7 ms·
The high number of vulnerabilities that keep being found in LastPass (including some that are not publicly disclosed) forced me to jump ship a while ago.
by svenfaw 10y ago
The high number of vulnerabilities that keep being found in LastPass (including some that are not publicly disclosed) forced me to jump ship a while ago.
- mikecb 10y agoConcern about code quality is legitimate, and vulns discovered is one metric for that, but I worry that hopping to the unreviewed (and therefore lacking vuln disclosures) app is even worse. But I don't use lastpass.
- Analemma_ 10y agoOther managers have been reviewed, and found better success than LastPass. I (finally) signed up for a password manager a little while ago, and after some evaluation chose 1Password. A big part of that decision was that they have been reviewed/audited and there were a couple vulnerabilities found, but they were all minor, which indicates to me the system is pretty secure. The nature of the bugs was also comforting in that they seemed like small oversights, compared to a lot of the LastPass bugs which seem like "holy shit how did you let this happen".
- awirth 10y agoWhat other ones have been reviewed? I'd be interested to read the audit reports.
- mdekkers 10y agosame here. Trialling Dashlane, but not quite convinced yet..
- devopsproject 10y agowhat is your hesitation with dashlane?
- jonathonf 10y agoNo Linux support might be a biggie.
- devopsproject 10y agoNo linux support seems like hard deal breaker for a linux user. His comment indicated he was questioning the security practices or some other technical reason
- mdekkers 10y agocost, and clunky yubikey support. I can enable a yubikey with some hoop-jumping but this will impact ease of use on my mobile clients. I still need to look into the team functionality. I have used Lastpass for many years privately and for my business, and it is pretty deeply stuck in everything we do, so evaluation takes time.
- xxkylexx 10y agoIf you're interested in an open source option that compares quite well to the LastPass feature-set, check out bitwarden: https://bitwarden.com/ https://bitwarden.com/ (note: I am the lead developer).
- bgrohman 10y agoHi, I'm considering giving bitwarden a try. I'm curious, though - are there any 3rd party security scans for the product? And (only half-joking) can we get Tavis to review it?
- xxkylexx 10y agoThere have not been any formal third-party audits done that we can document yet, however, the product is entirely open source (from the database, backend apis, to all client-side applications). https://github.com/bitwarden https://github.com/bitwarden . Anyone is free to audit (and contribute) as much as they'd like. If you can get Travis (or any security researcher) interested in reviewing our products we would love to work with him.
- devopsproject 10y agoHow are you making money off of this?
- xxkylexx 10y ago
- brynjolf 10y agoIt uses soo much memory and there is obvious UX mistakes everywhere like you can add new sites in client but not generate passwords. Dashlane really worried me sadly.
- larsnystrom 10y agoCan you please provide some references to the "high number of vulnerabilities"? I've only heard of one or two, but those were promptly fixed.
- deleted 10y ago[deleted]
- UnoriginalGuy 10y agoThey cannot because it is a fictional claim. I've just been researching it and most of the recent vulnerabilities (before this one) have been either minor in severity or "working as intended" (like saving your master password and using PIN unlock, which they warn you is insecure, and relies on device encryption to protect your master password). Today's issue is by far the most serious in at least the last year.
- tptacek 10y agoI have the same concern.
- xbryanx 10y agoIt's always worth remembering that using something like LastPass should be compared with the status quo that it often fixes (same password for everything, post-it notes, teams emailing passwords around).
- lazaroclapp 10y agoSure. Which is why Last Pass makes you safer if you use it for the long tail of rarely used non-critical passwords. The problem is once you are using Last Pass for those, it becomes more and more tempting to use it for passwords that actually matter, and for those you really really don't want to be using an online password manager. In fact, for the average person, I am not sure a post-it note full of passwords in their home is a bigger risk than an online password manager. Sure, if someone breaks into their house they are screwed, and that is a relatively easy attack. But on the other hand, any bulk breach leaves them unaffected. A notebook full of plain text passwords in a drawer in your home and a shared memorized prefix that must be combined with the passwords on the list to get the full password seems strictly more secure than a password manager (although slightly less convenient).
- saghm 10y ago> A notebook full of plain text passwords in a drawer in your home and a shared memorized prefix that must be combined with the passwords on the list to get the full password seems strictly more secure than a password manager (although slightly less convenient). This actually sounds pretty good; I might start recommending this to non-technical friends and family. EDIT: phone auto-completed "non-technical" to "non-profit technical"
- fauigerzigerk 10y agoWhy is that a relevant comparison for anyone interested in their own security? It seems to me that the comparison that matters is with my own status quo and with other options that I might consider, not with some average status quo.
- problems 10y agoAgreed - I was tolerant for quite a while as the vulnerabilities seemed obscure and the handling seemed good, but they kept cropping up in more and more obvious ways. When KeePass got a crypto upgrade recently I jumped ship. I loved LastPass for the sync, but SyncThing to my phone has made it all too easy to get away without it.