nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Notes field encryption during September 2022 security incident

claudiu.diaconu

This question has been asked multiple times on this forum, without a confirmation from an official logmein account. Because the question has been asked numerous times, I will not further explain it here.

I understand that it's Christmas, however, at my work when we had catastrophes, I also had to work for Christmas. This is a catastrophe. Furthermore, it was your own willful decision to wait months to inform us about unencrypted fields just before the holidays when people are too busy packing up and leaving. Therefore, you will work on Christmas.

Please note that I'm looking for responses only from official logmein accounts.

Thank you.

Find more posts tagged with

Accepted answers

claudiu.diaconu

Since the lastpass team was busy for the holidays or under lawyer silence, I spent Christmas doing some research and found out that the notes section of each password is indeed encrypted as are the customized names of entries. I can say this with 85% certainty, as lastpass has mentioned it in this article:

https://support.lastpass.com/help/how-does-lastpass-protect-my-data

Furthermore, the user uploaded files such as images of credit cards and of important security documents, also seem to be encrypted. I can say this with 65% certainty, as lastpass mentioned it in this article:

https://www.lastpass.com/-/media/3c8c76e8e9be4ded8a0a207ddea610c8.pdf

I will now select my own response as the official answer to this question.

Keep in mind that based on the information in the above article, the hackers could know your name, email address, and all your URLs. Therefore, if you are a certain religion or work at a certain place and are married and on dating sites, please think about the percentage of the ransom that lastpass would have to help pay.

All comments

dabonz1965

Why you put your 2FA codes in your notes I have mine printed out and put in my file cabinet I have nothing in my notes ( Credit Cards,Bank Info,Addresses anything that can be breached)

My master password is like 5 football fields with every character and symbols that would take a billion years to crack even some plus and extra layer of security for my 2FA security . I have no breaches for my alias emails so I’m pretty confident that my passwords are protected and encrypted that’s my opinion

marceli.kubik

Hi, I also need to know this. I stored some passwords and other sensitive info (e.g. 2FA reset codes) in the Notes field in the password database (not only "Secure Notes"). So, they were exposed/leaked/copied regardless of the strength of the master password?

I have a feeling there is a big storm coming. LastPass is in mess and people in support may not know what is true and what to say or may have been instructed no to tell anything specific which can be used against the company. And no longer anybody cares.

I'm surprised there's so much info and comments on the net - the only one which I found and is pretty deep and technical is from Wladimir Palant who proved that cracking a master password even which is "strong" by LP standard may take months not years - kudos, man!

jepenny

What's the question?

claudiu.diaconu

My password does not have every character on the keyboard and is less than one football field long. However, according to lastpass, it should take a few million years to crack, which is a much shorter duration crack-time than yours.

Also, if yours will take 1 billion years to crack, why did you not store to 2FA codes and security questions in your notes? Did you not assume like the rest of us that notes in a secure password manager would be encrypted?

claudiu.diaconu

Since the lastpass team was busy for the holidays or under lawyer silence, I spent Christmas doing some research and found out that the notes section of each password is indeed encrypted as are the customized names of entries. I can say this with 85% certainty, as lastpass has mentioned it in this article:

https://support.lastpass.com/help/how-does-lastpass-protect-my-data

Furthermore, the user uploaded files such as images of credit cards and of important security documents, also seem to be encrypted. I can say this with 65% certainty, as lastpass mentioned it in this article:

https://www.lastpass.com/-/media/3c8c76e8e9be4ded8a0a207ddea610c8.pdf

I will now select my own response as the official answer to this question.

Keep in mind that based on the information in the above article, the hackers could know your name, email address, and all your URLs. Therefore, if you are a certain religion or work at a certain place and are married and on dating sites, please think about the percentage of the ransom that lastpass would have to help pay.