5 ms·

You didn't ask me, but, several things: - This is the second serious security incident with them. Nobody's immune to bugs, but I haven't seen a similar history

by __jal 10y ago

You didn't ask me, but, several things: - This is the second serious security incident with them. Nobody's immune to bugs, but I haven't seen a similar history with AgileBits. - LastPass has, IMHO, terrible UI/UX. Things don't work consistently, there are weird, unexpected pauses that look like malfunctions until something visible happens; it took me a comparatively long time to figure out how to map common actions to the gestures that perform them; and finally, this is way down the priority list, but I find it generally kind of ugly. I suspect some of these complaints are partially linked to the next point. - Lastpass is more trouble than it is worth in Safari/Mac. I've used 1Password personally since 2008-ish, and think I've had exactly one nontrivial problem with it in that time, which was my fault. (There was some upgrade-path weirdness with the iOS version several years ago, and I left a device unused long enough that it ended up with orphaned data I couldn't sync. I forget the details of what exactly happened.) 1Password Teams didn't exist when my company started using Lastpass, but I'm hoping to get switching onto the low-priority project list.

balls187 10y ago
Just got an email from our Security team saying we should stop using lastpass.
unfletch 10y ago
> ...I'm hoping to get switching onto the low-priority project list. You should maybe try and get it on the high priority list. On August 1st the Teams pro plan will increase from $4/user/mo. (introductory price) to $12/user/mo. for new signups: https://1password.com/teams/pricing/ https://1password.com/teams/pricing/
tedmiston 10y ago
> - Lastpass is more trouble than it is worth in Safari/Mac. Can't agree with this more. I've had so many issues with LastPass staying logged in one browser across sessions, even though the preferences are set to logout after short inactivity windows and on browser quit. LastPass seemed to lose its preferences like this multiple times, and it made me uncomfortable from a security perspective to not know for sure when my sessions would actually end. Besides that it's mostly UX issues for me, similar to what you've described. I also prefer 1Password's pronounceable random password generator vs LastPass's generator (obligatory xkcd https://xkcd.com/936/ https://xkcd.com/936/).
- __jal 10y ago
  Another really cool trick it plays is that it enables Secure Input, as it should, but then never disables it. So it breaks 3rd party tools that expand shortcuts, automate UI actions, etc. like TextExpander, which I use a lot.
  - tedmiston 10y ago
    I've had this trouble in Chrome quite a bit too. For example, system level text expansions break in the Chrome omnibox. I think that's independent of LastPass, but I could be wrong.
    - __jal 10y ago
      I'm actually talking about sort of the reverse. Secure Input is a system-level thing; it disables input capture via the accessibility API (which things like TextExpander use), which effects everything on the machine. That is what you want; when typing a password, there is no good reason for other code to be reading what you (or LastPass) is typing. You just also want it to be turned back off when you're done. But after the first use of the LastPass Safari extension, TextExpander (or KeyboardMaestro, or a bunch of other tools) won't work anywhere until a after reboot or some other method of disabling SI.

by __jal 10y ago

balls187 10y ago

Just got an email from our Security team saying we should stop using lastpass.

unfletch 10y ago

> ...I'm hoping to get switching onto the low-priority project list. You should maybe try and get it on the high priority list. On August 1st the Teams pro plan will increase from $4/user/mo. (introductory price) to $12/user/mo. for new signups: https://1password.com/teams/pricing/ https://1password.com/teams/pricing/

tedmiston 10y ago

> - Lastpass is more trouble than it is worth in Safari/Mac. Can't agree with this more. I've had so many issues with LastPass staying logged in one browser across sessions, even though the preferences are set to logout after short inactivity windows and on browser quit. LastPass seemed to lose its preferences like this multiple times, and it made me uncomfortable from a security perspective to not know for sure when my sessions would actually end. Besides that it's mostly UX issues for me, similar to what you've described. I also prefer 1Password's pronounceable random password generator vs LastPass's generator (obligatory xkcd https://xkcd.com/936/ https://xkcd.com/936/).

__jal 10y ago
Another really cool trick it plays is that it enables Secure Input, as it should, but then never disables it. So it breaks 3rd party tools that expand shortcuts, automate UI actions, etc. like TextExpander, which I use a lot.
- tedmiston 10y ago
  I've had this trouble in Chrome quite a bit too. For example, system level text expansions break in the Chrome omnibox. I think that's independent of LastPass, but I could be wrong.
  - __jal 10y ago
    I'm actually talking about sort of the reverse. Secure Input is a system-level thing; it disables input capture via the accessibility API (which things like TextExpander use), which effects everything on the machine. That is what you want; when typing a password, there is no good reason for other code to be reading what you (or LastPass) is typing. You just also want it to be turned back off when you're done. But after the first use of the LastPass Safari extension, TextExpander (or KeyboardMaestro, or a bunch of other tools) won't work anywhere until a after reboot or some other method of disabling SI.