17 ms·

I want to ask a serious question: considering there have been some major issues with LastPass, like this one, showing up in recent memory, why do people (at lea

by yladiz 10y ago

I want to ask a serious question: considering there have been some major issues with LastPass, like this one, showing up in recent memory, why do people (at least here on HN) stick with it despite these major issues? There are other options out there, depending on your use case (I use 1Password, which seems to have fared much better as far as vulnerabilities), so why keep the same software when vulnerabilities continue to be found in it? Is there a special feature in LastPass?

arjie 10y ago
I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so. It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.
- TheDong 10y ago
  That's not an apt comparison. Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass. The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews. 1password has more recommendations by security engineers, and has been reviewed in significant depth. Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.
  - arjie 10y ago
    Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.
  - DiNovi 10y ago
    I like the idea that you are just walking around asking security engineers for password managers
    - tptacek 10y ago
      That comment is not wrong.
    - montycantsin 10y ago
      Is that weird?
  - ryankask 10y ago
    1password has changed recently. Are security experts recommending their newer cloud subscription service or the older version that stored the vault on Dropbox or another storage service (or both)?
  - brynjolf 10y ago
    I mean, you want us to take the word of people you asked? You could just be a shill for 1password as well.
- detaro 10y ago
  How do you tell that LastPass has been vetted better than the alternatives? "Experts looked at X and found no major issues" normally doesn't get very much attention, and potentially isn't published at all, or just reflected in recommendations. (some of it is of course also depends on the threat-model: something with no (or with more caveats, an explicitly activated browser integration) is way less likely to be vulnerable against attacks launched from a website, reviewed or not)
  - arjie 10y ago
    I do not know this. If you're informed, I would appreciate your advice.
paulryanrogers 10y ago
For me it's the ease of adding new sites, which is frequent. As a long time Keepass user I know the pain of generating often requiring navigating two programs for every sign up. In light of recent revelations I'm considering going back. And possibly telling friends and family to maintain a separate LastPass for their important stuff, in a separate browser.
- yladiz 10y ago
  I would check out 1Password. I can't compare LastPass and 1Password since I have never used LastPass, but adding a new login/password for a website is pretty easy in 1Password (just open the app and choose generate password, as long as the extension is installed on the browser it understands the website). It also prompts you if you login without generating a password.
tenken 10y ago
Why not!? So they mess up. I figure all the other password managers either have similar issues and either weren't disclosed, or fixed before the issue was publicly found. No software is bug free. While they have issues -- at least this is an issue I know that's been addressed.
- TheDong 10y ago
  That's fallacious logic. "This password manager is bad, so all the others must be just as bad"... yeah. Other password managers, like 1Password, are more frequently recommended by security engineers. They're also not built entirely as browser extensions and interfaces, which massively increases attack surface. Maybe the reason other password managers aren't tire-fires is because they're designed better and are more secure, not because they have more unknown issues.
  - Azkar 10y ago
    There are tradeoffs to all software. I use lastpass with a yubikey for 2fa and I feel safe enough. I briefly looked at other password managers when I was evaluating lastpass, but convenience won out for me. I haven't looked at moving out of lastpass, but 3 years ago no other password manager came close to the mobile and platform support that lastpass had. I considered keeping my passwordDB local, but the inconvenience of needing it and not having it wasn't it worth it to me. Do I know I'm making a tradeoff? Yes. I also have a nasty habit of setting things up on a local server and then never updating it. Instead I decided that lastpass was worth the $12/year so I wouldn't have to manage anything locally. So while lastpass may not be perfect security, I'm a lot better off than I was three years ago when I used the same few passwords everywhere. It also helps me share passwords with my wife, so that's nice.
regecks 10y ago
