17 ms·
The fact that LastPass consider that a flaw in their system that could have put them on their knees is only worth 1K is quite frightening if you are relying on
by y04nn 10y ago
The fact that LastPass consider that a flaw in their system that could have put them on their knees is only worth 1K is quite frightening if you are relying on them for your security.
- crdoconnor 10y agoExactly this. I'm abandoning them now.
- SaturateDK 10y agoI want an alternative, got a good one?
- ajdlinux 10y agoAny good alternatives for LastPass Enterprise-style multi-user sharing? (Apart from "don't use services that require you to share passwords for a single account". Alas.)
- winsome 10y agoMy team and I have been using 1Password Teams (https://1password.com/teams/ https://1password.com/teams/) for this. They also have a Families service if for some reason you want to do the same thing with family and friends.
- greenshackle 10y agoDoes it need to have Windows client? I'm guessing yes. If not there is [SFLVault](http://sflvault.org/ http://sflvault.org/)
- scandox 10y agoI've been using Pass for several months and I love it. https://www.passwordstore.org/ https://www.passwordstore.org/
- deleted 10y ago[deleted]
- pwenzel 10y agoWithin Pass is there a best practice for sharing passwords with another person or team?
- scandox 10y agoI don't know about best practise but it integrates closely with Git. I store the encrypted passwords in a remote git repository. That means if someone else had the same GPG key and the password for that key, they could simply clone the repo and obtain the passwords. Equally they could add passwords and push them to the repo. So that seems like a reasonable way for people to share them. However, I only use it for myself so I may not have thought of all the gotchas.
- riquito 10y agoenpass.io, it supports pretty much every platform
- crdoconnor 10y agoKeePass, but I'm not 100% on that one either.
- toxican 10y agoWhy not? I've been using it for about a year now (switched from LastPass) and haven't had any issues. Kind of miss the in-browser features of LastPass, but seeing as how those are what's being exploited, maybe not so much!
- theandrewbailey 10y agoThere are browser extensions that work with KeePass. This LastPass vulnerability makes me wonder, too. I wish the KeePass site would be 100% HTTPS, though, but the maintainer is a jerk in that regard.
- Quiark 10y agoBe careful about browser integration https://github.com/pfn/keepasshttp/issues/258 https://github.com/pfn/keepasshttp/issues/258
- jsight 10y agoI use KeePass as well, but I have never tried it with a browser extension. That seems a little dangerous to me.
- gourou 10y agoWork on your memory, it's very hard to hack.
- Xylakant 10y agoThat's a very bad recommendation. Very few people are capable of remembering unique 10-character passwords for each site. I have like 100 passwords and accounts for various systems and I'm certainly not able to remember each of them. So either I start reusing passwords or I use a password manager.
- mabcat 10y agoI switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.
- jxpx777 10y agoDisclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-dont-why-our-data-format-is-public/ https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ https://1password.com/security/ (White paper is linked at the bottom of the page.)
- niij 10y agoHow easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.
- AGKyle 10y agoDisclosure: I also work for AgileBits :) We have a dedicated LastPass import option. See here: https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/ If you encounter any trouble please write into support at agilebits dot com and mention "Kyle" somewhere in the body of the email and I'll get notified. You should be fine though, but every once in awhile we have someone encounter trouble with the import from LastPass.
- niij 10y agoThanks! I checked out the pricing model and didn't see anything that made sense to me as an individual user. Is there any plan for an affordable individual plan (in the range of 10-20$/ year)? As a Mac/IOS user, I don't see myself shelling out 60$ for a desktop license and then another 10$ for an IOS license on top of it. I'm sure your profit margin is great, don't get me wrong, but as a buyer that is just overkill.
- Alpacalex 10y agoIf you're using a *nix system: https://www.passwordstore.org/ https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)
- etatoby 10y agoThat's brilliant, thanks a lot! I never trusted "cloud" (read: not yours) password stores. I have been using KeePass and manual syncing, but I had my doubts about it too. This looks perfect and simple!
- oslavonik 10y agoI've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?
- embik 10y agopass is as safe as your gpg installation and your gpg key because that's the encprytion it uses.
