Two years after suffering a series of major beaches, LastPass has started implementing stricter password measures for its customers.
These include the requirement for all customers to use a master password with at least 12 characters.
This measure has been LastPass' default option since 2018.
In April 2023 it was made mandatory for new customers and existing customers who reset their master passwords.
Other existing customers, i.e. those who joined before April 2023 and had not changed their master password, could keep their shorter master passwords until now.
Although the current National Institute of Standards and Technology guidelines require that human-generated passwords be at least eight characters in length, recent advances in password cracking and brute-forcing technology and techniques mean that an even longer password is recommended, he continued.
LastPass provided a list of additional recommendations for customers needing to change their master password.
A master password longer than 12 characters is recommended.
Using at least one of each of the following: upper case, lower case, numeric, and special character values.
Making the new master password memorable, but not easily guessed Making sure that it is unique only to an individual and not reused anywhere else.
A phased rollout will be implemented from the end of January to progressively nudge customers to implement the new measure.
LastPass will also begin cross-checking its customers' new master passwords against a database of known breached credentials in order to ensure the password has not been previously exposed on the dark web.
The firm will also start prompting customers to re-enroll their multi-factor authentication with common authenticators like Microsoft Authenticator and Google Authenticator.
These new measures come after LastPass suffered multiple breaches in 2022, which saw an unauthorized party gain access to some of the company's data.
The series of incidents, extensively reported by Infosecurity Magazine, highlighted the importance of having a long and complex master password when using a password manager.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Thu, 04 Jan 2024 17:00:23 +0000