I use Lastpass. Today I got an email from them telling me that their servers were hacked, and a database with email addresses and recovery hints was probably copied.
Dear LastPass User,
We wanted to alert you that, recently, our team discovered and immediately blocked suspicious activity on our network. No encrypted user vault data was taken, however other data, including email addresses and password reminders, was compromised.
We are confident that the encryption algorithms we use will sufficiently protect our users. To further ensure your security, we are requiring verification by email when logging in from a new device or IP address, and will be prompting users to update their master passwords.
We apologize for the inconvenience, but ultimately we believe this will better protect LastPass users. Thank you for your understanding, and for using LastPass.
How safe is the recovery method?
Just now I logged out of my Lastpass account, and did a recovery. It turns out that Lastpass stores a one time password on my machine (and on each machine that I used to login to Lastpass), activated by a recovery link sent to the mail address used for the Lastpass account. Just clicking the link is enough to unlock the local database. The link has a long identifier. I guess this id is required to unlock the local one time password - if not the password could simply be copied and abused.
- Question: How safe is this method, with those one time passwords on all machines where I logged in?
Abuse of stolen email addresses
The stolen email addresses - what risk do they pose?
Of course it's not good that yet another time thousands or millions of valid mail addresses are stolen and can be abused for spam. Furthermore, as these are all Lastpass users, they can be mailed about Lastpass, and tricked into entering their master password.
When I login to lastpass, it downloads the user database, and unlocks it. If this happens in that order, I can download all databases for all users without having their passwords. I could then try to unlock the databases using a list of standard passwords like "password" and "1234567890", the usual bad passwords. That will open quite a lot, and it won't notify Lastpass as they don't see the many tries.
If the database is not downloaded before the password is validated, that means that the database is unlocked remotely, which is not what they tell us. Right?
- Question: Is this a possible scenario or is this method protected in some way?
The connection between the browser addon and Lastpass is of course encrypted, and I don't know if they somehow protect a newly downloaded database to prevent something like this, but won't some really smart people be able to get around that encryption?
Advice to update master password
As they write in the mail, Lastpass monitors whenever someone logs in from an unknown location, and sends a mail to verify that this is legit. This is of course good practise. Then they write that they will prompt users to update their master password. Why? I don't understand. How will this prevent the criminals from unlocking accounts more than currently is the case? Lastpass says no passwords are downloaded, which should be impossible anyways because they don't store them.
- Question: So why do we need to change the master password and how is that going to make it more difficult for the criminals?
This "hack" can be done without having all those addresses. Just login using a random email address and follow the same scenario. The difference is efficiency.
- Question: If Lastpass is sure they properly protect my data, and I use a strong password, then nothing has changed except that some criminal organisation got my email address, if they didn't already?
Do I miss something? What other risks are there?