{"id":63789,"date":"2023-02-13T09:58:48","date_gmt":"2023-02-13T01:58:48","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=63789"},"modified":"2024-09-13T16:31:44","modified_gmt":"2024-09-13T08:31:44","slug":"the-lastpass-data-breach-and-how-nordpass-keeps-your-data-safe","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2023\/02\/the-lastpass-data-breach-and-how-nordpass-keeps-your-data-safe\/","title":{"rendered":"The LastPass Data Breach and How NordPass Keeps Your Data Safe"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\n

\"\"<\/p>\n

On December 22, 2022, LastPass announced that a data breach first disclosed in August 2022 was far more extensive than initially thought. The news sent shockwaves through the industry, leaving many password manager users \u2014 especially LastPass users \u2014 concerned about the security of their sensitive information.<\/p>\n

The breach serves as a stark reminder that no online service provider may be completely bulletproof breach-wise. So today, let\u2019s get into the LastPass data breach and what it means for NordPass users.<\/p>\n\n

The LastPass data breach breakdown<\/h2>\n

Cybercriminal activity has been on a steady rise for the last decade, and it looks that the trend is not about to change. In fact, today, cybercrime is the most lucrative criminal activity and is estimated to cost the world\u00a0$10.5 trillion annually<\/a>\u00a0by 2025.<\/p>\n

So as our personal and financial information is increasingly getting stored online, it is critical that companies take all necessary steps to protect their customers’ data. Unfortunately, the recent LastPass data breach shows that even well-known companies can fall short security-wise.<\/p>\n

The\u00a0company’s latest statement<\/a>\u00a0explains that an unauthorized party was able to access LastPass’ cloud-based storage environment and copy customer vault data along with information from a backup of customer account information.<\/p>\n

The extent of the breach is not yet clear, but it is likely that it included some personally identifiable data such as email addresses, phone numbers, and billing information for some users.<\/p>\n

The response from LastPass to the breach has been met with criticism from both industry experts and customers. In fact, it has already led to a\u00a0class-action lawsuit<\/a>, with one plaintiff alleging that the data breach resulted in the theft of around $53,000 worth of Bitcoin.<\/p>\n\n

Did the LastPass data breach affect all password manager users?<\/h2>\n

Let\u2019s be clear \u2014 the LastPass data breach does not have any direct effect on NordPass, its users, or users data.<\/p>\n

After all, we\u2019re two different companies and products with completely different security approaches and mindsets. However, we admit that seeing a competitor affected by a breach of this magnitude is an acute reminder to stay vigilant and prepared at all times.<\/p>\n\n

Is NordPass a secure place for your digital valuables?<\/h2>\n

Given the severity of the LastPass data breach, it\u2019s only natural that people are questioning the security of their password manager, including NordPass.<\/p>\n

First, one of the key elements of NordPass is that it is a zero-knowledge password manager equipped with an advanced encryption algorithm known as XChaCha20 to ensure protection of everything you store in NordPass.<\/p>\n

This means that all data stored in the NordPass vault is first encrypted on your device and only then sent to the cloud-based server. Because of the way NordPass is set up, it is only you \u2014 the user \u2014 who holds the decryption key and has access to everything stored in their vault.<\/p>\n

The NordPass team can\u2019t see or access anything. The same principle applies in situations of breaches. Even if a bad actor were able to get their hands on your vault data, they would still need your device, which holds the decryption key, to access the actual contents of the vault data.<\/p>\n

NordPass CTO Tomas Smalakys offers a more detailed explanation:<\/p>\n\n

\"quotes\"\n
<\/div>\n
\n

<\/p>\n

Each NordPass user has a unique public-key cryptography key pair. The Public Key is always stored in plaintext form. The Private Key, on the other hand, exists in plaintext form only on the user\u2019s end device for a limited period of time and never leaves it.<\/p>\n

When we need to store a user\u2019s Private Key, it\u2019s encrypted with secret-key cryptography (XChaCha20-Poly1305-IETF) on the user\u2019s device and only then passed to us. While the app is unlocked, the unencrypted Private Key is stored in the secure memory accessible only to the NordPass application. When the application is locked, either by the user or automatically after a set period of inactivity, the Private Key is deleted from the secure memory.<\/p>\n

For the user\u2019s Private Key encryption, the Master Key is used. The Master Key is derived from the Master Password and a 16-byte unique-per-user cryptographic salt using the key derivation function (Argon2id). We ask the user for the Master Password every time we need to decrypt the user\u2019s Private Key.<\/p>\n \n

– Tomas Smalakys<\/p>\n

NordPass CTO<\/p>\n<\/blockquote>\n<\/div>\n

Tomas further explains that in addition to the encryption principles above, every item (folder, password, credit card, etc.) has two types of data:<\/p>\n\n