LastPass

So password vaults and all that stuff is getting into.

We're not quite sure what all that means, but anybody get any additional comments on those things? And I know LastPass has been hacked a few times too.

I was going to ask you, Julian, because you sort of predicted this a while ago.

For you, is it coming to fruition in terms of

And then it's like, okay, then I finally find it.

What is the password? Did I put it in LastPass? Have I even logged in? Because I don't really know.

So then I'm like, well, I guess I can forget my password and then just go through that.

So now I'm like, all right, let's do this again.

And they're just super easy because you can share them with your VAs, and everybody can have access.

And also, I recommend setting up a password protection software called LastPass.

These days, it's really important to keep your accounts safe with two-factor authentication, and LastPass allows you to create the password using a very strong password generator tool.

And then after that, all you need to do is you can share it with the email address of your VA instead of having to show it directly to them through LastPass.

And if you ever need to change your password, that's easy.

And then through the actual platforms themselves, make sure that you set up two-factor authentication with the Authenticator app, the Google Authenticator app.

I would do that right away if you are using the Plex media server.

And I might remind you that the LastPass breach, the major one that happened several years ago, was due to a bug in a Plex server that was run by a LastPass developer who was working from home.

Bad guys got into his Plex server and then moved laterally in his home network to attack his work computer and then got all these credentials and the rest, as they say, is history.

Honestly, Plex has been shitified as far as I'm concerned.

One more thing I want to note here just generally, even if you're not running Plex, if you're running any sort of service on some box in your home, including your computer that is exposed to the internet, like Plex is in this case, realize that you are exposing your entire network to attack.

If there are holes poked in your firewall, for example, to allow somebody outside of your house to access something that's inside your home network, then if there's any bugs in that whatsoever, there are going to be automated systems out there from the bad guys that are looking for holes in firewalls, trying to identify what's behind that hole in the firewall, and then trying to compromise it.

And if they manage to compromise it, they will then, like they did in the LastPass thing, more than likely move laterally, because now they've got a beachhead inside your home network, and will try to find any other devices that are on your home network that they might be able to compromise.

So think very carefully about whether you want to expose something like that.

And because most small businesses, they're on Xero, QuickBooks, MYOB, which are cloud-based systems, then... making sure that they've got virus protectors on their computer and that you have a security protocol in place, which every business should have.

So we always advise our clients in our induction meeting that they should have something like LastPass, which is good for every family because if you are writing passwords down on a sheet of paper or on an Excel spreadsheet, there's no security over those.

But if you are...

I know what Crystal's password is for lots of things.

I've got different passwords for different things.

I use

LastPass, but I'm finding I have to be careful, like with Descript that I use for editing the radio shows.

Oh, yeah.

And there's a track record when it comes to exploiting Plex flaws.

A remote code execution bug in Plex Media Server was the likely entry point for the 2022 hack of a LastPass DevOps engineer's home computer.

That compromise cascaded into one of the worst password manager breaches ever.

Patch now before someone reverse engineers the fix and starts exploiting it.