LastPass has been my trusted choice of password manager, but they have now confirmed a security breach on their network. The company said there is no evidence that user's vault data/stored passwords were taken, however, the hacker did manage to take away user email addresses, authentication hashes, password reminders and server per user salts.
Lastpass assured users with this:
We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.
LastPass has issued a security notice as shared at - https://blog.lastpass.com/2015/06/lastpass-security-notice.html/
Add new comment