<story><title>What’s in a PR statement: LastPass breach explained</title><url>https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/</url></story><parent_chain><item><author>bikeformind</author><text>Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality.&lt;p&gt;not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastPass should shut down the  businesses, refund customers, and help them migrate to a new service? You are just not the organization for this job.</text></item></parent_chain><comment><author>hn_throwaway_99</author><text>I think the whole LastPass fiasco just shows why everyone wants to get into the SaaS business so bad - subscription revenue is the gift that keeps on giving.&lt;p&gt;LastPass has proven they have no business safekeeping anyone else&amp;#x27;s credentials. Anyone who cares a modicum about their security will have migrated off. But migrating off is a HUGE pain (people will need hours to update hundreds of passwords), and LastPass&amp;#x27;s announcement just days before Christmas was obviously done so that your average Joe would just miss it.&lt;p&gt;So LastPass will be able to continue collecting subscription revenue from users who were too busy or just not paying attention to the news, despite the fact that they really should be giving refunds to everyone who depended on their service.</text></comment>
<story><title>What’s in a PR statement: LastPass breach explained</title><url>https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/</url></story><parent_chain><item><author>bikeformind</author><text>Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality.&lt;p&gt;not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastPass should shut down the  businesses, refund customers, and help them migrate to a new service? You are just not the organization for this job.</text></item></parent_chain><comment><author>folkhack</author><text>&amp;gt; Lastpass has failed their fiduciary duty&lt;p&gt;I get where you&amp;#x27;re coming from, and ultimately agree. But I doubt anyone at LastPass on the business side agrees - to them this is just another PR snafu. The business continues to chug along regardless of how many catastrophic breaches they go through. I think they see these numerous issues as a cost of doing business vs. having a critical broken product offering.&lt;p&gt;Again I agree, but, I doubt they&amp;#x27;re going to change their ways this late in the game.</text></comment>