If this inspires one to select a new password vault provider, I encourage selecting one that encrypts the entire vault and has an MFA option for protecting the vault a local (vs. And, like everyone, they need to remain vigilant in their phishing defenses. All of this is extremely useful in phishing attempts.Īt this point, LastPass customers need to think about the strength of their master password and consider changing passwords on their “important” (or all) web sites. So, the bad actor knows the website for your bank, your email provider, your paycheck stub, your doctor/hospital, etc. Notably, URLs for which you have stored passwords are not encrypted. Unfortunately, it turns out that only portions of the vault are encrypted. On the surface, one may consider this “bad”, but not “catastrophic” due to the presence of a master password that “nobody but the customer knows”. Today, they disclosed that the bad actor also obtained copies of customer’s encrypted password vaults.

Late last month, LastPass disclosed that they had suffered a breach, exposing customer contact information and source code to the company’s applications.

Lastpass local vault