Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry
Seems they only targeted potentially accounts that might’ve contained some MONEY (Cryptocurrency)
Then on Aug. 28, Monahan said she’d concluded that the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments.
It seems that in particular “Secure Notes” containing crypto seed phrases seem to have been compromised. It’s pretty silly to have not migrated your old crypto wallets by now though.
In a December 2022 blog post, Palant explained that the crackability of the LastPass master passwords depends largely on two things: The complexity of the master password, and the default settings for LastPass users, which appear to have varied quite a bit based on when those users began patronizing the service.
…If you have/had an older account with potentially a very weak Master Password… Your password would be considered Weak if it was Less than 12 characters & did not not contain Uppercase, Lowercase and Symbols & was not an XKCD style password that *isn’t * “Correct Horse Battery Staple” or some other combination of those exact four words…
But Palant said while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum.
…Older than 2018…
Palant noted last year that for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000.
…Or worse yet, 2013…and you didn’t change the iterations setting(s), which most people probably did not.