It’s a good idea to use one of the best password managers to keep your logins safe, but now a security company is warning that one of the most popular password managers in the world is not safe to use.
The extraordinary claim comes from Intego, a firm that specializes in Mac security. Intego made its assertion based on a series of security breaches LastPass has suffered in recent months, the way LastPass has responded to those incidents, and the underlying technology LastPass uses to protect customer accounts.
In its report, Intego outlined the LastPass saga, from its initial disclosure of a breach in August 2022 up to an investigation by rival password manager 1Password in December. That timeline paints a picture of a password manager with questionable practices and technology, Intego states.
In August 2022, LastPass notified users that its development environment had been accessed by an unauthorized third party but that no customer data was taken. Then, LastPass issued a new statement in November stating that hackers had taken “certain elements of … customers’ information.”
Finally, in December, LastPass admitted the data accessed by the hackers was used to trick a company employee into handing over keys to some customer credentials, which were then used to access and decrypt customer data.
Questionable practices
However, Intego maintains that third-party analyses of the breach suggest a more troubling scenario. According to security researcher Wladimir Palant, for example, LastPass’s statements were “full of omissions, half-truths, and outright lies.” One of Palant’s allegations is that LastPass’ implementation of a password-strengthening algorithm is not considered strong enough based on industry standards, making users’ vaults far too easy to hack into.
Rival password manager 1Password has added its opinion into the mix, claiming that it would cost a hacker $100 or less to crack the master passwords protecting many LastPass vaults, such is the weakness of LastPass’ hashing methods.
All of that has led Intego to state that, “given what we now know about LastPass — both how the company operates and its technology — we do not recommend using LastPass as a password manager.”
How to keep your passwords safe
It’s a remarkable statement to make given LastPass’ popularity. LastPass itself claims it has over 33 million users — if the claims about its lax security are correct, that’s a huge number of people whose accounts, passwords and credit card data are all now potentially vulnerable.
Right now, Intego advises LastPass users to immediately begin migrating their accounts to another password manager. Once that’s complete, the company recommends users update all of the passwords that had been stored in LastPass with fresh replacements.
It goes to show that not even the most popular services are immune to hacking attacks and security breaches. Whether you use a password manager or not, you can protect yourself by using strong, unique passwords that are not used on multiple sites. That way, one breach won’t lead to all your other accounts being compromised.
