Technologies

What LastPass Subscribers Need to Do After the Latest Breach

Following the latest breach, you might want to find a new password manager.

LastPass, one of the world’s most popular password managers, is yet again under the microscope after its latest security breach.

In late December, LastPass CEO Karim Toubba acknowledged that a security incident the company first disclosed in August had ultimately paved the way for an unauthorized party to steal customer account information and vault data. This is the latest in a lengthy string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party now has access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party also has a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have saved in their vaults. If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager because your passwords and personal data are at risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»

At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Scouts Can Now Earn a Merit Badge for AI

Scouting America has also created an AI chatbot to explain the requirements for the different merit badges.

Scouts are doing more than tying knots, building fires and learning first aid. Scouting America has added artificial intelligence and cybersecurity to its lineup of merit badges, keeping the 115-year-old organization in step with modern technology.

Scouting America is the youth organization that was known as Boy Scouts of America before 2019, when it changed its name to Scouts BSA and allowed girls to join all-girl troops. In February, the organization changed its name to Scouting America to reflect a more-inclusive philosophy.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

The AI merit badge «will introduce scouts to the fundamentals of AI and automation through hands-on activities and real-world examples,» according to Scouting America’s website, while the cybersecurity merit badge «equips Scouts with essential knowledge and skills to navigate and protect the digital world.»

While many of the merit badges seen on individual Scouts’ iconic sashes focus on hands-on experiences, often in the outdoors — such as fire safety and insect study — Scouting America says the new additions are relevant to modern life.

«Both badges focus on real-world practice, not just reading about technology,» Scouting America said in a statement. «The AI badge gets Scouts thinking about how to use technology responsibly. The cybersecurity badge teaches actual security skills along with safe online habits.»

Scouting America added another modern twist. The organization recently released an AI chatbot named Scoutly that can share the requirements for the various merit badges, among other tasks. Scouts can earn more than 130 badges in different subjects.

Scouting America is the largest scouting organization and one of the largest youth organizations in the United States, with over 1 million youth, including nearly 200,000 female participants.

Technologies

The Ultimate AI Wearable Is a Piece of Tech You Already Own

Commentary: Tech companies are trying to give us dedicated AI devices. There’s no need — we all have them already.

In some quarters, the rise of AI has sparked the urge to invent all-new devices, which are deeply invested in that technology but which look and function differently from any products we’ve owned before.

These range from head-mounted XR devices, such as headsets and glasses, to pins, necklaces, phone accessories and whatever mystery product former Apple designer Jony Ive and OpenAI are developing in secret.

But what if, in pursuit of these new devices, we overlook the fact that the ultimate AI form factor is something we all already own? It could even be that the best way to deploy AI is through tech that dates back to the 19th century.

I’m talking about headphones.

There hasn’t been a lack of evolution in personal audio over the years, but integrating AI into headphones is giving them a new lease on life, says Dino Bekis, vice president of wearables at chipmaker Qualcomm. We’re starting to see this with devices like Apple’s new AirPods Pro 3.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

The impact of AI on headphones will be twofold, says Bekis. First, it will build on improvements we’ve already seen, such as the ability to easily switch among active noise cancellation, transparency and other listening modes.

Instead of that being something we need to control manually, the headphones themselves will increasingly handle it all dynamically. Sensors on board, layered with AI, become more adept at reading and understanding our immediate surroundings.

Bekis says that maybe your headphones could alert you to someone trying to get your attention by recognizing your name being called, even if you’re listening to music with ANC enabled. If you’re on a call, walking along a busy street, they could alert you to traffic dangers, sirens or someone who might be walking close behind you.

But where he really sees AI headphones coming into their own is in the interactions you’ll have with AI agents. These personal assistant-like versions of artificial intelligence will operate autonomously with our devices and services on our behalf.

There’s no more «natural way» than conversation to interact with them, he says, and the high-quality mics and speakers in your headphones will allow for clear and effective communication.

«Earbuds or headphones are really yesterday’s technology that’s suddenly been reinvented and is becoming the primary way we’re going to be interfacing with agents moving forward,» says Bekis.

Headphone-makers, meet AI

Not all headphones are on the verge of transforming into wearable AI assistants, and the situation is not the same across the board. Many legacy headphone companies are «entrenched in their core focus of audio quality and audio file capability,» says Bekis.

At the same time, Bekis says Harman-owned high-end audio brand Mark Levinson is one headphone maker Qualcomm is working with on integrating AI into its products. And smartphone manufacturers who also have audio products in their lineup are at the forefront of the charge.

