LastPass hammered with £1.2M fine for 2022 breach fiasco

The UK's Information Commissioner's Office (ICO) says LastPass must cough up £1.2 million ($1.6 million) after its two-part 2022 data breach compromised information from up to 1.6 million UK users. Information Commissioner John Edwards said: "Password managers are a safe and effective tool for businesses and the public to …

[TrevorH]

Why so cheap? £1.2m is a drop in the bucket, add several noughts please.

[ajadedcynicaloldfart]

@TrevorH

It's a United States company. Can't risk getting more sanctions can we?

[Roo]

It's about the estimated size of the CEO's pay packet. I imagine they'll get a raise.

[Anonymous Coward]

Long term liability

Instead of a single fine, companies should send regular payments to affected clients for 10 years.

This may become a reasonable source of personal income, since so many companies fail security; and will truly motivate companies to improve.

The payments could be paid once a quarter to properly reflect on quarterly reports. Designated managers of all payments could be set to simplify compliance and convenience - which could be Google Wallet, or Amazon shopping, if a user wants so.

[Roland6]

Re: Long term liability

>” companies should send regular payments to affected clients for 10 years.”

Given all the free accounts, with only a email address, that would seem to imply we all need PayPal accounts.

[VoiceOfTruth]

Blasé approach to security

Senior DevOps engineer at LastPass has Plex Media Server running on his PC. Hardly what one might call a locked-down workstation.

I don't single out LastPass here, but it's a sign that a lot of so-called security companies can't secure themselves.

[MiguelC]

Re: Blasé approach to security

As I understand it, it wasn't necessarily the same PC. The problem was that LastPass "actively encouraged, senior staff to link their personal and business accounts, so both could be accessed using the same master password". Once having got to the personal account, the attacker was then able to access the linked business account were were kept all those yummy LastPass passwords

[VoiceOfTruth]

Re: Blasé approach to security

Yes. My bad on that. But linking personal and work accounts is beyond stupid. Would they link their bank logins? Who knows? The question is why would they think any kind of linked login is a good thing?

[Just Enough]

Re: Blasé approach to security

This is definitely the insane part. I can't fathom why either company or senior staff would think that linking personal accounts and work accounts was a sensible and desirable. What happens when the member of staff decides to move on? Why does the member of staff not have reservations about their employers being entwined with their personal life? What if the staff member's personal on-line life is NSFW, yet accessible through the company's systems? What if the company locks down the senior staff's account for some reason, and inadvertently locks them out of their personal accounts too?

[RSProutt]

Re: Blasé approach to security

The Lastpass employee had installed Plex on his home PC/Server.

An Attacker used a known exploit to compromised the Employee Plex software, which allowed a keylogger to be installed.

When the employee connecting into work (VPN) the keylogger captured the credentials

Now the Attacker has the credentials, they can use those stolen credentials to get into Lastpass systems.

[MOH]

Re: Blasé approach to security

I dont understand why you're being downvoted.

If corporate policy encouraged this, and encouraged one of four people with the required decryption keys to exploit the attack to use their personal device for work then nobody should ever use LastPass again.

There's a place for BYOD. This is not it.

[Roopee]

Re: Blasé approach to security

Downvoted because neither you nor VoiceOfTruth read the article properly - the breach occurred because of linking of personal/work accounts, not personal use of work PC, and BYOD isn’t even suggested.

[DCdave]

Re: Blasé approach to security

Also reading the article reveals that the PC of the person with access to the encryption key was compromised using a vulnerability in Plex Server, the presence of which suggests either BYOD or personal use on a work device. Once the PC was compromised the linking of personal and work accounts led to further compromise.

[MOH]

Re: Blasé approach to security

I suspect the reason both of missed that fact is because there's a load of links labelled "more context" which would tend to indicate the end of the article.

It's not at all obvious on mobile that half the article is below the links.

But that's even worse: a company in charge of password management effectively encourages employees to use the same password for personal stuff and highly confidential corporate systems.

LastPass should be toast after this

[Ascy]

I've always thought people that use these web based password managers are nuts. Keep your passwords secure, except give them all to one company? I've been in the software dev industry long enough to know that the majority of fellow devs out there don't really understand the first thing about encryption, so unless their solution is open source AND you are going to inspect the source code yourself AND you trust that the code you've reviewed is the one that's actually running, why risk it?

