'LastPass's claim of 'zero knowledge' is a bald-faced lie,' he says, alleging that the company has 'about as much knowledge as a password manager can possibly get away with.' LastPass claims its 'zero knowledge' architecture keeps users safe because the company never has access to your master password, which is the thing that hackers would need to unlock the stolen vaults.

He also highlights LastPass' admission that the leaked data included 'the IP addresses from which customers were accessing the LastPass service,' saying that could let the threat actor 'create a complete movement profile' of customers if LastPass was logging every IP address you used with its service.Īnother security researcher, Jeremi Gosney, wrote a long post on Mastodon explaining his recommendation to move to another password manager. Some of his criticisms deal with how the company has framed the incident and how transparent it's being he accuses the company of trying to portray the August incident where LastPass says 'some source code and technical information were stolen' as a separate breach when he says that in reality the company 'failed to contain' the breach. Here's an excerpt from the report: LastPass' December 22nd statement was 'full of omissions, half-truths and outright lies,' reads a blog post from Wladimir Palant, a security researcher known for helping originally develop AdBlock Pro, among other things. 'While the company insists that your login information is still secure, some cybersecurity experts are heavily criticizing its post, saying that it could make people feel more secure than they actually are and pointing out that this is just the latest in a series of incidents that make it hard to trust the password manager,' reports The Verge.

Last week, LastPass announced that attackers stole customer vault data after breaching its cloud storage earlier this year using information stolen during an August 2022 incident.

My vault lastpass