3 ms·

I literally switched to using LastPass for everything over the past four hours after meaning to do so for years. I can't believe this.

by underyx 11y ago

infinitone 11y ago
Well on the bright side I think you can export your lastpass account to something better, like 1pass.
- sn0v 11y ago
  Why is the latter better?
- mordocai 11y ago
  1pass likely has similar problems (if you are talking about 1password)
- viraptor 11y ago
  Actually I'd rather use lastpass after they fix the issues than 1pass now. Lastpass just got a serious security review. For all we know 1pass has just as many issues.
- jansc 11y ago
  I used 1password before, but several times I lost access to all my passwords after upgrading the software. On the bright side, I was always able to restore access to it by manually downloading 1password and reinstalling 1password. Besides, 1password does not officially support Linux. That's why I wanted to try Lastpass. I also find the yubikey support interesting. Well, I guess, it's time to reinstall keepass2 again.
  - clarkdave 11y ago
    A really cool feature I love about 1Password is that you can open up the `agilekeychain` file in a web browser and unlock it to view your passwords right there without the application. [0] One of the few unique passwords I remember myself is that of Dropbox, so I'm always able to access my passwords this way from anywhere that has a web browser. I don't know if this would have helped your particular situation (not sure if you can export from this stripped down interface), but it gives me peace of mind that if the software itself ceased to function, my passwords would still be accessible. [0] https://support.1password.com/guides/mac/1passwordanywhere.html https://support.1password.com/guides/mac/1passwordanywhere.h...
mordocai 11y ago
Read some other comments. It is only if you check the store password option and lastpass has been very responsive in fixing the issues since they disclosed them privately.
- underyx 11y ago
  Mine was the first comment on this post; I did read the discussion that followed and it was a huge relief.
spaceSub 11y ago
Well that's bad timing but really, this sort of news is a good thing. No software is perfect and now they can improve upon these findings. Password Managers are still a very valid technology. Better then Firefox/Chromes integrated plain text login stores or using the same password everywhere. Though, IMO, a password manager which uploads all your password onto a central location with thousands upon thousands of other peoples password is just a really damn stupid idea to begin with.. Even if it's encrypted or whatever.
latortuga 11y ago
Don't use the browser plugin "Store My Password" functionality and you're fine. They offer the feature as a tradeoff: lose some security in exchange for convenience. It's very plain and always has been that the master password is the "key to the kingdom" and the only place it should exist is in your head. Anywhere else and you've opened yourself up to attack of those secondary locations - your wallet, your home, your spouse, your browser, your phone, etc. Evaluate for yourself which of these you think is secure and which isn't. LastPass is so much of a win for the average user that even with this feature enabled, you are still better off than using the same username/password for every website which is the norm. This thread will be full of people recommending alternatives and there will be solid choices. I will keep using and recommending LastPass.

I literally switched to using LastPass for everything over the past four hours after meaning to do so for years. I can't believe this.

by underyx 11y ago

I literally switched to using LastPass for everything over the past four hours after meaning to do so for years. I can't believe this.

infinitone 11y ago

Well on the bright side I think you can export your lastpass account to something better, like 1pass.

sn0v 11y ago
Why is the latter better?
mordocai 11y ago
1pass likely has similar problems (if you are talking about 1password)
viraptor 11y ago
Actually I'd rather use lastpass after they fix the issues than 1pass now. Lastpass just got a serious security review. For all we know 1pass has just as many issues.
jansc 11y ago
I used 1password before, but several times I lost access to all my passwords after upgrading the software. On the bright side, I was always able to restore access to it by manually downloading 1password and reinstalling 1password. Besides, 1password does not officially support Linux. That's why I wanted to try Lastpass. I also find the yubikey support interesting. Well, I guess, it's time to reinstall keepass2 again.
- clarkdave 11y ago
  A really cool feature I love about 1Password is that you can open up the `agilekeychain` file in a web browser and unlock it to view your passwords right there without the application. [0] One of the few unique passwords I remember myself is that of Dropbox, so I'm always able to access my passwords this way from anywhere that has a web browser. I don't know if this would have helped your particular situation (not sure if you can export from this stripped down interface), but it gives me peace of mind that if the software itself ceased to function, my passwords would still be accessible. [0] https://support.1password.com/guides/mac/1passwordanywhere.html https://support.1password.com/guides/mac/1passwordanywhere.h...

mordocai 11y ago

Read some other comments. It is only if you check the store password option and lastpass has been very responsive in fixing the issues since they disclosed them privately.

underyx 11y ago
Mine was the first comment on this post; I did read the discussion that followed and it was a huge relief.

spaceSub 11y ago

Well that's bad timing but really, this sort of news is a good thing. No software is perfect and now they can improve upon these findings. Password Managers are still a very valid technology. Better then Firefox/Chromes integrated plain text login stores or using the same password everywhere. Though, IMO, a password manager which uploads all your password onto a central location with thousands upon thousands of other peoples password is just a really damn stupid idea to begin with.. Even if it's encrypted or whatever.

latortuga 11y ago

Don't use the browser plugin "Store My Password" functionality and you're fine. They offer the feature as a tradeoff: lose some security in exchange for convenience. It's very plain and always has been that the master password is the "key to the kingdom" and the only place it should exist is in your head. Anywhere else and you've opened yourself up to attack of those secondary locations - your wallet, your home, your spouse, your browser, your phone, etc. Evaluate for yourself which of these you think is secure and which isn't. LastPass is so much of a win for the average user that even with this feature enabled, you are still better off than using the same username/password for every website which is the norm. This thread will be full of people recommending alternatives and there will be solid choices. I will keep using and recommending LastPass.