Roughly 25 million of the passwords have never been seen before by widely used service.
    • Tangent5280@lemmy.worldEnglish
      32·
      10 months ago

      I feel like atleast one of these has been hacked at some point in the past, but I cant remember which.

      • hperrin@lemmy.worldEnglish
        56·
        10 months ago

        It was LastPass, but the passwords themselves weren’t leaked. All of these encrypt the password.

        • Passerby6497@lemmy.worldEnglish
          22·
          10 months ago

          the passwords themselves weren’t leaked

          You’re not wrong, but you kinda are. The plaintext passwords weren’t released, but the encrypted blobs were stolen. Unfortunately, the LastPass defaults were absolutely shit so people have been able to selectively attack the blobs and decrypt the vaults, leading to millions in crypto being stolen.

          I was a long time supporter of LastPass, but they haven’t been responsible stewards of sensitive information. The fact that they failed to encourage or force existing customers to update the encryption settings as they updated their defaults is negligent and is disqualifying in my opinion.

        • Z4rK@lemmy.worldEnglish
          19·
          10 months ago

          There is no excuse for LastPass and it absolutely should not be treated with your passwords or secrets.

          • shaggy959500@lemmy.worldEnglish
            4·
            10 months ago

            Security Now is amazing. For anyone that wants the deep dive tech perspective, plus what it means for everyday people and users, this is a great option.

        • Tangent5280@lemmy.worldEnglish
          4·
          10 months ago

          Ah, alright, thanks. Thats a good thing then, that you cant get to the passwords even if you hack the company.

      • boatswain@infosec.pubEnglish
        18·
        10 months ago

        KeePass doesn’t store your stuff in the cloud; it’s all local storage. You can sync your encrypted KeePass DB in a number of different ways; personally, I go for SyncThing, but you can use Box or whatever.

    • fmstrat@lemmy.nowsci.comEnglish
      21·
      10 months ago

      Based on experiences helping people migrate away, I’d suggest removing LastPass from your list. See other replies for why.

      Note: For those that care, not only is BitWarden FOSS, it can also be self hosted easily using VaultWarden.

      • hperrin@lemmy.worldEnglish
        6·
        10 months ago

        I added a note. I personally use Bitwarden and would recommend it, but I didn’t want to give a biased recommendation. If, for whatever reason, one of the others works better for someone, just using an encrypted password manager is way better than not.

        • fmstrat@lemmy.nowsci.comEnglish
          2·
          10 months ago

          Oh I feel you. I did a ton of research on toilet paper (of all things) and made a recco and my post was deleted as an “ad”, hah

      • Ghoelian@lemmy.dbzer0.comEnglish
        3·
        10 months ago

        Only issue I have with 1Password is their Android app. It works great most of the time, except that they didn’t implement the Android autofill stuff correctly.

        It sees Firefox as a browser and offers autofill suggestions for the websites just fine, but apparently Fennec isn’t on their allowed browser list or something. It just sees Fennec as another android app and doesn’t offer logins for the website I’m on, just ones that I’ve linked to the Fennec app.

    • cdf12345@lemmy.worldEnglish
      23·
      10 months ago

      About 1/3 had not been previously seen in the have I been pwnd database, that’s really crazy. Either this was a very new or private list of exploited accounts.

      • EarMaster@lemmy.worldEnglish
        7·
        10 months ago

        The good thing (for me personally) is that only some very old mail aliases of mine are in this collection. Which means that using a password manager to create and save all my passwords for years does have a positive effect.

        • SkyNTP@lemmy.mlEnglish
          2·
          10 months ago

          A password manager is irrelevant for Have I Been Owned, since the site only matches emails, not passwords. Also, that site includes mega lists which mix and match data from different services as well as spam lists… Not terribly useful.

          PM’s and avoiding reuse are still vital despite that.

  • AutoTL;DR@lemmings.worldBEnglish
    12·
    10 months ago

    This is the best summary I could come up with:

    Nearly 71 million unique credentials stolen for logging into websites such as Facebook, Roblox, eBay, and Yahoo have been circulating on the Internet for at least four months, a researcher said Wednesday.

    breach notification service, said the massive amount of data was posted to a well-known underground market that brokers sales of compromised credentials.

    Hunt said he often pays little attention to dumps like these because they simply compile and repackage previously published passwords taken in earlier campaigns.

    This isn’t just the usual collection of repurposed lists wrapped up with a brand-new bow on it and passed off as the next big thing; it’s a significant volume of new data.

    When you look at the above forum post the data accompanied, the reason why becomes clear: it’s from ‘stealer logs’ or in other words, malware that has grabbed credentials from compromised machines.”

    For added assurance, Hunt also checked a sample of the credentials to see if the email addresses were associated with accounts on the affected websites.

    The original article contains 645 words, the summary contains 167 words. Saved 74%. I’m a bot and I’m open source!