For me, it is because I have shared folders for credential management for various jobs and it would be way too hard to get everyone to migrate. In fact, I am not aware of any other solution that matches LastPass functionality. I have changed my behavior to just using lastpass-cli and a self-written Go/Qt GUI wrapper over the CLI - https://github.com/alexzorin/lpass-ui https://github.com/alexzorin/lpass-ui - (only builds on Linux sorry) to protect myself from the problems of the browser extension.
bloaf 10y ago
You mean this 1Password? https://bugs.chromium.org/p/project-zero/issues/detail?id=888 https://bugs.chromium.org/p/project-zero/issues/detail?id=88...
- daenney 10y ago
  Yes. That one. No one claims they didn't have any bugs of their own, but they tend to fare better. That bug also only affects Windows users and is only locally exploitable, compared to LastPass which is pretty much always RCE. Just b/c they also have a bug doesn't make them any worse than anyone else or diminish their track record in general. And contrary to just about everyone else LastPass doesn't care to notify you of updates or have the auto-update mechanism on.
calculi 10y ago
LastPass user here, the reason why I choose LastPass is it's convenient and _not_ because it's safe. A common misconception is that softwares like LastPass/Keepass should be extremely secure, resist to any kind of hacking/exploiting, so that I can store all my passwords in it. Let face it, that's not realistic. The practical way is: 1, for non-critical accounts use the most convenient and relatively safer one, like LastPass/OpenID/etc. 2, for cirtical ones(like bank account, major email account) burn a strong passwords inside your brain and combine it with 2FA. Do not trust any one/software when something really matters to you.
city41 10y ago
A similar question I have is why use a browser extension for your password manager? I use 1Password as well, and if I need a password I just head into 1Password Mini. It's convenient enough, simple, and completely eliminates this attack vector.
- tempestn 10y ago
  Because it's extremely convenient. When this bug was first reported a few days ago, I disabled the Lastpass browser extension and started copying and pasting passwords from the vault, basically as you describe. It's been a very noticeable inconvenience, to the extent that I probably would have turned it back on soon even without a fix.
  - city41 10y ago
    I'd argue convenience isn't really the point of password managers. Extremely convenient would be using the same password everywhere or letting your browser save them. I've never used LastPass, but 1Password Mini is pretty convenient. It's always ready to go in the menu bar, and once you enter your password it stays unlocked for a good while.
Afforess 10y ago
>why do people (at least here on HN) stick with it despite these major issues? Before I switched to lastpass, I had maybe 10 different passwords I shared across 100 sites. This was terrible, and now that I use Lastpass, every password is unique. So I use Lastpass because its an incremental improvement. Is 1Password an incremental improvement over lastpass? I'm not convinced. It might be a tiny bit more secure, but nowhere near the gain in security I had from 10 re-used passwords -> all unique randomly generated 20+ char passwords. The cost of switching is high and so it would have to be enough of an improvement to justify the switchover.
- an_account_name 10y ago
  I recently switched. There's a LastPass import option, and it took about 20 minutes to get all my devices synced up. The cost of switching may not be so high, depending on how you use LastPass (if you use their Enterprise features, for example, it would be higher).
- kevin_thibedeau 10y ago
  > 10 different passwords I shared across 100 sites. This was terrible That isn't terrible so long as the email linked to them has a unique, strong password. How many of those sites need the highest level of vigilance?
gnopgnip 10y ago
The alternative is either going back to remembering passwords, sharing passwords between sites, or writing them down, or to switch to a similar product that has fewer features and an unknown amount of bugs with likely worse vulnerabilities because there are fewer people looking for them
- Artemis2 10y ago
  Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]? These two products are very feature-complete (at least for my usage) and have as much attention as LastPass (with for example Tavis Ormandy working on both). They even publish information about their security model[2][3], which LastPass does not. LastPass has proven repeatedly that it is not robust enough for storing passwords. Fewer or less important vulnerabilities reported does not equate to less security. 0: https://1password.com https://1password.com 1: https://www.dashlane.com https://www.dashlane.com 2: https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf https://1password.com/files/1Password%20for%20Teams%20White%... 3: https://www.dashlane.com/download/Dashlane-Security-Whitepaper-V2.8.pdf https://www.dashlane.com/download/Dashlane-Security-Whitepap...
