6 ms·

“Sites like these give PHP a bad reputation”

51 points by gempir 10y ago

CiPHPerCoder 10y ago
One one point: This is kind of meaningless and alarmist. On the other: It says volumes about LastPass's code quality.
- Bud 10y ago
  It seems to me it says more about their website quality, which is different.
  - CiPHPerCoder 10y ago
    The code quality of their website and the code quality of the application they sell might be two different things, but the overlap between both topics is "code quality", which is what I said.
    - bigbugbag 10y ago
      This is still wrong, you're inferring that the website code and the application code share the same code quality. But chances are this is not true (unless there is only one dev at lastpass which would also be admin of the webserver.
      - CiPHPerCoder 10y ago
        > But chances are this is not true (unless there is only one dev at lastpass which would also be admin of the webserver. This is an unknown, and we can argue until we're both blue in the face about whether or not information about app A tells you information about app B, if produced by the same company, but you don't know if the same people within said company produced both apps. But I say that point doesn't really matter: Their quality controls are either lopsided or inadequate. Neither is a good outcome for a security company.
      - gempir 10y ago
        This says they have atleast 8 developers. https://lastpass.com/about-lastpass/ https://lastpass.com/about-lastpass/
  - chiefalchemist 10y ago
    +1 The site probably isn't the application per se, nor where the data is stored.
Zombieball 10y ago
I expected a long rant about storing all your passwords in one place. First paragraph I see reference to php, and completely sympathized with the author And I am a LastPass customer! (edit: clarification, I meant to portray my disdain for php. I still like (and trust) LastPass!)
- CiPHPerCoder 10y ago
  Modern PHP (which LastPass almost certainly isn't using or writing) isn't really worthy of disdain. https://github.com/paragonie/halite/blob/master/src/Symmetric/Crypto.php https://github.com/paragonie/halite/blob/master/src/Symmetri... (Disclaimer: My project.)
  - corobo 10y ago
    Just a heads up comments like these don't really say anything useful. I know you're splitting keys because that's what the function is called. What the keys are or why they're being split is what the comment should mention. // Split our keys list($encKey, $authKey) = self::splitKeys($secretKey, $salt, $config); Also what's happening here? This could do with a comment for more junior devs. It's impossible to Google "function with a colon on the end of it in php" public static function decrypt( [..] ): HiddenString { [..] } Edit: Re-phrased my wording to be a bit less boorish
    - CiPHPerCoder 10y ago
      > Just a heads up comments like these don't really say anything useful. Thanks for looking through the code. I'll make the comments more meaningful on my next run through. > Also what's happening here? This could do with a comment for more junior devs. It's impossible to Google "function with a colon on the end of it in php" That's a PHP 7 feature called return type declarations. If it doesn't return an instance of HiddenString, PHP will throw a TypeError.
      - corobo 10y ago
        Oh no I mean if we shrink it down to the PHP it becomes public static function decrypt(): HiddenString { } The way I worded it is implying I'm digging at you sorry. I mean the literal what does this do, I've not come across formatting things like this before
Raed667 10y ago
I used lastpass in the beginning for a long time, and I was OK with the fact that I don't know most of my passwords. Until the day I forgot my 'master password' (I don't know what happened... I just couldn't remember it) And almost all my passwords were gone. Resetting everything was a real pain
- bcraven 10y ago
  How do you now mitigate this?
  - Raed667 10y ago
    You can't. The DB is encrypted locally using your password (wich lastpass does not have because they store only the hash)
  - CiPHPerCoder 10y ago
    Write it down, store half of it in a safe, the other half in a compartment in your purse/wallet (which you keep on your person).
- danparsonson 10y ago
  That's not a problem with LastPass, it's a problem with password managers - also coincidentally a feature of them.
- DCoder 10y ago
  In case of KeePass at least, you can skip the master password and use keyfiles or HOTP such as Yubikey instead. Or, better yet, you can combine the master password with one of those.
whack 10y ago
For the benefit of people not familiar with php, can someone please clarify why the author's findings reflect badly on lastpass?
