August 2016 Incident (opens in new tab)

Agreed 100%. With something like LastPass, they never actually have your enencrypted data at any point. So a logging bug (probably somebody logging the payload, etc. accidentally) wouldn't matter.

This is really concerning for a company that offers IAM as a service. IMO this is straight up incompetence.

Seems more likely that they use HTTPS and this is "just" an issue with cleartext logging (i.e. some server component logs unencrypted data after TLS termination).

Yeah, they have to because of how they work. As much as possible they do via SAML, and for that no plaintext is needed. But a lot of their customers want to log in to sites that don't support SAML (it's hard). For those they do form stuffing - naturally that requires plaintext.

Source: worked in the industry at a more security-focused company, had to explain to sales/support a few times why they can support a site but we can't.

That is my question too - how was an internal logging server not set for restricted login only from the internal subnet?

Also - they mentioned the perp got in via a compromised employee login. No clarification if it was a former disgruntled employee, or that a current employee had a weak password, or was social engineered into divulging it.

In any case, it points to bad internal policies and procedures around isolating servers and employee password management.

Very interesting. Do they really think that people use right click on the logo to get their logo?

Also, I use Cmd + Click more than right click -> open in new tab.