  - chrismonsanto 10y ago
    > Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]? Linux support
    - daenney 10y ago
      Enpass: https://www.enpass.io/apps/linux/ https://www.enpass.io/apps/linux/
      - noja 10y ago
        Enpass ticks all the boxes, except... no-one ever mentions or reviews it. Has there been a security audit? Is it reliable?
jsudhams 10y ago
Cost, 1Password is atleast 3 times the cost. And i use, 2nd factor on most sites + lastpass website only no app or no browser extension. I think using this way it is same as 1Password when it comes to security with 1 3rd of cost..
the8472 10y ago
don't use a browser addon. don't use one with cloud features. that takes away a lot of attack surface.
- Anderkent 10y ago
  And most of the convenience. I don't need a password manager if all I'm using is a single machine - an encrypted file in my homedir would do. It's the syncing of passwords across all devices that is the most useful.
  - the8472 10y ago
    Syncing does not need cloud features built into a password manager.
    - brainfire 10y ago
      How else would it sync automatically?
      - the8472 10y ago
        Syncing of the encrypted store file between devices or your home server when they're in the same network.
        Anderkent 10y ago
        What if they're never on the same network? I don't bring my work machine home, or my personal laptop to work, and yet they have to sync passwords somehow.
tvanantwerp 10y ago
As an enterprise customer, I previously tried getting people to use some Keepass databases available only on the local network. Compliance was roughly zero. The UI frightened people, it didn't integrate well into existing workflows, and, as an admin, I had no good way to segregate users into groups and only give them access to specific password sets. Since moving us to LastPass, compliance is through the roof. Using the browser extension makes it much easier for everyone. Administration is much simpler too. I'm actually considering moving some personal Keepass files to a personal LastPass account, as I now find myself comparatively frustrated when I have to use my Keepass files.
- montycantsin 10y ago
  Compliance with vulnerable software is much, much worse than non-compliance with safer software.
pluma 10y ago
The only good alternative everyone seems to agree on is Keepass. Keepass is useless if you need something that works in a group of people, especially across different devices. I can't speak to the vulnerabilities in 1Password but the reason we decided against 1Password is that the user experience for LastPass (Teams) is much better. There's no point in having a secure tool without compliance and bad UX is a show-stopper. Also the vulnerabilities so far have been mostly non-concerning: 1. The vulnerabilities of the browser extensions generally require the user to access malicious URLs, so they still require some degree of interaction. 2. The actual hacks of LastPass didn't result in any passwords or confidential information being leaked, so they're not very interesting. That 1Password hasn't seen similar disclosures doesn't mean 1Password doesn't have any vulnerabilities, nor that it didn't have them in the past. No software is without faults and so far LastPass has always reacted promptly. That 1Password doesn't have as many recent disclosures may simply mean that Tavis hasn't gotten around to looking at it yet.
brynjolf 10y ago
I used lastas for two years. When my student license expired I tried KeePass, 1password and Dashlane. Dashlane used over 1.2gb of memory, was slow and made no sense. You could add sites in the standalone client but NOT passwords. So you had to use the browser extension to create the password and copy paste it into the client. 1password might be amazing on Mac but on Windows it was so barwbonea I could just use lastpass without the extensions and still get more features. KeePass was fine just a bit cumbersome to integrate and browser integration would sometimes stop working. That being said the UX in lastpass is also horrible and getting worse. It is so slow now with the fancier graphics. I'm still surprised they are all so bad but lastpass is the least annoying to use.
patrec 10y ago
LastPass is terrible, but without alternative, at least if you want cross platform. People keep bringing up KeepPass, but apart from the bad UX, it's developers seem to be even more incompetent concerning basic security design. That leaves 1Password, which also hasn't covered itself in glory security-wise, but appears to be marginally more competent. No linux client though.