- Raed667 10y ago
  It just shows bad (old) coding habits that might indicate the kind of code quality running lastpass
- mSparks 10y ago
  Php (generally speaking) isn't "secure by design". Which means writing Php code that isn't as insecure as an ugly girl on prom night requires significant effort on the part of the developer to make applications secure. The guy notes they haven't even put in the basic effort required.
  - swombat 10y ago
    > Php code that isn't as insecure as an ugly girl on prom night What the hell? Where did this come from? Could you not think of a less sexist metaphor to use here? Maybe this is how you talk to your buddies, and maybe that's fine, and maybe it's even ok to speak like this here, but in the interests of not making the tech industry even more hostile to women than it is now, my request would be to refrain from picking this particular metaphor in this particular forum.
    - deleted 10y ago
      [deleted]
    - deleted 10y ago
      [deleted]
    - mSparks 10y ago
      nonesense. its only in America you cant talk about the difference between boys and girls. I dont care how much you homos, bisexuals and metrosexuals whine and moan, i am not required to respect your life choices. Sexisim isnt a bad thing, its as natural as sexual preference, whichever way you swing. https://pics.onsizzle.com/something-went-terribly-wrong-fwd-back-when-men-were-men-3812881.png https://pics.onsizzle.com/something-went-terribly-wrong-fwd-... And you know a secret? Women really do prefer men over whiney little girls. So what exactly is your beef with describing the web as insecure as an ugly girl on prom night? Its not exactly scarface high on coke. is it.
bigbugbag 10y ago
You should avoid lastpass (and similar services) because you are giving all your credentials to a third party to be remotely stored. Also lastpass has a history of security issues: https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues If you want to use a password manager, you should use something like pass[1]. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/
- CiPHPerCoder 10y ago
  I don't disagree (although I prefer KeePassX), but let's be charitable: - What LastPass gets is ciphertext, not your unencrypted passwords. Important detail. - There are opportunities for LastPass to receive your master password (i.e. if you enter it on their website). I haven't audited LastPass. After Tavis Ormandy looked at it earlier this year and published his findings, I wouldn't be surprised if the crypto was totally and hopelessly broken. But to eschew the fact that their app does encrypt passwords before sending them to their servers isn't fair.
  - angry-hacker 10y ago
    But nothing theoretically stop them from getting your master password. You have to put a lot of faith in them and the question why would you always remains.
    - pfg 10y ago
      To be fair, that's true for just about any password manager unless you audit the code and use reproducible builds. It just tends to be easier to place these kind of backdoors in web apps because the code is basically re-downloaded each time ... which is worrisome given their, uhm, antiquated app "architecture." Native apps, on the other hand, tend to have signed updates and such. I'd pick a native password manager over a web-based one any day, but the theoretical risk is still there.
    - dogma1138 10y ago
      Nothing stops anyone from getting your master password, including Google, Microsoft, Apple, Firefox etc.. The thing here is motive and incentive, LastPass has not motive or incentive to handle your passwords in an unencrypted form, it has no motive or incentive to want to know your master password ever since both of those things are just a huge liability for them. Every password manager, every browser, every OS, every hardware can be backdoored and compromised by their maintainer/manufacturer in a way nearly impossible to detect even in some cases if the source code is fully or partially available, heck how many people ever verify that the package they just grabbed via the package manager was built using an unaltered version of the source code? To function you need to have some level of trust, you can try to add additional security measures e.g. like not storing highly sensitive passwords in a password manager but even then really depending on how you maintain those passwords you are likely to increase your risk rather than reduce it.
ithipster 10y ago
