LastPass has just announced significant updates to its account security protocols aimed at bolstering customer protection against the ever-evolving cyber threats.
The password management app has urged its users to update their master passwords, ensuring they meet recommended best practices for length and complexity.
The National Institute of Standards and Technology (NIST) guidelines advocate for passwords of at least 8 characters. However, LastPass now advocates for a minimum of 12 characters due to advancements in password cracking technology.
Since April 2023, new LastPass customers and existing ones who reset their passwords have been required to create or modify their master passwords to a minimum of 12 characters. By January 2024, all users will need to comply with this updated requirement.
Customers not meeting this criterion must create a new master password or update their existing one to align with the new policy. LastPass also provides guidelines to help users create secure and unique passwords resistant to hacking attempts.
The phased implementation of this policy will roll out across LastPass’ customer base, with various user groups receiving notifications at different times.
In addition to password changes, LastPass will initiate immediate checks on new or reset master passwords against a database of known breached credentials in the Dark Web. Passwords detected in prior breaches will prompt users to choose another password.
The company also emphasizes the importance of multi-factor authentication (MFA) re-enrollments. This action serves to mitigate risks from previous security incidents.
LastPass encourages users to manually re-enroll in MFA for non-federated customers, providing detailed instructions in their Security Bulletin. It assures its users that any requested actions or changes have a specific security purpose, and transparency remains a top priority for the company.
