4 ms·

You should avoid lastpass (and similar services) because you are giving all your credentials to a third party to be remotely stored. Also lastpass has a histor

You should avoid lastpass (and similar services) because you are giving all your credentials to a third party to be remotely stored. Also lastpass has a history of security issues: https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues If you want to use a password manager, you should use something like pass[1]. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/

CiPHPerCoder 10y ago
I don't disagree (although I prefer KeePassX), but let's be charitable: - What LastPass gets is ciphertext, not your unencrypted passwords. Important detail. - There are opportunities for LastPass to receive your master password (i.e. if you enter it on their website). I haven't audited LastPass. After Tavis Ormandy looked at it earlier this year and published his findings, I wouldn't be surprised if the crypto was totally and hopelessly broken. But to eschew the fact that their app does encrypt passwords before sending them to their servers isn't fair.
- angry-hacker 10y ago
  But nothing theoretically stop them from getting your master password. You have to put a lot of faith in them and the question why would you always remains.
  - pfg 10y ago
    To be fair, that's true for just about any password manager unless you audit the code and use reproducible builds. It just tends to be easier to place these kind of backdoors in web apps because the code is basically re-downloaded each time ... which is worrisome given their, uhm, antiquated app "architecture." Native apps, on the other hand, tend to have signed updates and such. I'd pick a native password manager over a web-based one any day, but the theoretical risk is still there.
  - dogma1138 10y ago
    Nothing stops anyone from getting your master password, including Google, Microsoft, Apple, Firefox etc.. The thing here is motive and incentive, LastPass has not motive or incentive to handle your passwords in an unencrypted form, it has no motive or incentive to want to know your master password ever since both of those things are just a huge liability for them. Every password manager, every browser, every OS, every hardware can be backdoored and compromised by their maintainer/manufacturer in a way nearly impossible to detect even in some cases if the source code is fully or partially available, heck how many people ever verify that the package they just grabbed via the package manager was built using an unaltered version of the source code? To function you need to have some level of trust, you can try to add additional security measures e.g. like not storing highly sensitive passwords in a password manager but even then really depending on how you maintain those passwords you are likely to increase your risk rather than reduce it.
    - chiefalchemist 10y ago
      Spot on. And it's certainly better than what chrome does, or at least used to do. Which is no encryption at all. The only other option is to use something like this to-do it yourself. github.com/ezWebDevTools/ezCryptoJS
  - deleted 10y ago
    [deleted]
alkonaut 10y ago
Pass doesn't solve the most important issue: passwords available on all devices, most importantly mobile. Credentials being "remotely stored" would be the case regardless of if you run any other viable storage such as Dropbox. I suppose you can remotely store on your own server, but I'm about a million times more likely to screw up than even a bad cloud company or password manager - so that's a non starter. I'm sure there are alternatives to LastPass/1pass and similar, but storing encrypted passwords in a local file solves only a small part of the problem.
- lmns 10y ago
  > Pass doesn't solve the most important issue: passwords available on all devices, most importantly mobile. https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios
  - alkonaut 10y ago
    Thanks, I think it's still not quite there. I either have to use Cydia(?) or have my linux machine serve(?) the passwords to my mobile device. The former isn't going to happen to most people and the latter is going to be a lot more insecure than 1Pass/Lastpass (because I sure can't set up a secure web server with certs etc). What people need is centralized & turnkey password management. This has drawbacks , but remember: it competes on security with the only other alternative: using the same password for all sites - That's the most common password management system out there!
- darfs 10y ago
  I keep it sync on a virtual Server with sftp, where i Upload the db, sshfs to Mount it - the Directory which contains the Database, localy on Linux, or easySSHFS on Android. To Set this up i need for every new device around... 10 minutes It isn't THAT hard. Im pretty sure there is a dropbox(or $urCloudProvider) App that Can sync your files too :-)
  - tmikaeld 10y ago
adilparvez 10y ago
I've been using this on the desktop, and Password Store + OpenKeychain on Android, both are very polished apps. This setup works great with a YubiKey. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html https://fossdroid.com/a/password-store.html
- alkonaut 10y ago
  I'm on Windows + iOS (which says a lot about how much tinkering I like to do with tech :D ). When it comes to ease of setup and general UX polish every open solution leaves a lot to be desired. In the choice between insecure and cumbersome, insecure wins every time. Case in point: gmail is what people want in terms of usability. A more secure solution (such as any pgp solution on standalone mail client) is not really an option.

