4 ms·
So, I've been using Lastpass for a few years now and I probably rely on it too much. Every single login has a unique and strong password so it would be a pain t
by Accacin 10y ago
So, I've been using Lastpass for a few years now and I probably rely on it too much. Every single login has a unique and strong password so it would be a pain to have to move away.
I use a Yubikey that's required when I log into a new PC (my home pc is set to only ask every 30 days for my 2FA key), I use an email that is only connected to Lastpass and I have a strong passphrase. Any other device I use Lastpass on is set to require a password and 2FA key at each start.
Is that enough to make me reasonably secure?
- ciucanu 10y agoIt should be safe enough, with a few exceptions, one of those being this exploit: https://news.ycombinator.com/item?id=12171547 https://news.ycombinator.com/item?id=12171547 This guy says that if the webpage "asks" for another's page credentials, lastpass plugin will give it. Every character/keystroke in specific fields could be catched/logged , here you have an example from ... eBay : https://news.ycombinator.com/item?id=12000820 https://news.ycombinator.com/item?id=12000820 Anyway, this was already fixed and pushed to the users, as the guy mentions in his post.
- mhurron 10y agoLastPass does allow you to export all of your saved sites and passwords as an csv file. So moving away is simply exporting the vault and uninstalling the software. The LastPass exploits presented exist after you have unlocked your vault, so 2fa on the LastPass vault won't stop them. Personally, I'm not moving away from LastPass over these.