Newsgroup: it.comp.sicurezza.varie
Titolo: LastPass Security Notice

 
https://blog.lastpass.com/2015/06/lastpass-security-notice.html/
 
 
June 15th, 2015
LastPass Security Notice
 
We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.
We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.
Nonetheless, we are taking additional measures to ensure that your data remains secure. We are requiring that all users who are logging in from a new device or IP address first verify their account by email, unless you have multifactor authentication enabled. As an added precaution, we will also be prompting users to update their master password.
An email is also being sent to all users regarding this security incident. We will also be prompting all users to change their master passwords. You do not need to update your master password until you see our prompt. However, if you have reused your master password on any other website, you should replace the passwords on those other websites.
Because encrypted user data was not taken, you do not need to change your passwords on sites stored in your LastPass vault. As always, we also recommend enabling multifactor authentication for added protection for your LastPass account.
Security and privacy are our top concerns here at LastPass. Over the years, we have been and continue to be dedicated to transparency and proactive measures to protect our users. In addition to the above steps, we're working with the authorities and security forensic experts.
We apologize for the extra steps of verifying your account and updating your master password, but ultimately believe this will provide you better protection. Thank you for your understanding and support.
Joe Siegrist
& the LastPass Team
 
Frequently Asked Questions
Why haven't I been notified by email? Emails are being sent to all users regarding the security incident. While this takes a bit longer than posting on the blog, we are working to notify users as fast as possible.
 
Do I need to change my master password right now? LastPass user accounts are locked down. You can only access your account from a trusted IP address or device - otherwise, verification is requested. We are confident that you are safe on your LastPass account regardless. If you've used a weak, dictionary-based master password (eg: robert1, mustang, 123456799, password1!), or if you used your master password as the password for other websites you need to update it.

 passwords on those other websites. Because encrypted user data was
 
sempre la stessa vecchia storia
 
https://xkcd.com/936/
 
 
https://xkcd.com/792/
 
 
 

 
https://xkcd.com/792/
 
 
E anche l'avviso di non riutilizzare password usate altrove,
non l'ho visto spesso.



per come la vedo io, quelle due "strisce" di xkcd andrebbero stampate
ed affisse in posizione visibile in qualsiasi azienda/organizzazione :)
 

 ed affisse in posizione visibile in qualsiasi azienda/organizzazione :)
 
No no, userebbero tutti "correcthorsebatterystaple" come password ;)

It was Thu, 25 Jun 2015 06:15:42 -0700 (PDT) when

uffaaaa :) oh, comunque... totalmente OT, ma nel caso non la conoscessi
 
http://map.ipviking.com/
 
 
passa un paio di minuti a dare un'occhiata e, magari, prova a lasciare
il puntatore del mouse sopra uno dei "bersagli" sulla mappa ;-)
 

 il puntatore del mouse sopra uno dei "bersagli" sulla mappa ;-)
 
Bello!
Se tra gli Attack Targets passo il mouse su Mil/Gov, mostra un punto
al largo della costa africana!