i do not advocate for lastPass, you should not allow ANYBODY handle YOUR passwords. but. the premise of your argument is utterly and completely wrong. "I got redirected to lastpass.com/update_phone.php ... I get redirected to a php file in the root of the webserver?" no and no. by looking on a URL you can not say anything about the "root" location, whatever you mean by the "root". and you was not redirected to any "file" at all, there are no files in the space of URLs. and ".php" part is not telling you anything about the server's internals (i have a couple of servers written in Erlang, i can create a couple of ".php" URIs for you if you wish.) YOU MAKE UNJUSTIFIED ASSUMPTIONS -- this is THE primary reason for the mistakes you alleged in your article -- WHAT AN IRONY!!!!
stabbles 10y ago
It also has an include.php file: https://lastpass.com/include.php https://lastpass.com/include.php
curiousgal 10y ago
I have much faith in Dropbox' security so I use 1password (uses Dropbox for online storage). It even works on Linux with Wine and Chrome. (except for auto-submit, but I don't use that feature anyway.)
kybernetyk 10y ago
Wow, what an non-argument. I expected some kind of security analysis. Not a "look at them using file extensions" rant which doesn't say anything about the quality of their software at all. How got this submission to 30 points? Voting ring?
- ben_jones 10y ago
  Blind passion runs stronger at late hours of the night? Europeans hate centralized, third-party, password management? So many variables that could explain it.
- CiPHPerCoder 10y ago
  > Not a "look at them using file extensions" rant which doesn't say anything about the quality of their software at all. See https://news.ycombinator.com/item?id=12884523 https://news.ycombinator.com/item?id=12884523 for how the detail covered in the article could adversely affect the quality of their software and the security of their service. I wish they had done more research in this realm, seems like they pressed "publish" far too early.
elFarto 10y ago
I've been using Enpass[1] for a while now and it's great. Free desktop clients (Windows, macOS and Linux), and $10 for the mobile app. Supports a bunch of cloud services for sync. [1] https://www.enpass.io/ https://www.enpass.io/
- Semaphor 10y ago
  I looked into enpass recently and it really looks nice. But after playing around a bit with it, I just found it too lacking in the feature department compared to KeePass [1] and it's browser extensions. [1] http://keepass.info/ http://keepass.info/
stratosgear 10y ago
I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... I have personally have found bliss in Password Hasher Plus (https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd https://chrome.google.com/webstore/detail/password-hasher-pl...) (Hash it! App on android) Basically it hashes your password together with the domain name you want to login in together with a very long private key to generate an arbitrarily long password as a final pass. The chrome extension and app provide some nice utilities to make all this pretty easy and transparent to use. Advantages: * Only one password to remember. * Different final passwords for all services * Hashed with a unique private key * Arbitrarily generate any pasdword length you want * Passwords are not shared with anyone (automatically generated on your device) * Plus many more (that i will do a bad job describing) Disadvantages: * More of a script approach not a full blown application (matters to some) * Different approach for desktop and mobile (extension vs app)
- ZoFreX 10y ago
  > I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survive the website being owned. I use LastPass and I'm not sharing my passwords with them, I'm sharing my encrypted passwords with them. It's an important consideration! 2) You don't want to trust a third party so you use a Chrome extension that is made by a third party and has permission to access any website? You are trusting a third party.
  - stratosgear 10y ago
    Well, I know exactly what goes in the Chrome extension (https://github.com/ericwoodruff/passwordhasherplus https://github.com/ericwoodruff/passwordhasherplus) or the android app (https://github.com/ginkel/hashit https://github.com/ginkel/hashit) The point is that I do NOT want to store (even hashed) passwords with a third party in the hopes that they will be able to protect my passwords, when I can generate them on the spot from the device I'm using. But that's just me. My post was just a comment on how people find third party password managers so secure. I can't be the only paranoid about this...
MaKleSoft 10y ago
