3 ms·
Software needs to be Secure by Design Secure by Default Secure by Deployment I can't comment on Deployment, but the defaults are not secure (defaults to aut
by csours 10y ago
Software needs to be
Secure by Design
Secure by Default
Secure by Deployment
I can't comment on Deployment, but the defaults are not secure (defaults to autofill info), and it's not secure by design - surface area is much too large.
For me to trust lastpass, I will have to see real changes on those.
- scrollaway 10y agoI highly recommend KeepassX instead. https://www.keepassx.org/ https://www.keepassx.org/ It's a local db only, you're in full control of where it is, where it goes. It's one of my favourite pieces of software actually: Simple enough that my aunt is using it, secure enough that I'm using it for my company's accounts.
- interfixus 10y agoKeePassXC is a fork of the 1.x version. Fixes all the annoyances that the official 2.x series somehow never got around to. Recommended. https://keepassxc.org/ https://keepassxc.org/
- scrollaway 10y agoxc is a fork of the 2.x series. I would possibly recommend it, but it's less battle-tested and they're aiming to enable the HTTP server by default which I think is a mistake. I'm using it, but disabling that stuff. (Either way the databases are compatible with one-another, so it's up to you what client you use)
- interfixus 10y agoYou're right. I'm thinking 1.x because it has kept and augmented all the useful 1.x behavior which the regular 2.x somehow managed to butcher.
- deleted 10y ago[deleted]
- iraklism 10y agoAnd you can always store your DB in a "cloud" drive. This is what I do and I'm fairly happy with it. Granted it doesn't have the features and ease-of use of online password managers, but my workflow allows me to live with that tradeoff.
- nirvdrum 10y agoI have quite a few sites I need to share credentials to with my wife, but we each have other credentials we don't need to share. Is there straightforward workflow for that with any of the KeePass variants?
- scrollaway 10y agoOne keepass db per person for your personal accounts. One separate keepass db for your shared accounts.
- nirvdrum 10y agoAre there any special considerations that need to be made with regards to synchronization? I'd expect the DBs to be mostly read-only, so maybe it won't matter much. But I'd hate for a write conflict to leave things in an inconsistent state. Edit - Thinking about it more, I suppose it really depends on what each cloud provider does.
- scrollaway 10y agoYeah you gotta make sure you're syncing the db properly when you write to it. It works ok with two people, but it doesn't scale much further than that.
- nirvdrum 10y agoThanks for the info. I'll give it a shot.
- allenz 10y agoSecurity isn't an absolute thing. Just the fact that you use the internet indicates that you're willing to sacrifice a significant amount of security, which is clearly worth it to you. Presumably most LastPass users prefer autofill browser integration.
- csours 10y agoGoing outside makes me less secure, but I usually put on clothes and shoes before I do it.
- criddell 10y agoAnd a helmet and gloves?
- paulryanrogers 10y agoSometimes, yes. Usually for the bicycle and the cold.