3 ms·
I trust LastPass for 3 reasons: 1) LastPass has a history of taking ownership of vulnerabilities and taking appropriate measures. They do this publicly and pro
by hallman76 11y ago
I trust LastPass for 3 reasons:
1) LastPass has a history of taking ownership of vulnerabilities and taking appropriate measures. They do this publicly and provide a level of detail that demonstrates their expertise[1].
2) They're working under the same constraints as Google with the same caliber of engineering strength.
3) Most importantly, their business depends on delivering a secure product. It's in their best interest to continue providing a secure product.
[1] https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h...
- spinchange 11y agoIt isn't that I don't trust LastPass the company. It is that I'm no longer sure if the entire model of the product/service offers enough additional (or comparable) security over what Chrome offers, wrt to the syncing of encrypted credentials to the cloud. If your're only considering vulnerabilities that pertain to that, I would think native Chrome has an inherent security advantage over a Chrome plugin. I am happy to be wrong about this, though. Edit/Addition: While I give them props for the full disclosure about the salts being exposed, we don't have any evidence that this has ever happened to Google, so setting everything else aside, we already know for certain LastPass has been exploited in a way we don't have any evidence that Google has. That's not intended to be a slight on LastPass or praise for Google, just that, "it is what it is."