What alarms me much more than the appearance of bad code quality is the fact that we have no direct way of checking what's actually going on under the hood and what impact it has on security. If there is one axiomatic requirement for the trustworthiness of a password manager, it's that it must be open source. That way people don't have to guess at the code quality from their use of file extensions. Lots of people seem to have a huge phobia of storing their passwords in the cloud and I have the feeling that the provenly poor security of Lastpass [1] has contributed significantly to this. <shameless plug>Padlock[2] is a penetration-tested, open source alternative that also has a (open source!) cloud storage solution[3] that you can even deploy to your own server if you don't trust the official one. All of this based on zero-knowledge (the server has no way of acquiring your master password or reading any of your clear-text data). Disclaimer: I'm the main contributor.</shameless plug> [1]: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d... [2]: https://padlock.io https://padlock.io [3]: https://github.com/maklesoft/padlock-cloud https://github.com/maklesoft/padlock-cloud
- gempir 10y ago
  That's exactly what i was trying to say with the article :) serving .php files directly is not security issue, but as you said nobody knows what's going on under the hood.
- lestatcheb 10y ago
  Padlock doesn't work in Firefox?
  - MaKleSoft 10y ago
    Yeah, currently the only way to run it on desktop is through the Chrome app. A native, standalone desktop app for all major platforms will be released very soon, though.
halilim 10y ago
Facebook was doing something similar (.php URL's). Should we avoid Facebook? Maybe. But for this reason? I was a PHP dev for nearly a decade and you can't possibly know the ways I hate it (unless you're a PHP dev too); but this is a very poor form of criticism.
webwanderings 10y ago
iCloud's Notes are not bad as a solution for simple password storage solution. No need to worry about syncing and it is secured.
- ZoFreX 10y ago
  Doesn't that mean Apple has access to all your passwords, though?
  - webwanderings 10y ago
    iCloud is encrypted, isn't it? You can also double lock your Notes with its own password.
    - SallySwanSmith 10y ago
      or you just use the iCloud keychain, you know, the iCloud component designed to store passwords securely...
      - webwanderings 10y ago
        Yes, but keychain is not there on the online portal of iCloud, which wouldn't be helpful if you're on different OS.
butz 10y ago
Using frontend web technologies for keeping passwords safe is not the best idea. Lastpass has "restricted" password copy functionality, if passwords were shared. But it actually loads password to input field with type set to password. Open up inspect tools, change input field type to text and you have a password in plain text, you can easily copy.
simias 10y ago
I've been working on a reimplementation of the LastPass command line client lately and while I was also a bit surprised when I found out that the login URL was "https://lastpass.com/login.php" https://lastpass.com/login.php" I didn't really think much of it. In the end the server side of things is really not critical since it only stores an encrypted version of the blob. Sure, it looks a bit sloppy, but if it works... The real weakness of lastpass is and always will be the clients, in particular those browser extensions that can update in the background and are difficult to audit. But these browser extensions are also the reason I'm not using something like "pass" or even a custom GnuPG-based solution. It just works on any machine regardless of the OS without any hassle. So far the C code of the CLI client looks decent enough. Not amazing but nothing really stands out, besides maybe the key derivation algorithm they use: they query the server for the number of rounds to use when deriving the keys and if the server replies "1" they fallback on a single round of SHA256 salted with the username. It's probably some kind of compatibility mode but that seems rather weak to me. If somebody compromised the server they could have it tell the client that the number of rounds for any client is 1 which will cause the clients to send a "simple" SHA256 of username+password which will be a lot easier to bruteforce than the default 5000 rounds of PBKDF2.
_kyran 10y ago
There's also a https://lastpass.com/db.php https://lastpass.com/db.php
chiefalchemist 10y ago
Considering the general insecurity and hackability of the internet, this is probably more of a symptom than a disease. It's the digital equivalent of the cure for cancer. 'cept the internet is printing too much money for too many peopke and no one wants to muck with that, even if it's the right thing to do. Everything will OK. Just don't be evil ;)
chiefalchemist 10y ago
Might it be possible to kinda fake a PWM with some sort of encryption and Git for backup / cross device access?