- svenfaw 10y agoThat's a dangerous oversimplification. By that logic "LastPass is as safe as AES as that's what it uses" which is obviously not the case. A system is as secure as its weakest component.
- haasn 10y ago`pass` is based on well-established cryptography implementations: GnuPG. GnuPG is recommended by many security experts and used widely by journalists dealing with sensitive disclosures, e.g. the edward snowden documents. It also doesn't try to NIH some complicated database format or syncing technology but instead uses well-established software (git, plain directory structure and gpg-encrypted text files) which makes it robust, flexible and future-proof, and also responsive to changes in cryptography as it benefits from upstream GnuPG updates. You can use any PGP key structure you want, or even hardware PGP devices like the YubiKey. KeePass on the other hand seems to be based on mostly homegrown techniques written by people with no or limited understanding of cryptography. (see e.g. [0]) That said, I don't know how much KeePassX continues this trend - but it's based on the same file format so it presumably has to reimplement at least some of KeePass's homegrown crypto. I don't know how much more convincing you need, but personally I wouldn't even dare consider using anything other than `pass`. [0] https://news.ycombinator.com/item?id=9727297 https://news.ycombinator.com/item?id=9727297
- imglorp 10y agoDon't use anything that runs in the DMZ (browser), if you care about your secrets. I use keepassx, which requires manual search, copy, paste but it can store its vault on a cloud drive, mobile etc. and can have a key file or password.
- chrisper 10y agoWhat do you mean? Autotype is available in KeepassX.
- riskable 10y agoAutotype is a bit risky because it assumes you've got the correct window/element focused. All it takes to expose your passwords is for a pop-up (e.g. instant message) to appear at the right moment. Even if you don't hit the enter key/submit the form it is still possible for that incorrect window/app to grab your keystrokes.
- foxylion 10y agoI had this once, "auto typed" a password into a messenger window. So be careful it can happen at any time. Better use Ctrl+C and Ctrl+V.
- cowkingdeluxe 10y agoWorth mentioning that one of the major benefits of Keepass is that it is open source. Many of the other providers mentioned here are not.
- julsimon 10y agoDashlane is really good. Running 100% in AWS and leveraging a lot of their security features. Here is their security white paper : https://www.dashlane.com/download/Dashlane-Security-Whitepaper-V2.8.pdf https://www.dashlane.com/download/Dashlane-Security-Whitepap...
- jontas 10y agoI just read the whitepaper (I am a long time Dashlane user) and they have a section on security of their javascript/browser extensions. They say that their extensions all use c++ so execute entirely outside of the javascript context. This would not have prevented the Lastpass exploit since all that was required as a malformed URL, but it is nice to see that Dashlane is thinking about this stuff. Also, had Lastpass not used js this exploit would've been harder to find (though not impossible).
- dashlanesupport 10y agoHello Julsimon, this is Simon from Dashlane's Support team. Thank you for your feedback. We have indeed ran multiple checks on our end and can confirm that we are not vulnerable to this type of issue. The code used for our auto-fill functions is shared on all our platforms and has been audited multiple times.
- ClayM 10y agoI switched myself and my family to use 1Password Family. Been very happy with it. Syncs across all user and devices (except IE lol)
- tedmiston 10y ago1Password is very nicely integrated if you're on a Mac and/or iOS. It's not free like LastPass, but I consider it a reasonable one-time* purchase. *every few major releases
- chyle 10y agoCheck out Enpass password manager. https://www.enpass.io/ https://www.enpass.io/ I found this alternative when LastPass was acquired by log me once. I was not happy with this. This app doesn't have hacking or vulnerability history like LastPass. They also have a dedicated import for LastPass. https://www.enpass.io/docs/desktop-mac/import_lastpass.html https://www.enpass.io/docs/desktop-mac/import_lastpass.html
- retox 10y agoNo one is under any obligation to provide bug bounties.
- deleted 10y ago[deleted]
- icebraining 10y agoAnd no one is obligated not to take that into consideration when deciding whether to use the product.
- jug 10y agoNo, exactly -- at their peril.