CiPHPerCoder 10y ago

I don't disagree (although I prefer KeePassX), but let's be charitable: - What LastPass gets is ciphertext, not your unencrypted passwords. Important detail. - There are opportunities for LastPass to receive your master password (i.e. if you enter it on their website). I haven't audited LastPass. After Tavis Ormandy looked at it earlier this year and published his findings, I wouldn't be surprised if the crypto was totally and hopelessly broken. But to eschew the fact that their app does encrypt passwords before sending them to their servers isn't fair.

angry-hacker 10y ago
But nothing theoretically stop them from getting your master password. You have to put a lot of faith in them and the question why would you always remains.
- pfg 10y ago
  To be fair, that's true for just about any password manager unless you audit the code and use reproducible builds. It just tends to be easier to place these kind of backdoors in web apps because the code is basically re-downloaded each time ... which is worrisome given their, uhm, antiquated app "architecture." Native apps, on the other hand, tend to have signed updates and such. I'd pick a native password manager over a web-based one any day, but the theoretical risk is still there.
- dogma1138 10y ago
  Nothing stops anyone from getting your master password, including Google, Microsoft, Apple, Firefox etc.. The thing here is motive and incentive, LastPass has not motive or incentive to handle your passwords in an unencrypted form, it has no motive or incentive to want to know your master password ever since both of those things are just a huge liability for them. Every password manager, every browser, every OS, every hardware can be backdoored and compromised by their maintainer/manufacturer in a way nearly impossible to detect even in some cases if the source code is fully or partially available, heck how many people ever verify that the package they just grabbed via the package manager was built using an unaltered version of the source code? To function you need to have some level of trust, you can try to add additional security measures e.g. like not storing highly sensitive passwords in a password manager but even then really depending on how you maintain those passwords you are likely to increase your risk rather than reduce it.
  - chiefalchemist 10y ago
    Spot on. And it's certainly better than what chrome does, or at least used to do. Which is no encryption at all. The only other option is to use something like this to-do it yourself. github.com/ezWebDevTools/ezCryptoJS
- deleted 10y ago
  [deleted]

alkonaut 10y ago

Pass doesn't solve the most important issue: passwords available on all devices, most importantly mobile. Credentials being "remotely stored" would be the case regardless of if you run any other viable storage such as Dropbox. I suppose you can remotely store on your own server, but I'm about a million times more likely to screw up than even a bad cloud company or password manager - so that's a non starter. I'm sure there are alternatives to LastPass/1pass and similar, but storing encrypted passwords in a local file solves only a small part of the problem.

lmns 10y ago
> Pass doesn't solve the most important issue: passwords available on all devices, most importantly mobile. https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios
- alkonaut 10y ago
  Thanks, I think it's still not quite there. I either have to use Cydia(?) or have my linux machine serve(?) the passwords to my mobile device. The former isn't going to happen to most people and the latter is going to be a lot more insecure than 1Pass/Lastpass (because I sure can't set up a secure web server with certs etc). What people need is centralized & turnkey password management. This has drawbacks , but remember: it competes on security with the only other alternative: using the same password for all sites - That's the most common password management system out there!
darfs 10y ago
I keep it sync on a virtual Server with sftp, where i Upload the db, sshfs to Mount it - the Directory which contains the Database, localy on Linux, or easySSHFS on Android. To Set this up i need for every new device around... 10 minutes It isn't THAT hard. Im pretty sure there is a dropbox(or $urCloudProvider) App that Can sync your files too :-)
- tmikaeld 10y ago

adilparvez 10y ago

I've been using this on the desktop, and Password Store + OpenKeychain on Android, both are very polished apps. This setup works great with a YubiKey. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html https://fossdroid.com/a/password-store.html

alkonaut 10y ago
I'm on Windows + iOS (which says a lot about how much tinkering I like to do with tech :D ). When it comes to ease of setup and general UX polish every open solution leaves a lot to be desired. In the choice between insecure and cumbersome, insecure wins every time. Case in point: gmail is what people want in terms of usability. A more secure solution (such as any pgp solution on standalone mail client) is not really an option.