51 points by gempir 10y ago

CiPHPerCoder 10y ago

One one point: This is kind of meaningless and alarmist. On the other: It says volumes about LastPass's code quality.

Bud 10y ago
It seems to me it says more about their website quality, which is different.
- CiPHPerCoder 10y ago
  The code quality of their website and the code quality of the application they sell might be two different things, but the overlap between both topics is "code quality", which is what I said.
  - bigbugbag 10y ago
    This is still wrong, you're inferring that the website code and the application code share the same code quality. But chances are this is not true (unless there is only one dev at lastpass which would also be admin of the webserver.
    - CiPHPerCoder 10y ago
      > But chances are this is not true (unless there is only one dev at lastpass which would also be admin of the webserver. This is an unknown, and we can argue until we're both blue in the face about whether or not information about app A tells you information about app B, if produced by the same company, but you don't know if the same people within said company produced both apps. But I say that point doesn't really matter: Their quality controls are either lopsided or inadequate. Neither is a good outcome for a security company.
    - gempir 10y ago
      This says they have atleast 8 developers. https://lastpass.com/about-lastpass/ https://lastpass.com/about-lastpass/
- chiefalchemist 10y ago
  +1 The site probably isn't the application per se, nor where the data is stored.

Zombieball 10y ago

I expected a long rant about storing all your passwords in one place. First paragraph I see reference to php, and completely sympathized with the author And I am a LastPass customer! (edit: clarification, I meant to portray my disdain for php. I still like (and trust) LastPass!)

CiPHPerCoder 10y ago
Modern PHP (which LastPass almost certainly isn't using or writing) isn't really worthy of disdain. https://github.com/paragonie/halite/blob/master/src/Symmetric/Crypto.php https://github.com/paragonie/halite/blob/master/src/Symmetri... (Disclaimer: My project.)
- corobo 10y ago
  Just a heads up comments like these don't really say anything useful. I know you're splitting keys because that's what the function is called. What the keys are or why they're being split is what the comment should mention. // Split our keys list($encKey, $authKey) = self::splitKeys($secretKey, $salt, $config); Also what's happening here? This could do with a comment for more junior devs. It's impossible to Google "function with a colon on the end of it in php" public static function decrypt( [..] ): HiddenString { [..] } Edit: Re-phrased my wording to be a bit less boorish
  - CiPHPerCoder 10y ago
    > Just a heads up comments like these don't really say anything useful. Thanks for looking through the code. I'll make the comments more meaningful on my next run through. > Also what's happening here? This could do with a comment for more junior devs. It's impossible to Google "function with a colon on the end of it in php" That's a PHP 7 feature called return type declarations. If it doesn't return an instance of HiddenString, PHP will throw a TypeError.
    - corobo 10y ago
      Oh no I mean if we shrink it down to the PHP it becomes public static function decrypt(): HiddenString { } The way I worded it is implying I'm digging at you sorry. I mean the literal what does this do, I've not come across formatting things like this before

Raed667 10y ago

I used lastpass in the beginning for a long time, and I was OK with the fact that I don't know most of my passwords. Until the day I forgot my 'master password' (I don't know what happened... I just couldn't remember it) And almost all my passwords were gone. Resetting everything was a real pain

bcraven 10y ago
How do you now mitigate this?
- Raed667 10y ago
  You can't. The DB is encrypted locally using your password (wich lastpass does not have because they store only the hash)
- CiPHPerCoder 10y ago
  Write it down, store half of it in a safe, the other half in a compartment in your purse/wallet (which you keep on your person).
danparsonson 10y ago
That's not a problem with LastPass, it's a problem with password managers - also coincidentally a feature of them.
DCoder 10y ago
In case of KeePass at least, you can skip the master password and use keyfiles or HOTP such as Yubikey instead. Or, better yet, you can combine the master password with one of those.

whack 10y ago

For the benefit of people not familiar with php, can someone please clarify why the author's findings reflect badly on lastpass?

