Solved LastPass hit by new data breach - 4 steps you should take now

KevTech said:

LastPass also uses AES-256 bit encryption and operates on a zero-knowledge model but yet have had many breaches.

Click to expand...

Yes, but with 256-bit encryption, the vault would be safe.

KevTech said:

I suspect Bitwarden and 1Password will be the next targets it is just a matter of when.

Click to expand...

1Password was founded May 19, 2006. 1Password has never been breached in over 20 years. Even if it were breached, vaults are safe with AES 256-bit encryption.

KevTech said:

Online password vaults are just a centralized target for hackers and now with AI it may be getting easier to breach them.

Click to expand...

The odds of AES‑256 being “breached” in the cryptographic sense are effectively zero with any technology that exists today. No publicly known attack can break full‑round AES‑256 in any feasible amount of time, and every credible analysis shows that brute‑forcing a 256‑bit key is beyond the reach of all current and foreseeable computing.

KevTech said:

Online password vaults are just a centralized target for hackers and now with AI it may be getting easier to breach them.

Click to expand...

TraderGary said:

The odds of AES‑256 being “breached” in the cryptographic sense are effectively zero with any technology that exists today. No publicly known attack can break full‑round AES‑256 in any feasible amount of time, and every credible analysis shows that brute‑forcing a 256‑bit key is beyond the reach of all current and foreseeable computing.

Click to expand...

You also have to keep in mind if there is weaknesses in the programming code that can be exploited.
The encryption of Bitlocker wasn't cracked, they just found a way to decrypt it without the key.
Everything exposed to the internet with a lot of users are the target for hackers.

Marie SWE said:

You also have to keep in mind if there is weaknesses in the programming code that can be exploited.
The encryption of Bitlocker wasn't cracked, they just found a way to decrypt it without the key.
Everything exposed to the internet with a lot of users are the target for hackers.

Click to expand...

As you said, BitLocker was never decrypted. With Yellow-Key the hacker had to have physical access to a running system. Yellow-Key was patched in the last Patch Tuesday. I use BitLocker on all my devices with full confidence.

Marie SWE said:

I'm going to be the party pooper here.
Password protected word file sounds more secure then a Bitlocker protected USB drive.
Bitlocker and the word secure dont have any weight right now. (Yellow Key is the latest one) and this one is not the last one.

Click to expand...

I moved to Bitlocker from TrueCrypt in May 2014 (remember that?), and it's been nothing but good. The exploits over the last couple of years are all variations on a theme that doesn't affect people like me who use pre-boot authentication, in my case, a long password on my systems lacking a TPM, and on my systems with TPM, I use TPM+USB key. My USB keys are Apricorn Aegis Secure Keys, as it kind of defeats the purpose to store them on regular thumb drives IMO. People who are actually subject to this family of exploits can simply disable WinRE to defeat them. But the FUD will always propagate.

TraderGary said:

As you said, BitLocker was never decrypted. With Yellow-Key the hacker had to have physical access. Yellow-Key was patched in the last Patch Tuesday. I use BitLocker on all my devices with full confidence.

Click to expand...

you missing the point.... it was the exploit that gave access to the encrypted data.
This is do to bad coding. If MS had done it right it hadn't been possible.
There is unknown CVE's just waiting to be published July 2026 and then August, and then September.. and so on and on and on for decades to come, that no one know of right now... or even haven't been programmed yet(new software to come.)
This is the problem with all cloud based services...... if there is a hidden fault that can be exploited.. then we have a data breach.. and its not the encryption that will fail.. its a exploit (backdoor) to bypass the encryption that will be the problem.

barreleye said:

I moved to Bitlocker from TrueCrypt in May 2014 (remember that?), and it's been nothing but good. The exploits over the last couple of years are all variations on a theme that doesn't affect people like me who use pre-boot authentication, in my case, a long password on my systems lacking a TPM, and on my systems with TPM, I use TPM+USB key. My USB keys are Apricorn Aegis Secure Keys, as it kind of defeats the purpose to store them on regular thumb drives IMO. People who are actually subject to this family of exploits can simply disable WinRE to defeat them. But the FUD will always propagate.

Click to expand...

Back in 2014, i wasn't even on Tenforums and less on 11. So i do not remember that.

I have a thumb rule.. Never use the Eco system for security, as that is the first one they aim for/expect.. Windows/Bitlocker, Linux/Luks, MacOS/FileVault.
The attacker expect that the majority of users will use the default disk encryption and default AntiMalware software.

Marie SWE said:

you missing the point.... it was the exploit that gave access to the encrypted data.
This is do to bad coding. If MS had done it right it hadn't been possible.
There is unknown CVE's just waiting to be published July 2026 and then August, and then September.. and so on and on and on for decades to come, that no one know of right now... or even haven't been programmed yet(new software to come.)
This is the problem with all cloud based services...... if there is a hidden fault that can be exploited.. then we have a data breach.. and its not the encryption that will fail.. its a exploit (backdoor) to bypass the encryption that will be the problem.

Click to expand...

I've been running Microsoft operating systems for 45 years. I've used cloud OneDrive for close to 20 years. My security and backup strategy are in place. I'm not even remotely concerned with your projections.

TraderGary said:

I've been running Microsoft operating systems for 45 years. I've used cloud OneDrive for close to 20 years. My security and backup strategy are in place. I'm not even remotely concerned with your projections.

Click to expand...

That is good you trust Microsoft that they never will leak your data for all eternality, or give it to the government, or use it for AI training.

Marie SWE said:

That is good you trust Microsoft that they never will leak your data for all eternality, or give it to the government, or use it for AI training.

Click to expand...

