<http://schema.org/articleBody>
"Irregular network activity caused cloud-based password management solution LastPass to issue a security notification Wednesday night. In addition to the security notice, LastPass is requiring users to change their master passwords as a precaution.\nOn its blog, LastPass notes that it noticed some strange network activity in several places in its system. Because the root cause for the traffic couldn't be ascertained, LastPass is assuming the worst.\nFrom its blog:\n...We're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transferred and that it's big enough to have transferred people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.\nLastPass notes that the potential threat in this case is brute-force password attacks, likely using dictionary-based key generators. For that reason, LastPass says users who have strong, non-dictionary based passwords or pass phrases should be fine.\nUnderstanding that not all users have a strict password, however, LastPass is requiring everyone to change their master password.\nAn unfortunate side effect of all this password changing, however, is overloading the LastPass infrastructure. At 2:15 p.m. Thursday, LastPass posted this update:\n\nRecord traffic, plus a rush of people to make password changes is more than we can currently handle.\nWe're switching tactics \u2014 if you've made the password change already we'll handle you normally.\n\nWhat this means is that LastPass users who have not already changed their passwords will be logged into offline mode. LastPass will work as usual, but the syncing of new passwords won't be available.\nUnderstanding the Real Threat\nOperating under LastPass's worst-case assumption that email addresses, server salt and salted password hashes were lifted from the LastPass database, there is little reason to think that users face any substantial risk.\nAlthough crackers may now be able to use brute-force methods to crack the passwords for some users, LastPass is taking major steps to prevent access to user accounts from nefarious sources.\nFirst, the company is requiring that users change their master password. Because of the site's server load, this process could take days. However, all users will be required to change their passwords before they can access their accounts.\nSecond, LastPass will be verifying that users are who they say they are, by requiring email validation or by having users enter the password change form via an IP block used in the past. In other words, if a request is coming from an IP range thousands of miles away from the last place a user logged in, the user won't gain access without going through another verification layer.\nWhat This Means for the Future\nLastPass is one of the largest cloud-based password management tools on the web and through the years, it has proved to be an effective and secure option for individuals and businesses. Mashable has recommended LastPass as a password management solution in the past.\nWe commend LastPass for making the decision to notify users immediately, require new master passwords and utilize an email/IP-based authentication system.\nBut we still worry about how and why an attack like this was possible in the first place. LastPass says that its security audit isn't giving much insight into the attack vector. The company's transparency in this matter is admirable \u2014 in fact, it's essential \u2014 but it's still troubling.\nFor users who already have qualms with having their passwords stored in the cloud, this incident, unfortunately, will not make things any better. \nWe're not security experts, but perhaps LastPass could consider requiring that master passwords fit a minimum strength. Password strength meters are already built into the product \u2014 if users were required to have a password that would be unsusceptible to dictionary-based brute-force attacks, the consumer-facing risk might be a bit lower.\nImage courtesy of iStockphoto, peepo"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2011/05/05/last-pass-breach/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Mashable+%28Mashable%29>