way in.
The only thing they would be able to get
at is a bunch of encrypted data that would be useless to them.
So like I said, I'm not concerned about
this particular hack because it doesn't expose any of my data.
Even if that data were exposed,
if the encrypted data were exposed, we're still safe because it's encrypted.
So I just don't see the necessity for taking any kind of action.
I continue to use LastPass.
I will continue to recommend and LastPass.
However, as I said earlier,
I totally get that some people may not feel comfortable doing so.
That's fine.
That really is I totally get that this is too important to be uncomfortable about.
If you're not comfortable using LastPass, there are alternatives.
I'll talk about them in an upcoming article.
But there are programs like BitWarden
and 1password and keePass and some others.
Those are great alternatives.
If you feel more comfortable placing your trust in them, by all means use them.
I feel comfortable placing my trust in LastPass.
I'm not going to move.
I don't think you need to.
But more important is I think you need to feel secure so that you will use your
password vault for the maximum security across all of your accounts.
Hope that helps.
Understand a little bit about what's going on and why I'm not switching.
For updates, for comments,
for related links and more, visit askleo.com/148363.
I'm Leo Notenboom.
And this is Askleo.com. Thanks for watching.