That the website URLs are unencrypted was a bad mistake by LastPass, so if anything should be criticized here, it's that. As long as you're not treating your own security as a joke, LastPass isn't going to make you any less secure.Įdit: I misread part of the official blog post on my first reading.

That LastPass actually told you about this attack is a point in their favor when most companies in their position would likely try to shove the whole thing under the rug and hope nobody notices. If you're one of those 'I'm deleting my LastPass account' people as a result of this break-in, you're acting irrationally and doing yourself no favors. LastPass has done everything right from what I can see on my end. That's why it's just as important for me to make sure whatever damage can be done once you get past the barriers I have set up is minimal. When I design server security, I start with the assumption that nothing I do can fully protect against a focused attack. They have also communicated clearly with both customers and authorities. In this case, LastPass has made sure that any stolen data is basically worthless except in those cases where the customers themselves have deliberately ignored the LastPass password recommendations and put themselves at needless risk.

What matters is how useful any stolen data is to the attackers and how the company that was attacked communicates with its customers and the authorities afterward. It's literally impossible for a company with an online presence to protect itself 100% from data theft. Whoever broke into LastPass has nothing of any real value outside of those accounts whose master passwords are 'password1234' and such. The only people who need worry are the people who use crap master passworrds, and if you're one of those people, nothing LastPass could have possibly done would have made your data safe in any way, shape or form, nor will any other password manager save you from your own stupidity. WTF is this stupid-ass title and why is it still unchanged?Īs someone who works with computer security myself, this is a huge nothingburger.

Lastpass clear vault