You don't get the same level of team audit and granularity as you may get with some web based solutions, but just put your passwords in a KeePass vault and use encrypted cloud storage to sync the vault (eg Filen, Sync.com, iDrive, etc). Then there are two layers of defence and you don't have to fully trust either solution (though are obviously hoping that one of them works).

[Charlie Clark]

I understand your point but, even as a developer, I have a couple of issues: encryption isn't my forte so I don't trust my own ability to assess the security of any particular solution, even if I have access to the source – though I do agree that making it open source is a good start. But what are non-technical users supposed to do? If they're lucky, they'll have a friend to help them choose and manage whatever system they use. And I think that for many people KeePass, while a great solution isn't practical. It adds complexity but also an additional dependency and has a master "database" – I have situations where I need to be able to demonstrate that personal and private keys are separate. As it happens, for one customer I do have to use LastPass – not my choice – so I use a different FireFox profile for this. For my personal use, I've switched from BitWarden, which has some great features but more than I need at the moment, to HeyLogin, which has an admirable import function, making switching easier.

On the whole, I prefer it if people do at least use password managers and let them generate "secure" passwords.

[Kurgan]

There are lots of issues here, but surely the biggest one is that it's web based. The other is that it's closed, the next is that devs don't understand security. They never do. And a big repo full of credentials is a fucking big target, so it will be under constant attack from big criminal groups.

I'd never use a commercial, closed, web based password manager. NEVER.

I use KeepassXC with keyfile, password, and on an encrypted drive, on Linux. And I really hope that no one will sneak a backdoor into KeepassXC as has already happened in other open source software.

There will probably come a time when I'll drop password managers completely and use text files on an encrypted drive. Less risk of being targeted by supply chain attack if you don't use a password manager at all but use another encryption method.

[Roland6]

Perhaps the best thing the developers of Keepass could do is to provide a wizard that enables your sverage user to set up Keepass across all of their devices as easy as Apples Keychain or LasrPass…

[NoneSuch]

Reality

There is no system, protocol, mechanism, or service that is 100% secure, 100% of the time.

Any platform that houses passwords is a target. Thanks to US Gov weakening and limiting encryption for their own nefarious uses, everyone is at risk.

[BasicReality]

This kind of idiotic crap needs to stop. The government, no matter which country, has no place issuing fines over stuff like this. The money won't go to the people who had their data stolen. It's just to enrich the government.

[IGotOut]

So do nothing?

This is a pretty poor idea, even by your standards.

[Charlie Clark]

This is how the law works in the UK and is preferable to civil claims.

[Anonymous Coward]

Donald!?

[Missing Semicolon]

You can't network

A little black book.

[Anonymous Coward]

Re: You can't network

What has your list of girlfriends got to do with this?

[Roland6]

Re: You can't network

Just another relationship…

[spireite]

Re: You can't network

He's a nerd, what girlfriends?

[Kurgan]

Re: You can't network

If you don't lose it, this is the best method. It really is.

[Smeagolberg]

"Information Commissioner John Edwards said: "Password managers are a safe and effective tool for businesses and the public to manage their numerous login details and we continue to encourage their use."

Yeah, right... put all your passwords (in some form) on a computer that someone else owns and controls and that has a giant target on its back labled "Hack me".

[Anonymous Coward]

No

Never give anyone else your passwords

[Anonymous Coward]

Re: No

Mine is Hunter2.

[Roland6]

Re: No

Is that <Hunter2>, < Hunter2> Or <Hunter2.> ?

It is a little irritating when sharing passwords - yes it does happen where companies don’t have a privileged password management system, when people don’t provide some form of delimiters to denote which characters form the password.

[MrGreen]

Shocking

So your data was valued at 0.75p by the ICO.

This is how little the government value you as a citizen.

[xanadu42]

I manage my own passwords...

Typically "stored" using pen/cil and paper-based notepad (NOT sticky notes plastered near the computer) with a backup on an encrypted USB Drive

IMHO much more secure than a "third-party" software product (and much cheaper too)...

[heyrick]

Hammered? HAMMERED?

That's one single measly dollar per person. I could hammer harder using a piece of soggy linguine. This "fine" is a joke. The ICO is a joke.