Technology

Bitwarden or keepass ftw

Nearly every victim was a LastPass user.

But every victim was a cryptocurrency user.

Switched to bitwarden as soon as they tried to charge a sub for multiple devices, I see that was the right choice

These guys saved their seed phrases to LastPass, not just account passwords. You can't just change your seeds without moving funds to a new wallet.

The main lesson here is never store your seeds in digital form, ever. Write it down by hand on paper at creation and then take additional efforts to safeguard it.

instead of using a password manager managed by a PRIVATE ENTITY people should start using bitwarden ... its opensource, free and much more secure and reliable

Man am I glad that I picked KeypassXC as my password manager some years ago. Super safe, easy to use, costs nothing, not dependant on internet/cloud, can export data to another app at any time, transparent because open source.

I'm using Syncthing to synchronize across devices which arguably took some fiddling to set up but I only had to fiddle once and haven't touched the configuration since; it just works automagically in the background.

Pro Tip: You don't need to give a private company all of your passwords. That literally defeats the purpose of having passwords.

Any obvious holes in keeping a text file on my laptop that I encrypt when not using it? Using ccrypt on linux.

I do not want my passwords - even encrypted - on the cloud or at the mercy of a 3rd party in any fashion.

That's an average of over 200k each. I'm wondering how they managed to target people with so much money.

migrated my shit out of lastpass like 10 years ago or whenever it was bought by logmein. douches.

This is the best summary I could come up with:

Cybersecurity blogger Brian Krebs reports that several researchers have identified a “highly reliable set of clues” that seemingly connect over 150 victims of crypto theft with the LastPass service.

Taylor Monahan, lead product manager at crypto wallet company MetaMask and one of the key researchers investigating the attacks, concluded that the common thread connecting the victims was that they’d previously used LastPass to store their “seed phrase” — a private digital key that’s required to access cryptocurrency investments.

These keys are often stored on encrypted services like password managers to prevent bad actors from gaining access to crypto wallets.

We have reached out to LastPass to confirm if any of the stolen password vaults have been cracked and will update this story if we hear back.

Researcher Nick Bax, director of analytics at crypto wallet recovery company Unciphered, also reviewed the theft data and agreed with Monahan’s conclusions in an interview with KrebsOnSecurity:

“I’m confident enough that this is a real problem that I’ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.”

The original article contains 363 words, the summary contains 196 words. Saved 46%. I'm a bot and I'm open source!

I mean, they've had more than long enough to change passwords.

Nobody is after your password for the Moravian rug weaving forum but in this day and age it's on you, if you know there's a breach and you don't change your banking / crypto passwords.