Since April 2023, all new LastPass customers, and any existing customers who took steps to reset their master passwords, have been required to create or update their master password to a minimum of 12 characters. Starting in January 2024, LastPass will enforce a requirement that all customers use a master password with at least 12 characters.
The increase to a minimum of 12 characters requires customers to first login to their LastPass account to confirm one of two scenarios:
- For those customers who confirm that they already have a master password with 12 or more characters, no actions are needed since they are already in compliance with the new policy.
- Those customers who are not already in compliance with the new policy will be prompted to create a new master password with 12 or more characters.
For those customers who will have to update their master password, here’s a list of best practices to consider:
- Use a minimum of 12 characters, but additional characters are recommended,
- Use at least one of each of the following: upper case, lower case, numeric, and special character values,
- Make it memorable, but not easily guessed, such as a passphrase,
- Make sure that it is unique only to you,
- Don’t use your email address as your master password,
- Don’t use personal information in your master password,
- Don’t use sequential characters (for example, “1234”) or repeated characters (for example, “aaaa”),
- Make sure you don’t reuse your master password for any other account or application.
As previously noted in ourMarch 2023 security incident communications, resetting MFA is necessary as this action effectively mitigates the remaining risk stemming from the prior exposure of the LastPass MFA/Federation database backup.
If you haven’t done so already, initiate a manual re-enrollment of MFA for non-federated customers. You can find the detailed instructions for doing so in ourSecurity Bulletin.