by yladiz 10y ago

arjie 10y ago

I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so. It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.

TheDong 10y ago
That's not an apt comparison. Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass. The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews. 1password has more recommendations by security engineers, and has been reviewed in significant depth. Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.
- arjie 10y ago
  Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.
- DiNovi 10y ago
  I like the idea that you are just walking around asking security engineers for password managers
  - tptacek 10y ago
    That comment is not wrong.
  - montycantsin 10y ago
    Is that weird?
- ryankask 10y ago
  1password has changed recently. Are security experts recommending their newer cloud subscription service or the older version that stored the vault on Dropbox or another storage service (or both)?
- brynjolf 10y ago
  I mean, you want us to take the word of people you asked? You could just be a shill for 1password as well.
detaro 10y ago
How do you tell that LastPass has been vetted better than the alternatives? "Experts looked at X and found no major issues" normally doesn't get very much attention, and potentially isn't published at all, or just reflected in recommendations. (some of it is of course also depends on the threat-model: something with no (or with more caveats, an explicitly activated browser integration) is way less likely to be vulnerable against attacks launched from a website, reviewed or not)
- arjie 10y ago
  I do not know this. If you're informed, I would appreciate your advice.

paulryanrogers 10y ago

For me it's the ease of adding new sites, which is frequent. As a long time Keepass user I know the pain of generating often requiring navigating two programs for every sign up. In light of recent revelations I'm considering going back. And possibly telling friends and family to maintain a separate LastPass for their important stuff, in a separate browser.

yladiz 10y ago
I would check out 1Password. I can't compare LastPass and 1Password since I have never used LastPass, but adding a new login/password for a website is pretty easy in 1Password (just open the app and choose generate password, as long as the extension is installed on the browser it understands the website). It also prompts you if you login without generating a password.

tenken 10y ago

Why not!? So they mess up. I figure all the other password managers either have similar issues and either weren't disclosed, or fixed before the issue was publicly found. No software is bug free. While they have issues -- at least this is an issue I know that's been addressed.

TheDong 10y ago
That's fallacious logic. "This password manager is bad, so all the others must be just as bad"... yeah. Other password managers, like 1Password, are more frequently recommended by security engineers. They're also not built entirely as browser extensions and interfaces, which massively increases attack surface. Maybe the reason other password managers aren't tire-fires is because they're designed better and are more secure, not because they have more unknown issues.
- Azkar 10y ago
  There are tradeoffs to all software. I use lastpass with a yubikey for 2fa and I feel safe enough. I briefly looked at other password managers when I was evaluating lastpass, but convenience won out for me. I haven't looked at moving out of lastpass, but 3 years ago no other password manager came close to the mobile and platform support that lastpass had. I considered keeping my passwordDB local, but the inconvenience of needing it and not having it wasn't it worth it to me. Do I know I'm making a tradeoff? Yes. I also have a nasty habit of setting things up on a local server and then never updating it. Instead I decided that lastpass was worth the $12/year so I wouldn't have to manage anything locally. So while lastpass may not be perfect security, I'm a lot better off than I was three years ago when I used the same few passwords everywhere. It also helps me share passwords with my wife, so that's nice.

regecks 10y ago

For me, it is because I have shared folders for credential management for various jobs and it would be way too hard to get everyone to migrate. In fact, I am not aware of any other solution that matches LastPass functionality. I have changed my behavior to just using lastpass-cli and a self-written Go/Qt GUI wrapper over the CLI - https://github.com/alexzorin/lpass-ui https://github.com/alexzorin/lpass-ui - (only builds on Linux sorry) to protect myself from the problems of the browser extension.

bloaf 10y ago

You mean this 1Password? https://bugs.chromium.org/p/project-zero/issues/detail?id=888 https://bugs.chromium.org/p/project-zero/issues/detail?id=88...

