With news breaking on Monday, April 7th that the
Heartbleed bug causes a vulnerability in the OpenSSL cryptographic library, which is used by roughly two-thirds of all websites on the Internet, we want to update our community on how this bug may have impacted LastPass and clarify the actions we’re taking to protect our customers.
In summary, LastPass customers do not need to be concerned about their LastPass accounts. Though LastPass employs OpenSSL, we have multiple layers of encryption to protect our users and never have access to those encryption keys.
What is the Heartbleed Bug?
The Heartbleed bug is a vulnerability in the OpenSSL cryptographic library that allows stealing of information normally protected by the SSL/TLS encryption used to secure the Internet. OpenSSL is open-source software that is widely used to encrypt web communications. SSL/TLS is what normally provides secure and private communication over the Internet via websites, email, IM, and VPNs.
According to CNET, an attacker can exploit Heartbleed to essentially “get copies of a server's digital keys then use that to impersonate servers or to decrypt communications from the past or potentially the future, too.”
Heartbleed is being taken so seriously because OpenSSL is widely used, essentially no servers locally encrypt their data the way LastPass does, and it’s been exploitable for some time.
How does it affect LastPass?
LastPass utilizes OpenSSL for HTTPS/TLS/SSL encryption and we were therefore “vulnerable” to this bug. For anyone who was using this tool:
http://filippo.io/Heartbleed/#lastpass.com to check whether LastPass was vulnerable, it would have shown that we were vulnerable until this morning, when we restarted our servers after the patched OpenSSL software update.
However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern.
Also, LastPass has employed a feature called “perfect forward secrecy”. This ensures that when security keys are changed, past and future traffic also can’t be decrypted even when a particular security key is compromised.
Our next stepsThis bug has been out there for a long time, so we have to assume our SSL keys could have been compromised. We requested a reissued certificate this morning, and plan to roll it out today, while we’ve already deployed the OpenSSL software update after restarting our servers this morning.
LastPass customers should not be affected by the certificate transition, we expect it to be seamless with no interruptions to service.
Because other websites may not be encrypting data the way LastPass does, we recommend that LastPass users generate new passwords for their most critical sites (such as email, banking, and social networks) if those sites utilize Apache, Nginx or show as vulnerable to the Heartbleed bug. However, users should wait until their sites have replaced their certificates, with a start date after today (April 8th, 2014). For more information on replacing passwords with newly-generated ones, please
see this article.
Thank you to our community for your vigilance, and we’ll provide further updates if there are any changes to the situation.
Update: April 8th, 4:46PM ETWe have built a tool to help LastPass users check whether other sites and services they use may have been affected by Heartbleed, you can check it out at:
https://lastpass.com/heartbleedThe new SSL certificates for LastPass and Xmarks have been reissued as well.
Update: April 9thLastPass now alerts you if the sites stored in your vault may be impacted by Heartbleed. See our new blog post for more details:
http://blog.lastpass.com/2014/04/lastpass-now-checks-if-your-sites-are.html Update: April 10th, 2:29PM ETMany users are still concerned about what the Heartbleed situation means for their LastPass master passwords. To further clarify, we do not see a need at this time for LastPass users to update their master passwords. That said, if you would prefer to, there is no harm in doing so. We continue to update our LastPass Security Check tool to provide you the latest information regarding impacted sites. Thanks to our community for the feedback and input.
Pope Francis has called on the UN to do more to help the poor and encourage the "legitimate redistribution" of wealth.
A Bethesda revelou hoje um novo trailer com gameplay do jogo "Wolfenstein: The New Order". O vídeo começa com imagens do Brasil de 1950 e cenas de uma partida de futebol, mas o cenário e a época são, provavelmente, só pra contextualizar o game: ele se passa em um mundo...
Google has a new patent application with the USPTO (via 9to5Google), which takes one of the basic concepts of Glass and extends it even further, embedding tiny cameras that could be embedded in contact lenses for various uses, including photographing what a wearer sees, or providing the basic input for a contact-based assistive device for the visually impaired. Google has previously detailed a… 
It's been fascinating to watch news of heartbleed, the massive OpenSSL exploit, spread on the web. After years of quietly putting us at risk, the general web user became aware of the exploit only a few days ago, and probably via heartbleed.com. 
O Netflix começou a transmissão de conteúdos em 4K, e os primeiros programas disponíveis na resolução são a 2ª temporada House of Cards e documentários sobre a natureza. Só que o recurso estará disponível apenas para certas TVs Ultra HD, que tenham codificador HEVC (H.265) embuti...
