While you’re at it, we recommend that you enable multifactor authentication for your LastPass account. Enable MultiFactor Authentication for LastPass # During the process, LastPass will re-encrypt everything, and send you a verification email that you changed the master. That will bring you to the Password Reset page where you can simply follow the onscreen instructions to change your master password.

Then in the Account Settings window click Change Master Password under the Login Credentials section.

To change your master password, and click Account Settings from the left pane. At the time of this writing, I haven’t received one, and by the looks of the comments on the LastPass blog, neither have a lot of other users. As the company also said in its post that emails are being sent to all users about the security incident. One thing that’s rather irritating to a lot of users is that they are finding about this news on websites. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. We are confident that our encryption measures are sufficient to protect the vast majority of users. As an added precaution, we will also be prompting users to update their master password.” The company also said, “We are requiring that all users who are logging in from a new device or IP address first verify their account by email, unless you have multifactor authentication enabled. In a blog post, LastPass gave some limited details about what happened:

Lastpass multifactor authentication