LastPass Notice of Security Incident

As an avid fan and user of LastPass, I’ve been following this story with great interest:

Commenter epixoip, commenting in this ARS Technica article assesses the incident thusly:

Not much to sweat about here. Lastpass is doing things correctly, and their response is perfect.

If we could trust computers to keep secrets a secret, then we wouldn’t have to worry about protecting sensitive data at rest. But we can’t, so we do. Password databases can be compromised through a myriad of vectors — up to and including physical theft — and you have to plan for the eventuality that your database will be compromised. How you protect the data in the database is what really matters, and this is precisely why we have password hashing, and this is also why the threat model for password hashing starts with a compromised password database. Think of password hashing as an insurance policy. The stronger the password hashing is, the more time you buy for yourself and your users in the event of a breach: time to identify and contain the breach, time to notify your users, and time for your users to update their passwords.

Lastpass definitely understands this, as their password hashing is top-notch — possibly the strongest we’ve ever seen, especially for a company of this size. 105,000+ rounds of PBKDF2-HMAC-SHA256 is definitely no joke.

So while it never looks good when a security company is compromised, there are a lot of positives here:

– They quickly identified, contained, and evaluated the scope of the breach
– They promptly notified users about the breach (within 72 hours)
– They are certainly doing proper password hashing (strong insurance policy)
– Vault data obviously isn’t stored on the same system as authentication data, evidence of strong segmentation

All in all, Lastpass is doing things correctly, and I will definitely continue to support them.