Xmarks bookmark sync passwords safe, says LastPass

Computerworld - LastPass said Thursday that hackers did not obtain passwords linked to Xmarks, the browser synchronization service the company acquired last December.

Earlier in the day, LastPass forced customers to reset their master passwords after detecting a "traffic anomaly" that may have been a hacker intrusion.

But Xmarks passwords were not affected, and users of the browser plug-in -- available for Internet Explorer, Firefox, Chrome and Safari -- were not required to come up with a new password.

"Xmarks users are not impacted that we can see," said LastPass CEO Joe Siegrist in an email reply to questions Thursday. "Different machines, networks, databases."

LastPass, an online password management company that bills its free and for-pay service as "The Last Password You'll Have to Remember," acquired Xmarks late last year.

Before selling to LastPass for an undisclosed sum, Xmarks, which synchronizes browser bookmarks across multiple computers, browsers and operating systems, was ready to pull the plug on its service. In September 2010, Xmarks said it could no longer compete with the sync services built into Chrome and Firefox.

Later, Xmarks ran a pledge drive that asked users to promise to pay $10 annually for the service.

After buying Xmarks, LastPass retained the free service but also added a $12 per year premium service that offered bookmark synchronization to iPhone, iPad, Android and BlackBerry users.

In an interview late Thursday with PCworld -- like Computerworld, an IDG publication -- Siegrist said that at the worst, the danger to LastPass users was "a one in a million kind of a risk."

Read more about Application Security in Computerworld's Application Security Topic Center.