Light

Episode #904 Quiz

Leaving LastPass
Date: 2023-01-03 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

LastPass’s cloud backup was exfiltrated, exposing unencrypted metadata and encrypted vault blobs. Security depended on master-password entropy, PBKDF2 iterations, and CBC versus older ECB ciphertext. LastPass failed to enforce stronger passwords or iteration upgrades for all users. Mitigations include changing masters, reviewing 2FA-protected accounts, and migrating to better-audited alternatives.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific additional information did LastPass say the threat actor copied from the cloud-based backup storage besides the vault data itself?

Question 1

According to the episode, what specific additional information did LastPass say the threat actor copied from the cloud-based backup storage besides the vault data itself?

Only password hashes and authentication salts Only source code and technical information from the development environment Basic customer account information and related metadata Only encrypted secure notes and form-filled data

Question 2: What did Steve identify as the key reason the stolen vault blobs were still at risk even if a user changed their LastPass master password after the disclosure?

Question 2

What did Steve identify as the key reason the stolen vault blobs were still at risk even if a user changed their LastPass master password after the disclosure?

The backup contained the master password in cleartext beside the vault data The vaults were re-encrypted automatically with the new password when the account next synced The attacker had obtained the new password from LastPass's support portal The vaults had been encrypted under the master password that existed at backup time

Question 3: What evidence did Steve say showed that LastPass did not universally push the higher PBKDF2 iteration count to all users?

Question 3

What evidence did Steve say showed that LastPass did not universally push the higher PBKDF2 iteration count to all users?

Only mobile clients were updated to the higher iteration count, not desktop clients Some listeners checked their accounts and still saw 5,000 iterations The vault export format no longer included an iteration count field LastPass publicly announced that 5,000 iterations were still their default for legacy accounts

Question 4: What concrete concern did Steve raise about the unencrypted data in the stolen vault blobs?

Question 4

What concrete concern did Steve raise about the unencrypted data in the stolen vault blobs?

It would let attackers bypass two-factor authentication on all sites It would destroy the integrity of the encrypted vault ciphertext It would immediately reveal every stored password without cracking It could enable convincing phishing using exposed URLs and email addresses

Question 5: What set of migration criteria did Steve say led him to choose Bitwarden over the other password managers he considered?

Question 5

What set of migration criteria did Steve say led him to choose Bitwarden over the other password managers he considered?

The lowest annual price, the longest free trial, and built-in email hosting Open source, a useful free tier, and strong cross-platform support Proprietary code, biometric-only unlocks, and a single-device free plan Mandatory self-hosting, browser-only access, and no two-factor support

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.