Raed667 10y ago
It just shows bad (old) coding habits that might indicate the kind of code quality running lastpass
mSparks 10y ago
Php (generally speaking) isn't "secure by design". Which means writing Php code that isn't as insecure as an ugly girl on prom night requires significant effort on the part of the developer to make applications secure. The guy notes they haven't even put in the basic effort required.
- swombat 10y ago
  > Php code that isn't as insecure as an ugly girl on prom night What the hell? Where did this come from? Could you not think of a less sexist metaphor to use here? Maybe this is how you talk to your buddies, and maybe that's fine, and maybe it's even ok to speak like this here, but in the interests of not making the tech industry even more hostile to women than it is now, my request would be to refrain from picking this particular metaphor in this particular forum.
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]
  - mSparks 10y ago
    nonesense. its only in America you cant talk about the difference between boys and girls. I dont care how much you homos, bisexuals and metrosexuals whine and moan, i am not required to respect your life choices. Sexisim isnt a bad thing, its as natural as sexual preference, whichever way you swing. https://pics.onsizzle.com/something-went-terribly-wrong-fwd-back-when-men-were-men-3812881.png https://pics.onsizzle.com/something-went-terribly-wrong-fwd-... And you know a secret? Women really do prefer men over whiney little girls. So what exactly is your beef with describing the web as insecure as an ugly girl on prom night? Its not exactly scarface high on coke. is it.

bigbugbag 10y ago

You should avoid lastpass (and similar services) because you are giving all your credentials to a third party to be remotely stored. Also lastpass has a history of security issues: https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues If you want to use a password manager, you should use something like pass[1]. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/

CiPHPerCoder 10y ago
I don't disagree (although I prefer KeePassX), but let's be charitable: - What LastPass gets is ciphertext, not your unencrypted passwords. Important detail. - There are opportunities for LastPass to receive your master password (i.e. if you enter it on their website). I haven't audited LastPass. After Tavis Ormandy looked at it earlier this year and published his findings, I wouldn't be surprised if the crypto was totally and hopelessly broken. But to eschew the fact that their app does encrypt passwords before sending them to their servers isn't fair.
- angry-hacker 10y ago
  But nothing theoretically stop them from getting your master password. You have to put a lot of faith in them and the question why would you always remains.
  - pfg 10y ago
    To be fair, that's true for just about any password manager unless you audit the code and use reproducible builds. It just tends to be easier to place these kind of backdoors in web apps because the code is basically re-downloaded each time ... which is worrisome given their, uhm, antiquated app "architecture." Native apps, on the other hand, tend to have signed updates and such. I'd pick a native password manager over a web-based one any day, but the theoretical risk is still there.
  - dogma1138 10y ago
    Nothing stops anyone from getting your master password, including Google, Microsoft, Apple, Firefox etc.. The thing here is motive and incentive, LastPass has not motive or incentive to handle your passwords in an unencrypted form, it has no motive or incentive to want to know your master password ever since both of those things are just a huge liability for them. Every password manager, every browser, every OS, every hardware can be backdoored and compromised by their maintainer/manufacturer in a way nearly impossible to detect even in some cases if the source code is fully or partially available, heck how many people ever verify that the package they just grabbed via the package manager was built using an unaltered version of the source code? To function you need to have some level of trust, you can try to add additional security measures e.g. like not storing highly sensitive passwords in a password manager but even then really depending on how you maintain those passwords you are likely to increase your risk rather than reduce it.

