Re: LastPass Vault Breached via Employee's Home Computer

On 2/28/23 20:04, [email protected] wrote:
> https://pjmedia.com/news-and-politics/gregbyrnes/2023/02/28/lastpass-vault-breached-via-employees-home-computer-giving-keys-to-the-kingdom-to-hackers-n1674308
> 
> "Millions of LastPass users may be at risk after a major breach of the
> home computer of one of their top employees. This employee was only
> one of four people in the company with access to their corporate
> vault. The breach may have come through a home Plex media account,
> according to Ars Technica*, and appears to have been perpetrated by
> the same hackers who breached LastPass security on a smaller scale
> last August. At about the same time, Plex’s security was also
> breached."
> 
> *https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/
> 
> This is wjy I don't use password mangagers.  I keep my
> passwords/phrases in a PGP file on my comp.
> Yeah, I gotta copy paste after opening the PGP, but it is safer than
> using password "protector" dumbware like LastPass.

Write your passwords down and keep them in a real safe. A decent 
fireproof safe can be had for $250. Bolt it to the floor and fill the 
bottom half with a ton of bricks or bags of sand. Nobody is carrying it 
away like that. A small, 6-gun safe can be filled up halfway with 1500 
lbs of fire brick or sand, then the paperwork and password backups can 
be kept in a fireproof lockbox inside the safe on top of the bricks. The 
double fireproof setup will guarantee that your paperwork will not burn, 
and the bricks will absorb and distribute most of any heat that does 
seep in, spreading it out and reducing the air temperature inside the 
safe in the event of a fire. Even if your house or office burns to the 
foundation, your backups will be in good shape.

I keep multiple safes in different locations to protect my vital 
information and redundant backups. I have two dozen USB backups spread 
out among my safes. If one stops working I buy two new drives and 
replace the broken one with two more. That's why I'm up to two dozen 
already.

I rotate the USB drives between the safes and office, swapping out the 
rotation every time I go the rounds. People must think I am a gun nut, 
when they see two gun safes in my office, but I don't even tell them 
there are no guns in the gun safes.

My disk encryption passwords are not written down anywhere or in any 
password manager. I don't even keep them in my safes. They are long, 
complex passwords, 32+ chars long. I have had no problem remembering a 
handful of such passwords for many years. Nobody can steal a password 
that is not on disk or paper.

I can not see why anyone would trust their passwords to the cloud. It's 
like betting your life that there isn't an encryption bug. Not for me!