- The news recently broke
that LastPass suffered a massive security breach.
This isn't the first time either
as they've dealt with security incidents in the past.
But this time, hackers were able to gain access
to offline copies of vault data.
And if they were able to successfully guess
someone's master password,
they would gain access to all of the account logins.
In this video, I wanna take an in-depth look
at what happened to LastPass, what this hack means for you,
and what steps you can take
to migrate to a new password manager.
So LastPass disclosed that hackers were able to copy
a backup of user vault data
from an encrypted storage container.
The vault data is basically a database
of a user's account login, secure notes,
credit card numbers
and anything they would store in LastPass.
LastPass says the user vault is encrypted
and requires an encryption key
derived from the user's master password to unlock.
But if the hacker were able
to successfully guess the master password,
they would be able to decrypt the vault
and access everything inside.
Here's why this is such a big deal.
The hackers have access to offline copies of the user vault.
So let's think.
If someone was trying to get into your LastPass account,
they would typically go to the LastPass website.
They would type in your email
and they would start trying a bunch of different passwords.
The LastPass server could say,
"Hey, wait a minute, this person keeps trying to log in.
Something's fishy here."
And it could trigger an account lockout.
It could block them from trying to log in
so they can't guess your password
an infinite number of times.
But since the hackers have access to the vault data offline,
they can try as many passwords as they want
without any restriction.
There's nothing there to lock them out
so they could try a million different passwords
until they guessed the correct one.
LastPass claims that if your master password
met their recommendations,
it would take millions of years to crack
and you really shouldn't be worried about it.
But if your master password
didn't follow their recommendations,
they said that it could significantly
reduce the number of attempts it would take a hacker
to crack into your vault.
For anyone who feels that they have a weak master password,
LastPass is literally recommending
that you just change your passwords on all of your websites.
Basically saying,
"Hey, your vault might get hacked at some point
and someone might have all your passwords
so you might just want to go around
and change them everywhere."
Something easier said than done.
And many cybersecurity experts dispute the claim
that it would take millions of years
to crack even a strong password.
And remember, hackers have access to offline copies
of the vault.
This means that whatever your master password was
at the time in August 2022 when this breach happened,
that is the master password that they would have to guess.
Changing your master password in LastPass today
does not mean that your security improves
from the vault data that was accessed.
So what does this mean for you?
Well, if you had an active LastPass vault
at the time of the security breach in August 2022,
ultimately the best way to protect your account
is to change all your passwords.
But I know most of us have so many accounts,
it would be such a big ordeal
to log in and change the passwords everywhere.
So I would start with things like your bank account,
email address, social media accounts,
the accounts that you couldn't live without.
And lastly, if you're still using LastPass,
I would strongly consider trying a different option.
This is not the first security compromise they've had
and it seems like they just keep getting hacked
over and over again.
I personally don't feel comfortable
trusting my data to LastPass,
and I think it's worth exploring other options.
There's many options for you to consider
and you could check out my ultimate comparison video here.
But my personal favorite password manager is 1Password.
Now, 1Password has sponsored this section of the video,
but I've personally used 1Password with my team for years,
and I can say they have a solid product.
After testing many different password managers
in an unsponsored, unbiased comparison,
I can genuinely say that 1Password is my favorite.
There's many things about 1Password I prefer to LastPass.
The UI is intuitive and you can create custom fields.
And 1Password is always innovating
and adding new features.
They recently introduced this sign in with provider feature
where it will track if you choose to use sign in with Google
or sign in with Facebook on a website.
So that way when you return to that website,
it'll give you a reminder
and you know exactly how to sign in.
I've already used this feature several times
and it's come in handy.
But most importantly,
1Password has a secret trick up its sleeve
to protect your data
in the event their servers were compromised.
They have a concept called a secret key.
This is an encryption key that's randomly generated offline
at the time you create your 1Password account
and it's never stored on the 1Password servers.
This secret key
is used in combination with your master password
to create the ultimate encryption key
that protects your vault.
So even if a hacker got offline access to your vault data
and they were able to guess your master password,
they still wouldn't be able to get into your vault
without the secret key.
1Password has essentially forced everyone
to have a strong password without realizing it
because even if your password is abc123,
you still need that security key,
which is guaranteed to be strong
in order to gain access to your vault.
1Password has an article
explaining how the secret key works in depth,
but it's a great strategy by 1Password
to keep your account protected.
1Password also uses something called secure remote password
to authenticate your account details
without needing to send your username and password
to their servers.
This ensures that your account details
can't be stolen in transit going to a server.
I'll share more about how to migrate your data
to 1Password in a second,
but first, I wanna cover some best practices
for securing any password manager.
It's important to understand the concept of risk management.
You should always assume that anything can be hacked.
Nobody wants their accounts to be hacked,
but at the end of the day, nothing is fool-proof.
So if we can see things from the point of view
that anything is hackable
and we need to make the hacker's job harder,
that allows us to protect accounts
and make it not worth the hassle
that someone would have to go through
to get into your account.
So here's a few ways to lock down your password manager
and minimize the risk of being compromised.
First, I would highly recommend using a passphrase
instead of a password.
This is a random series of words with spaces in between.
I know for me that I've always thought
if I make this password with symbols and numbers
in place of letters, that's gonna be secure.
Your master password has to be something
that you can remember.
So the temptation is to just take a couple words,
replace some of the letters for symbols and numbers,
and call it secure.
But actually, passphrases are a lot more secure
because they use spaces.
Not many people think to use a space in a password.
When I learned that this was possible,
I went, "Wait, you mean to tell me
that I can press the space bar when I'm creating a password
and that's a character?"
Yes, it is.
And a passphrase is just random words
like cupcake, space, blue, space, water.
And believe it or not, this is actually a lot harder
for a hacker to guess and crack
than your password that you think is secure
with a bunch of numbers and symbols.
You should also always take advantage
of two-factor authentication to protect your vault.
Whether this is app-based, 2FA or a physical security key,
having a second step to log into your password manager
on the company servers is always a good idea.
Keep these tips in mind
when creating your new password manager account.
Now, I wanted to briefly show you how to migrate your data
from LastPass to 1Password.
In LastPass, go to Advanced Options and Export.
Follow the prompts and enter your master password
and download the CSV export.
In 1Password, go to your profile dropdown and select Import.
Select LastPass and upload your CSV file.
Next, take a look at the imported items
just to make sure that everything transferred over
successfully.
And lastly, this is a really important step.
Make sure you delete the CSV file from your computer
so there's not a plain text copy
of all your passwords hanging around.
And that's it.
You've successfully migrated to 1Password.
1Password is my personal favorite password manager,
but if you wanna see how it stacks up to the competition,
you can check out my ultimate comparison video here.