Ask Leo! #554 – More Windows 10, Your Digital Afterlife, Yes, We’re Having Fun, and more…

Leo

I have read that win 7 8 home machines set for auto updates will have 10 installed automatically. Profesional and Pro will not. Can you comment?

Keep up the good information outlet. Love it.

Bill

I think that you're confusing two issues.

No one will have Windows 10 installed automatically. Period. You'll have to at least OK it, and possibly actively ask for it.

Once Windows 10 is installed: Home editions of Windows 10 will take Windows updates automatically. That's new. Pro and better will still allow you to defer updates to a time more convenient. That's as it's always been.

You say "no user accounts have been hacked, and no unencrypted user account information has been compromised", but that's not what LastPass said. They said "No encrypted user vault data was taken, however other data, including email addresses and password reminders, was compromised". The implication is that they found no evidence of loss of user data, since they do not say their systems properly monitor if something is taken or not. Nor do they say what "compromised" means.

One potential concern is they and possibly you have vested interests in playing things down. I note your account is less alarming than the one from LastPass. Can you say you have no interest in the matter; perhaps you should say that either way?

If the vaults were not 'compromised', why are they suggesting a change of master password? What do they mean, "to be on the safe side".

How could users have an unbiased account of the status of the security of their data?

Regards,

Mike

Not sure what you're looking for from me. I have no vested interest in LastPass, and if you choose to move to a different system I certainly won't object. My comments stem from the fact that I believe that, while this is of course serious - any breech is - there's actually little impact on users of LastPass. By that I mean that you and I are not at any significantly additional risk than we were before the hack. My frustration is that the general technology press likes to make end-of-world headlines and thus overstate the impact (or at least imply that the impact is far greater than it actually is). As a result, people - people that visit Ask Leo! - panic and make ill-concieved decisions based on inaccurate information.

The hashes of user's master passwords were stolen. (https://glossary.askleo.com/hash/) That is NOT NOT NOT the same as actually having the password - which were NOT stolen because LastPass doesn't store your password - only the hashed value of the password. Having the hash does not allow the hackers to gain access to your LastPass account.

With one exception: if your master password was WEAK - as in, say, one of the top 1,000,000 most common passwords in general, then **in theory** the hackers could mount some kind of a brute force attempt to determine your passwords. This is still extremely unlikely, given the hashing algorithm that LastPass uses. But since the theory exists, it is easily thwarted by changing your master password. This completely invalidates the hash value the hackers have in their hands. So "to be safe" means doing that, and also making sure at the same time you choose a sufficiently lengthy/complex password when you do it.

But, like I said, if you don't feel convinced, then absolutely switch to another password manager. Find one you trust.

I trust LastPass. Still.