DEACTIVATE LASTPASS ACCOUNT PASSWORD

Whether you stay with LastPass or not is irrelevant for the primary objective, the race to invalidate your vault contents. All their safeguards have been rendered useless, the only thing that stands in the way is trusting in encryption and that it won't be broken, which is not impossible. It's painful, not fun and shouldn't be required, but LastPass failed in a major way and now you have to take control, because you can't do anything with LastPass to prevent it. Not all things in the vault may be able to be changed, but all password, API keys, anything that can be changed, needs to be, so you protect yourself from the worst case scenario. So if it was decrypted what's your exposure? The only way to possibly mitigate major damage is make the information stale. Remember some unknown actor has got a snapshot of your vault at a period of time. The race is to basically make your vault contents invalid. Unfortunately, LastPass hasn't been forthcoming on when the vaults were downloaded, therefore you must assume everything is at risk, but on a reasonable guess, it was likely at least 1 - 2 months ago, ignoring the fact LastPass announced it officially on 22nd December, it is highly likely the actual downloading of vaults in binary format were lifted long before then. The only protection is invalidate your vaults contents from the time it was stolen.

They use the stolen customer data to prepare targeted phishing campaigns, to get you to give up the master password.

They decrypt it and proceed to use the information within against you.

You will have no warning that someone's brute forcing your vault contents, until either: 2FA, restricted logins by country, brute force protection (8 attempts) etc are all not going to help you given the blob storage of your vault is available. website or browser extension are defeated. All safeguards and warnings you'd normally get if someone was trying to get into your vault via the LastPass web application i.e. The situation we have now is we assume any LastPass customer's vault is potentially out there to be brute forced. Bear in mind, as hardware gets more powerful cracking passwords will get more efficient. The possibilities on how realistic that is depending on various factors we can debate for the next few years.

DEACTIVATE LASTPASS ACCOUNT PASSWORD

Maybe consider a random 5 - 6 word passphrase with some numbers, symbols, and capitals sprinkled in the mix for good measure.Īll that stands in the way of the stolen binary vaults is the master password to decrypt the contents. No matter if you stay with LP or go somewhere else, please please please use a strong password for your vault.

If you have a STRONG master password AND believe LastPass has at least implemented the encryption properly, then your accounts are likely still safe. This is of course assuming LastPass has implemented encryption properly and you don't have any URLs in your vault that might allow for a password reset or otherwise leak a key or password. The only thing protecting the accounts in your vault right now is the strength of your master password. Changing only your master password and/or deleting your account will offer no protection from the breach. If you are worried about the recent LastPass breach your only recourse is to change ALL the passwords of the accounts held within your vault AND your master password (Assuming you are staying with LastPass).

Deactivate lastpass account