LastPass hacked: How to export and protect your passwords

LastPass is not any stranger to information breaches. It’s suffered a number of high-profile leaks, with the newest (and alarming) incident taking place simply final yr. When information first broke in August, the developer assured everybody that clients had been unaffected. But in a whole reversal, the company’s December updates were grim—buyer information had been taken in spite of everything. 

If you’re feeling such as you wish to depart the service, you may hardly be blamed. In this newest breach, not solely was personally figuring out data like billing addresses, phone numbers, and IP addresses stolen, however vault information as nicely. Most damning: Some of that vault information was unencrypted.

The excellent news is that exporting your information is fast and comparatively easy. You get your complete vault in a single file you could then use to add to a new password manager.

Here’s find out how to export your passwords from LastPass—and find out how to do securely. Plus, what it is best to do afterward to make sure the protection of all of your on-line accounts.

How to export your LastPass passwords

Getting your passwords out of LastPass is definitely very straightforward. More sophisticated is making certain the exported file stays safe. LastPass exports in both CSV and XML file codecs, and people file sorts aren’t encrypted.

You don’t need your passwords downloaded as plain textual content—even for those who delete the file, it may be recoverable on an unencrypted drive. And many individuals haven’t encrypted the drives on their PC.

The much less complicated methodology is to obtain the file to a drive fully encrypted by Windows, then completely deleting it as quickly as you’re carried out importing your information elsewhere. (Leaving it within the Recycling Bin means the file is out there and unencrypted everytime you’re logged into your laptop.) This just isn’t a bulletproof methodology, as you may get better the info whereas logged into your PC, however it’s a good center floor.

If you may tolerate slightly extra effort, I like to recommend creating an encrypted folder using VeraCrypt, then downloading exported vault information to that location. It acts like a protected for the file. Your information solely turns into accessible when the container is unlocked. When you’re carried out, simply delete the entire set whereas locked; if the container’s password is rarely shared, the dear information inside ought to stay safe.

Once you will have your safety precautions set, observe these steps to get your information out of LastPass, both through the online interface or the browser extension.

Note: If you’re utilizing a free account that’s tied to cellular gadgets solely, it is best to be capable to export through the online. If not, a workaround is to start out a paid trial, so that you just quickly get multidevice entry.

How to export from LastPass through the browser extension

Step 1: Access your account settings

PCWorld

• Open the browser extension, then click on on the account icon.

Step 2: Dig into the “Fix a problem” menu choices

PCWorld

• Choose Fix an issue your self.

Step 3: Export your vault objects

PCWorld

• Click on Export vault objects. Your file will instantly start downloading.

Reminder: The downloaded file might be in an unencrypted format. Anyone with entry to the file can see all your passwords. For a safe option to obtain the file, see the notes firstly of this part.

Your file can now be imported into a brand new password supervisor (both one other cloud-based service or software program put in to your laptop). The course of must be easy, however for those who run into any points, you may search for your new service’s assist pages for directions.

How to export from LastPass through the online interface

Step 1: Access the Advanced Options

PCWorld

• In the left nav bar, click on on the icon for Advanced Options. It must be the second from the underside.

Step 2: Choose Export

PCWorld

• Under Manage Your Vault, select Export. A inexperienced banner will pop up on the prime of the web page, instructing you to examine your e-mail.

Step 3: Verify the export request

PCWorld

• Log into the e-mail deal with related along with your account. Open the e-mail from LastPass and click on on the Continue export hyperlink inside. A browser tab ought to open, saying that the export is prepared.

Step 4: Enter your login information to start obtain

PCWorld

• Go again to Advanced Options > Export. To start the obtain, enter your consumer identify and password.

Reminder: The downloaded file might be in an unencrypted format. Anyone with entry to the file can see all your passwords. For a safe option to obtain the file, see the notes firstly of this part.

You can now import this file into a brand new password supervisor (be it one other cloud-based service or a chunk of software program put in to your laptop). It must be a simple course of, however for those who run into difficulties, your new service ought to have assist pages with directions.

You’re not carried out but, sadly

Usually, leaving a password supervisor for one more one is easy. You export your passwords from the outdated service, import the data into your new service, after which return to your life.

Ditching LastPass due to its breach makes issues extra sophisticated. Because hackers have your vault information, your grasp password is the one factor standing between them and entry to your accounts. To guarantee your safety, you’re finest off altering the passwords in your vault. 

Hopefully you had a powerful random grasp password, which can make brute forcing entry into the vault very troublesome. But there’s no method round this one if you wish to be certain you’re protected. You can’t change your LastPass grasp password and be carried out—the vault information captured is linked to the grasp password you had on the time of the hack. Updating it now received’t assist.

istockphoto.com/ManuelSousa

With lots of of passwords part of our each day lives, this activity is not any fast feat. Our suggestion? Work in graduated steps:

1. Move to the brand new password supervisor
2. Immediately change the entire passwords for important companies—banks and different monetary establishments, tax preparation, authorities applications, and so on. Anything that may very well be ruinous if somebody bought maintain of these accounts. 
3. Work your method by the rest of your passwords, beginning with those who have extra delicate information saved (i.e., bodily addresses, beginning dates, bank card numbers). Now’s a superb time to additionally wipe that information from web sites; preserve it in your password supervisor as an alternative.

You wish to do that after you permit LastPass, particularly for those who’re involved about remaining safety vulnerabilities the corporate has but to detect. This breach just isn’t LastPass’s first—and given the corporate’s historical past, possible not its final, both. 

(Whether LastPass is that significantly better at transparency, has that rather more problem sustaining safety, or is only a greater goal usually is a query to be answered one other time.) 

Whatever you do, don’t abandon password managers all collectively. Security on-line is imperfect, and so the options for it are additionally imperfect—however some methods are way more flawed than others. Reusing passwords, utilizing weaker passwords, writing them down in a pocket book—these received’t preserve you protected. You can discover a good password manager (and a system of use) that works for you.