{"id":16757,"date":"2022-08-31T08:49:44","date_gmt":"2022-08-31T06:49:44","guid":{"rendered":"https:\/\/www.m-q.ch\/?p=16833"},"modified":"2024-11-22T07:52:47","modified_gmt":"2024-11-22T06:52:47","slug":"lastpass-is-password-manager-yet-to-be-recommended","status":"publish","type":"post","link":"https:\/\/www.organisator.ch\/en\/operational-excellence\/2022-08-31\/lastpass-sind-passwortmanager-noch-zu-empfehlen\/","title":{"rendered":"LastPass: Are password managers still recommended?"},"content":{"rendered":"
\"LastPass\"\r\n
Despite recently discovered security vulnerability in a widely used password manager, such systems are recommended for password management. (Image: Pixabay.com)<\/figcaption>\r\n<\/figure>\r\n

Last week, the well-known and widely used password manager LastPass reported a Security gap<\/a>. According to the company, the security breach occurred two weeks earlier, when attackers broke into the system where LastPass stores the source code of its software. From there, the attackers stole parts of the source code and some proprietary technical information from LastPass. The cybercriminals rifled through the company's proprietary source code and intellectual property, but apparently did not get their hands on customer or employee data. This has now led to questions from concerned users: Are password managers still useful? Experts from IT security service provider Sophos comment as follows:<\/p>\r\n

If I use LastPass, should I change all my passwords?<\/strong><\/h3>\r\n

Users can, of course, change some or all of their passwords if they wish. However, according to reports, this security incident has nothing to do with the cybercriminals getting hold of personal data, let alone passwords, which are not stored in usable form on LastPass' servers anyway.<\/p>\r\n

As a LastPass user, should I switch to another solution?<\/strong><\/h3>\r\n

The fact is, according to LastPass, that neither personal nor password-related data (encrypted or otherwise) was stolen, but only source code and proprietary information of the company itself. A company's cybersecurity trustworthiness should be based on how it responds when a bug or vulnerability occurs, especially if the company's mistake did not directly and immediately endanger users. It is recommended that the LastPass incident report and the FAQ<\/a> read and decide on further trust on this basis.<\/p>\r\n

Doesn't stolen source code mean that hacks and exploits are bound to happen?<\/strong><\/h3>\r\n

Source code is much easier to read and understand than a compiled, \"binary\" equivalent, especially if it is well commented and uses meaningful names for things like variables and functions within the software. In other words, this source code leak might help potential attackers a little, but firstly almost certainly not as much as one might initially think, and secondly not to the extent that new attacks become possible that could never have been found out without the source code.<\/p>\r\n

Should I dispense with password managers altogether?<\/strong><\/h3>\r\n

Fundamental concerns would be justified if password managers stored exact copies of all passwords on their own servers, where they could be read by attackers or queried by law enforcement. But no reasonable cloud-based password manager works that way.<\/p>\r\n

Why should I use a password manager?<\/strong><\/h3>\r\n