Last.fm Password Security Update

Hi everyone,

We are currently investigating the leak of some Last.fm user passwords. This follows recent password leaks on other sites, as well as information posted online. As a precautionary measure, we’re asking all our users to change their passwords immediately.

You can do this here: https://www.last.fm/settings/password

We strongly recommend that your new Last.fm password is different to the password you use on other services. For more advice on choosing a solid password we recommend: http://www.google.co.uk/goodtoknow/online-safety/passwords/

We’re sorry for the inconvenience around changing your password; Last.fm takes your privacy very seriously. We’ll be posting updates in our forums and via our Twitter account (@lastfm) as we get to the bottom of this.

The Last.fm Team

Highly disappointing that last fm was apparently in the amateur hour club with LinkedIn

Burkey said:
Were the passwords hashed? Salted?

Would be nice to know as then we know how risky it is really to keep the password.

Please be sure to use https://www.last.fm/settings/password and
not http://www.last.fm/settings/password to do this,
for enhanced security over the web.

(Check yellow bar at top of page...)

And remember to change the password in the client too, to continue scrobbling.

CarrieLookahead said:
Please be sure to use https://www.last.fm/settings/password and
not http://www.last.fm/settings/password to do this,
for enhanced security over the web.

(Check yellow bar at top of page...)

And remember to change the password in the client too, to continue scrobbling.

The http link actually redirects to the secure https one :)

Tomek said:
It's a shame it's taken so long for them to issue this advice. I and several others reported over three weeks ago that last.fm or one of their affiliates had suffered a breach.

This was obvious as unique email addresses known only to last.fm suddenly started to receive spam.

So if this announcement is linked (which I assume it is) then they also have your email address too.

This is a very scary thought. I'm glad I don't use this account to pay for items via Paypal.

Paradoxj said:
Where can we check the password list?

lol are you like serious?

Oh dear!

Ideally passwords should be at least ten alphanumeric characters long, and include uppercase, lowercase, numeric, and punctuation symbols
to maximize entropy (randomness). It's best not to use the same password on more than one account, and certainly not on more than one website.

Ideally passwords should be generate easily at Free Password Generator Online page:

http://freepasswordgenerator.com/

Disagree!

For anyone like me who uses the last.fm client AND a seperate music player with its own scrobbler, remember to update your pw in both.

Yikes...