You only need to look at the new capabilities that Samsung, Google and Apple have bolstered their headphones with over the past few years. In addition to adaptive audio, the companies are starting to add AI-specific features. Google’s Pixel Buds 2 are engineered not just as an audio device but as hardware with the company’s Gemini AI assistant at the core (you could say «Hey, Google» to activate Gemini and ask it to summarize your emails, for example).

In September, Apple introduced AI-powered live translation with the AirPods Pro 3. The AirPods will parse what someone is saying to you and play it in your chosen language in your ear. They will also pick up your speech and translate it so that you can show the other person a transcript in their language on your phone screen.

Apple also seems to be searching for ways to further tap the AI potential of its headphones range. A report from Bloomberg earlier this month suggested that the company might introduce AI-powered infrared cameras with the next version of the AirPods Pro, which could be activated by and respond to gestures.

It’s clear that smartphone-makers can see the potential in headphones to be more than just audio products, in the same way they once recognized that the phone could be more than simply a device for making calls. They might even turn headphones and earbuds into what I think could be the ultimate AI wearable.

Why headphones?

The biggest argument for headphones over other emerging AI-focused wearable tech is their popularity: Who doesn’t own at least one pair? (My feeling is that everyone should own at least three different styles, each with its own strengths.) It’s just not the same with glasses or watches.

Yes, they are common and familiar, but the likelihood is that if you don’t already wear them regularly, the addition of AI is unlikely to persuade you. Glasses, in particular, have drawbacks, including battery life. There’s also the difficulty of combining the tech with prescription lenses and privacy concerns due to the addition of cameras.

After well over a decade of effort, tech companies are also still struggling to make smart glasses as sleek and comfortable to wear as their non-smart counterparts (the Meta Ray-Bans perhaps being the one exception to the rule here).

Smartwatches and fitness bands, meanwhile, have become more comfortable, but many people still find them cumbersome for sleeping. The sensors in them are too far away from our faces, where we receive the majority of our sensory inputs, to comprehend the world around us with forensic detail. They cannot relay sensory feedback to us without us having to look at a screen. The same is true for rings and other smart jewelry.

There are no devices that rival headphones, and earbuds in particular, for sheer proximity to a major sensory organ capable of both inputting and outputting complex sensory data. They have been and remain discreet, easy to take on and off, and not overly power hungry or demanding when it comes to charging frequency.

«Critically, there’s the social acceptance level of this as well, where, ultimately, headphones have become incredibly commonplace,» says CCS Insight Analyst Leo Gebbie.

They don’t insert a noticeable barrier between you and the world you’re experiencing. Plus, even when they’re obvious, they don’t tend to put people on edge over concerns you could be capturing their image, and you don’t need to learn how to use them, Gebbie says.

«Contrast that with something like smart glasses, where I think there is a whole new set of user behaviors that would need to be learned in terms of exactly how to interact with that device,» he says. «Also, there’s kind of a social contract, which, for me, at least with smart glasses, has always been one of the biggest stumbling blocks.»

What’s more, headphones have been getting gradually smarter all this time without most of us even noticing.

This invisible evolution is the closest tangible expression I’ve seen of the widespread belief among tech leaders that AI should be a subtle, ambient force that permeates our lives as inconspicuously as possible.

Headphones are an established product that shows consistent growth, making them the safest bet for companies that want as many people as possible to engage with AI through wearable tech.

Multiple forecasts, including from SNS Insider and Mordor Intelligence, estimate the global market for headphones will grow to over $100 billion by the early 2030s. By contrast, Mordor forecasts the smart glasses market will grow to $18.4 billion in the same period, one of the higher estimates I found.

Companies are always searching out new revenue streams, hence their determination to explore new kinds of AI devices, says Gebbie. But, he adds, «headphones definitely feel like a safer bet, because it’s a form factor that people are familiar with.»

It may well be the case that no single wearable device will define our coexistence with AI, and if there is, it will be a device of our choosing.

But rather than reinvent the wheel, I strongly suspect the companies embracing the potential of headphones will see these formerly audio-focused devices fly in the age of AI. And perhaps it’s just personal preference, but I’m on board.

Technologies

Phone Plugged in 24/7? Experts Reveal the Science Behind Battery Damage

Phone batteries degrade over time, but heat and use habits are a larger danger than keeping your phone plugged in.

There was a time when smartphone users were warned not to leave their phones plugged in for too long, or it could do damage to the battery. While modern smartphones now have overcharge protection that keeps them safe, many people still have questions about whether keeping their phone perpetually plugged in will damage the battery.