Maybe he backs up sensitive data to OneDrive using password-protected Bitlockered VHDX files like me? Oh wait, people have heard of Bitlocker, so it's not usable in your book. lol

P.S. Please think before responding with more FUD you heard somewhere.

i dont use cloud services full stop. everything is stored and encrypted on my system.
if they target me then i know its personal.

best of luck Steve ..

barreleye said:

Maybe he backs up sensitive data to OneDrive using password-protected Bitlockered VHDX files like me? Oh wait, people have heard of Bitlocker, so it's not usable in your book. lol

P.S. Please think before responding with more FUD you heard somewhere.

Click to expand...

I would never keep sensitive data on a cloud that isn't proved is end-to-end encrypted. If the cloud provider have access or the chain is broken on the way there and back.. then its a security problem.

My sources i hear from is those that actually works in IT security as pentesters or defenders or is bug bounty hunters.
So FearUncertaintyDoubt isn't my way. If i hear something, i then check to verify or refute the information.

Edit
And onedrive is not end-to-end encrypted as Microsoft do have access to the information if they get served a court order to hand it out.

Marie SWE said:

I would never keep sensitive data on a cloud that isn't proved is end-to-end encrypted. If the cloud provider have access or the chain is broken on the way there and back.. then its a security problem.

My sources i hear from is those that actually works in IT security as pentesters or defenders or is bug bounty hunters.
So FearUncertaintyDoubt isn't my way. If i hear something, i then check to verify or refute the information.

Edit
And onedrive is not end-to-end encrypted as Microsoft do have access to the information if they get served a court order to hand it out.

Click to expand...

Looks like the bit I mentioned about storing Bitlockered VHDX files on OneDrive for sensitive data just whooshed right over your head. I mean this constructively - you don't have a grasp on any of this stuff that you're opining so strongly on.

barreleye said:

Looks like the bit I mentioned about storing Bitlockered VHDX files on OneDrive for sensitive data just whooshed right over your head. I mean this constructively - you don't have a grasp on any of this stuff that you're opining so strongly on.

Click to expand...

Yeah... use Bitlocker and Microsoft have the bitlocker keys on your MS account. You didn't think of that one.

Edit
Use Bitlocker and Proton Drive... Or use Veracrypt and OneDrive.
Never use the whole Eco system if you have sensitive data you dont even want the government to get their hands on.
Time for bed.. its soon 8AM over here

TraderGary said:

Yes, but with 256-bit encryption, the vault would be safe.

1Password was founded May 19, 2006. 1Password has never been breached in over 20 years. Even if it were breached, vaults are safe with AES 256-bit encryption.

The odds of AES‑256 being “breached” in the cryptographic sense are effectively zero with any technology that exists today. No publicly known attack can break full‑round AES‑256 in any feasible amount of time, and every credible analysis shows that brute‑forcing a 256‑bit key is beyond the reach of all current and foreseeable computing.

Click to expand...

Best of luck when the first quantum computer works

Marie SWE said:

Yeah... use Bitlocker and Microsoft have the bitlocker keys on your MS account. You didn't think of that one.

Edit
Use Bitlocker and Proton Drive... Or use Veracrypt and OneDrive.
Never use the whole Eco system if you have sensitive data you dont even want the government to get their hands on.
Time for bed.. its soon 8AM over here

Click to expand...

Again, LOL. Microsoft has never seen my Bitlocker keys and never will. You really should stop. You have worse than no understanding of this subject.

barreleye said:

Again, LOL. Microsoft has never seen my Bitlocker keys and never will. You really should stop. You have worse than no understanding of this subject.

Click to expand...

if you have one drive and a Microsoft account then MS has your encryption keys
there is no way around it if using bitlocker, whether its with your permission or not.

best of luck Steve ..

XxXxX said:

if you have one drive and a Microsoft account then MS has your encryption keys
there is no way around it if using bitlocker, whether its with your permission or not.

best of luck Steve ..

Click to expand...

Are you competing with that other guy to see who can write the most misinformation? Because it's a tight race if you are.

barreleye said:

Again, LOL. Microsoft has never seen my Bitlocker keys and never will.

Click to expand...

Microsoft does have your bitlocker recovery key if you use a Microsoft account and your device is attached to your account.

That's cute. Here's the reality I myself live in.

My Microsoft account, my only one, the one I'm signed into OneDrive with:



I've never had to remove a BitLocker key from my Microsoft account, either, not even a single solitary one in the 12 years I've been using BitLocker. That's because I don't choose to save them there when I encrypt a volume.

Below is a partial screenshot of my Bitlocker backup folder on my PC, which I sync with my Apricorn Aegis Secure Keys, which is where I save keys when encrypting a volume. Note the dates, 2014-2026, and the number of items, 129. I've been doing this a long time for many drives. I Bitlocker all my system and data drives along with the two sets of bare drives I use with a dock for backups. I've redacted things like PC names and GUIDs in the filenames, because while there's no harm in sharing them, I prefer not to.



People who actually understand this stuff might wonder what "BitLocker - Restore AutoUnlock after Image Restore.txt" is for. It contains somewhat cumbersome recovery instructions for restoring auto-unlock on data drives after restoring a system volume and re-encrypting it, a process that invalidates the data drive auto-unlock info. Note also the July 2014 date, which is not long after my May 2014 migration from TrueCrypt I mentioned earlier. I discovered later that this isn't necessary if I boot into Image For Windows TBWinRE environment and restore to an unlocked system volume; the unlocking can be done before rebooting to perform the restore or from within TBWinRE after rebooting with manage-bde. This makes BitLocker in WinRE encrypt the data on the fly, as it's being restored, and it doesn't mess up the auto-unlocking of data drives. I keep the instructions around just in case I mess up or can't restore this way for some reason.

Oh, and "! BitLocker External Keys.txt"? It contains a list of PCs, protection methods, and filenames for the .bek files associated with their encrypted system volumes.