ithipster 10y ago

i do not advocate for lastPass, you should not allow ANYBODY handle YOUR passwords. but. the premise of your argument is utterly and completely wrong. "I got redirected to lastpass.com/update_phone.php ... I get redirected to a php file in the root of the webserver?" no and no. by looking on a URL you can not say anything about the "root" location, whatever you mean by the "root". and you was not redirected to any "file" at all, there are no files in the space of URLs. and ".php" part is not telling you anything about the server's internals (i have a couple of servers written in Erlang, i can create a couple of ".php" URIs for you if you wish.) YOU MAKE UNJUSTIFIED ASSUMPTIONS -- this is THE primary reason for the mistakes you alleged in your article -- WHAT AN IRONY!!!!

stabbles 10y ago

It also has an include.php file: https://lastpass.com/include.php https://lastpass.com/include.php

curiousgal 10y ago

I have much faith in Dropbox' security so I use 1password (uses Dropbox for online storage). It even works on Linux with Wine and Chrome. (except for auto-submit, but I don't use that feature anyway.)

kybernetyk 10y ago

Wow, what an non-argument. I expected some kind of security analysis. Not a "look at them using file extensions" rant which doesn't say anything about the quality of their software at all. How got this submission to 30 points? Voting ring?

ben_jones 10y ago
Blind passion runs stronger at late hours of the night? Europeans hate centralized, third-party, password management? So many variables that could explain it.
CiPHPerCoder 10y ago
> Not a "look at them using file extensions" rant which doesn't say anything about the quality of their software at all. See https://news.ycombinator.com/item?id=12884523 https://news.ycombinator.com/item?id=12884523 for how the detail covered in the article could adversely affect the quality of their software and the security of their service. I wish they had done more research in this realm, seems like they pressed "publish" far too early.

elFarto 10y ago

I've been using Enpass[1] for a while now and it's great. Free desktop clients (Windows, macOS and Linux), and $10 for the mobile app. Supports a bunch of cloud services for sync. [1] https://www.enpass.io/ https://www.enpass.io/

Semaphor 10y ago
I looked into enpass recently and it really looks nice. But after playing around a bit with it, I just found it too lacking in the feature department compared to KeePass [1] and it's browser extensions. [1] http://keepass.info/ http://keepass.info/

stratosgear 10y ago

I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... I have personally have found bliss in Password Hasher Plus (https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd https://chrome.google.com/webstore/detail/password-hasher-pl...) (Hash it! App on android) Basically it hashes your password together with the domain name you want to login in together with a very long private key to generate an arbitrarily long password as a final pass. The chrome extension and app provide some nice utilities to make all this pretty easy and transparent to use. Advantages: * Only one password to remember. * Different final passwords for all services * Hashed with a unique private key * Arbitrarily generate any pasdword length you want * Passwords are not shared with anyone (automatically generated on your device) * Plus many more (that i will do a bad job describing) Disadvantages: * More of a script approach not a full blown application (matters to some) * Different approach for desktop and mobile (extension vs app)

ZoFreX 10y ago
> I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survive the website being owned. I use LastPass and I'm not sharing my passwords with them, I'm sharing my encrypted passwords with them. It's an important consideration! 2) You don't want to trust a third party so you use a Chrome extension that is made by a third party and has permission to access any website? You are trusting a third party.
- stratosgear 10y ago
  Well, I know exactly what goes in the Chrome extension (https://github.com/ericwoodruff/passwordhasherplus https://github.com/ericwoodruff/passwordhasherplus) or the android app (https://github.com/ginkel/hashit https://github.com/ginkel/hashit) The point is that I do NOT want to store (even hashed) passwords with a third party in the hopes that they will be able to protect my passwords, when I can generate them on the spot from the device I'm using. But that's just me. My post was just a comment on how people find third party password managers so secure. I can't be the only paranoid about this...