The short answer is no. Keeping your phone plugged in all the time won’t ruin your battery. Modern smartphones are built with smart charging systems that cut off or taper power once they’re full, preventing the kind of «overcharging damage» that was common in older devices. So if you’re leaving your iPhone or Android on the charger overnight, you can relax.

That said, «won’t ruin your battery» doesn’t mean it has no effect. Batteries naturally degrade with age and use, and how you charge plays a role in how fast that happens. Keeping a phone perpetually at 100% can add extra stress on the battery, especially when paired with heat, which is the real enemy of longevity.

Understanding when this matters (and when it doesn’t) can help you make small changes to extend your phone’s lifespan.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

The science behind battery wear

Battery health isn’t just about how many times you charge your phone. It’s about how it manages voltage, temperature and maintenance. Lithium-ion batteries age fastest when they’re exposed to extreme levels: 0% and 100%.

Keeping them near full charge for long stretches puts additional voltage stress on the cathode and electrolyte. That’s why many devices use «trickle charging» or temporarily pause at 100%, topping up only when needed.

Still, the biggest threat isn’t overcharging — it’s heat. When your phone is plugged in and running demanding apps, it produces heat that accelerates chemical wear inside the battery. If you’re gaming, streaming or charging on a hot day, that extra warmth does far more harm than leaving the cable plugged in overnight.

Apple’s take

Apple’s battery guide describes lithium-ion batteries as «consumable components» that naturally lose capacity over time. To slow that decline, iPhones use Optimized Battery Charging, which learns your daily routine and pauses charging at about 80% until just before you typically unplug, reducing time spent at high voltage.

Apple also advises keeping devices between 0 to 35 degrees Celsius (32 to 95 degrees Fahrenheit) and removing certain cases while charging to improve heat dissipation. You can read more on Apple’s official battery support page.

What Samsung (and other Android makers) do

Samsung offers a similar feature called Battery Protect, found in One UI’s battery and device care settings. When enabled, it caps charging at 85%, which helps reduce stress during long charging sessions.

Other Android makers like Google, OnePlus and Xiaomi include comparable options — often called Adaptive Charging, Optimized Charging or Battery Care — that dynamically slow power delivery or limit charge based on your habits. These systems make it safe to leave your phone plugged in for extended periods without fear of overcharging.

When constant charging can hurt

Even with these safeguards, some conditions can accelerate battery wear. As mentioned before, the most common culprit is high temperature. Even for a short period of time, leaving your phone charging in direct sunlight, in a car or under a pillow can push temperatures into unsafe zones.

Heavy use while charging, like gaming or 4K video editing, can also cause temperature spikes that degrade the battery faster. And cheap, uncertified cables or adapters may deliver unstable current that stresses cells. If your battery is already several years old, it’s naturally more sensitive to this kind of strain.

How to charge smarter

You don’t need to overhaul your habits but a few tweaks can help your battery age gracefully.

Start by turning on your phone’s built-in optimization tools: Optimized Battery Charging on iPhones, Battery Protect on Samsung devices and Adaptive Charging on Google Pixels. These systems learn your routine and adjust charging speed so your phone isn’t sitting at 100% all night.

Keep your phone cool while charging. According to Apple, phone batteries perform best between 62 and 72 degrees Fahrenheit (16 to 22 degrees Celsius). If your phone feels hot, remove its case or move it to a better-ventilated or shaded spot. Avoid tossing it under a pillow or too close to other electronics, like your laptop, and skip wireless chargers that trap heat overnight.

Use quality chargers and cables from your phone’s manufacturer or trusted brands. Those cheap «fast-charge» kits you find online often deliver inconsistent current, which can cause long-term issues.

Finally, don’t obsess over topping off. It’s perfectly fine to plug in your phone during the day for short bursts. Lithium-ion batteries actually prefer frequent, shallow charges rather than deep, full cycles. You don’t need to keep it between 20% and 80% all the time, but just avoid extremes when possible.

The bottom line

Keeping your phone plugged in overnight or on your desk all day won’t destroy its battery. That’s a leftover myth from a different era of tech. Modern phones are smart enough to protect themselves, and features like Optimized Battery Charging or Battery Protect do most of the heavy lifting for you.

Still, no battery lasts forever. The best way to slow the inevitable is to manage heat, use quality chargers and let your phone’s software do its job. Think of it less as «babying» your battery and more as charging with intention. A few mindful habits today can keep your phone running strong for years.