Post

Corbin Crutchley
@crutchcorn.dev

@dashlane.com, I was one of the customers who received a "someone attempted a login" email. Frankly, I find the lack of official comms deeply upsetting and will likely be the reason I change password managers after the incident resolves. No site banner, no socials. Unacceptable.

0 reposts3 likes

Corbin Crutchley
@crutchcorn.dev

I'm not saying that you need to have answers immediately. But you absolutely MUST disclose that an incident is occurring if people have their entire livelyhoods entrusted to you. Hiding an announcement behind a hard-to-find status page is not sufficient public comms.

⭑ salma
@whitep4nth3r.com

Oh snap I’ve received two of these emails this evening and I have been panicking and reset my master password twice, which involved generating new recovery keys twice… are we presuming these emails are being sent erroneously?

Corbin Crutchley
@crutchcorn.dev

I don't know unfortunately :( Their status page is extremely scant on details and they've said nothing on comms AFAICT. I like genuinely don't know how they could have gotten my master password. It's never been reused from anything else

⭑ salma
@whitep4nth3r.com

Yeah same. I expected brute force. Given the IP addresses were in Chile and North Korea, and the IP address in Chile was a known abusive one 🫩 but given I got two emails in quick succession I’m not so sure anymore. Now I have to remember a new master password 🙃

⭑ salma
@whitep4nth3r.com

Interestingly I saw an announcement from January that they’re rolling out getting rid of master passwords… but it hasn’t been enabled for me yet five months later. 😭

Kevin Snyder
@guns.bsky.social

where are you seeing IPs? I can't find a login attempts page in the settings and my email only said that my account was suspended (it was not) after someone failed to provide the correct token to register a new device too many times. Or was yours a login attempt email?