MaKleSoft 10y ago

What alarms me much more than the appearance of bad code quality is the fact that we have no direct way of checking what's actually going on under the hood and what impact it has on security. If there is one axiomatic requirement for the trustworthiness of a password manager, it's that it must be open source. That way people don't have to guess at the code quality from their use of file extensions. Lots of people seem to have a huge phobia of storing their passwords in the cloud and I have the feeling that the provenly poor security of Lastpass [1] has contributed significantly to this. <shameless plug>Padlock[2] is a penetration-tested, open source alternative that also has a (open source!) cloud storage solution[3] that you can even deploy to your own server if you don't trust the official one. All of this based on zero-knowledge (the server has no way of acquiring your master password or reading any of your clear-text data). Disclaimer: I'm the main contributor.</shameless plug> [1]: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d... [2]: https://padlock.io https://padlock.io [3]: https://github.com/maklesoft/padlock-cloud https://github.com/maklesoft/padlock-cloud

gempir 10y ago
That's exactly what i was trying to say with the article :) serving .php files directly is not security issue, but as you said nobody knows what's going on under the hood.
lestatcheb 10y ago
Padlock doesn't work in Firefox?
- MaKleSoft 10y ago
  Yeah, currently the only way to run it on desktop is through the Chrome app. A native, standalone desktop app for all major platforms will be released very soon, though.

halilim 10y ago

Facebook was doing something similar (.php URL's). Should we avoid Facebook? Maybe. But for this reason? I was a PHP dev for nearly a decade and you can't possibly know the ways I hate it (unless you're a PHP dev too); but this is a very poor form of criticism.

webwanderings 10y ago

iCloud's Notes are not bad as a solution for simple password storage solution. No need to worry about syncing and it is secured.

ZoFreX 10y ago
Doesn't that mean Apple has access to all your passwords, though?
- webwanderings 10y ago
  iCloud is encrypted, isn't it? You can also double lock your Notes with its own password.
  - SallySwanSmith 10y ago
    or you just use the iCloud keychain, you know, the iCloud component designed to store passwords securely...
    - webwanderings 10y ago
      Yes, but keychain is not there on the online portal of iCloud, which wouldn't be helpful if you're on different OS.

butz 10y ago

Using frontend web technologies for keeping passwords safe is not the best idea. Lastpass has "restricted" password copy functionality, if passwords were shared. But it actually loads password to input field with type set to password. Open up inspect tools, change input field type to text and you have a password in plain text, you can easily copy.

simias 10y ago

I've been working on a reimplementation of the LastPass command line client lately and while I was also a bit surprised when I found out that the login URL was "https://lastpass.com/login.php" https://lastpass.com/login.php" I didn't really think much of it. In the end the server side of things is really not critical since it only stores an encrypted version of the blob. Sure, it looks a bit sloppy, but if it works... The real weakness of lastpass is and always will be the clients, in particular those browser extensions that can update in the background and are difficult to audit. But these browser extensions are also the reason I'm not using something like "pass" or even a custom GnuPG-based solution. It just works on any machine regardless of the OS without any hassle. So far the C code of the CLI client looks decent enough. Not amazing but nothing really stands out, besides maybe the key derivation algorithm they use: they query the server for the number of rounds to use when deriving the keys and if the server replies "1" they fallback on a single round of SHA256 salted with the username. It's probably some kind of compatibility mode but that seems rather weak to me. If somebody compromised the server they could have it tell the client that the number of rounds for any client is 1 which will cause the clients to send a "simple" SHA256 of username+password which will be a lot easier to bruteforce than the default 5000 rounds of PBKDF2.

_kyran 10y ago

There's also a https://lastpass.com/db.php https://lastpass.com/db.php

chiefalchemist 10y ago

Considering the general insecurity and hackability of the internet, this is probably more of a symptom than a disease. It's the digital equivalent of the cure for cancer. 'cept the internet is printing too much money for too many peopke and no one wants to muck with that, even if it's the right thing to do. Everything will OK. Just don't be evil ;)

chiefalchemist 10y ago

Might it be possible to kinda fake a PWM with some sort of encryption and Git for backup / cross device access?