daenney 10y ago
Yes. That one. No one claims they didn't have any bugs of their own, but they tend to fare better. That bug also only affects Windows users and is only locally exploitable, compared to LastPass which is pretty much always RCE. Just b/c they also have a bug doesn't make them any worse than anyone else or diminish their track record in general. And contrary to just about everyone else LastPass doesn't care to notify you of updates or have the auto-update mechanism on.

calculi 10y ago

LastPass user here, the reason why I choose LastPass is it's convenient and _not_ because it's safe. A common misconception is that softwares like LastPass/Keepass should be extremely secure, resist to any kind of hacking/exploiting, so that I can store all my passwords in it. Let face it, that's not realistic. The practical way is: 1, for non-critical accounts use the most convenient and relatively safer one, like LastPass/OpenID/etc. 2, for cirtical ones(like bank account, major email account) burn a strong passwords inside your brain and combine it with 2FA. Do not trust any one/software when something really matters to you.

city41 10y ago

A similar question I have is why use a browser extension for your password manager? I use 1Password as well, and if I need a password I just head into 1Password Mini. It's convenient enough, simple, and completely eliminates this attack vector.

tempestn 10y ago
Because it's extremely convenient. When this bug was first reported a few days ago, I disabled the Lastpass browser extension and started copying and pasting passwords from the vault, basically as you describe. It's been a very noticeable inconvenience, to the extent that I probably would have turned it back on soon even without a fix.
- city41 10y ago
  I'd argue convenience isn't really the point of password managers. Extremely convenient would be using the same password everywhere or letting your browser save them. I've never used LastPass, but 1Password Mini is pretty convenient. It's always ready to go in the menu bar, and once you enter your password it stays unlocked for a good while.

Afforess 10y ago

>why do people (at least here on HN) stick with it despite these major issues? Before I switched to lastpass, I had maybe 10 different passwords I shared across 100 sites. This was terrible, and now that I use Lastpass, every password is unique. So I use Lastpass because its an incremental improvement. Is 1Password an incremental improvement over lastpass? I'm not convinced. It might be a tiny bit more secure, but nowhere near the gain in security I had from 10 re-used passwords -> all unique randomly generated 20+ char passwords. The cost of switching is high and so it would have to be enough of an improvement to justify the switchover.

an_account_name 10y ago
I recently switched. There's a LastPass import option, and it took about 20 minutes to get all my devices synced up. The cost of switching may not be so high, depending on how you use LastPass (if you use their Enterprise features, for example, it would be higher).
kevin_thibedeau 10y ago
> 10 different passwords I shared across 100 sites. This was terrible That isn't terrible so long as the email linked to them has a unique, strong password. How many of those sites need the highest level of vigilance?

gnopgnip 10y ago

The alternative is either going back to remembering passwords, sharing passwords between sites, or writing them down, or to switch to a similar product that has fewer features and an unknown amount of bugs with likely worse vulnerabilities because there are fewer people looking for them

Artemis2 10y ago
Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]? These two products are very feature-complete (at least for my usage) and have as much attention as LastPass (with for example Tavis Ormandy working on both). They even publish information about their security model[2][3], which LastPass does not. LastPass has proven repeatedly that it is not robust enough for storing passwords. Fewer or less important vulnerabilities reported does not equate to less security. 0: https://1password.com https://1password.com 1: https://www.dashlane.com https://www.dashlane.com 2: https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf https://1password.com/files/1Password%20for%20Teams%20White%... 3: https://www.dashlane.com/download/Dashlane-Security-Whitepaper-V2.8.pdf https://www.dashlane.com/download/Dashlane-Security-Whitepap...
- chrismonsanto 10y ago
  > Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]? Linux support
  - daenney 10y ago
    Enpass: https://www.enpass.io/apps/linux/ https://www.enpass.io/apps/linux/
    - noja 10y ago
      Enpass ticks all the boxes, except... no-one ever mentions or reviews it. Has there been a security audit? Is it reliable?

jsudhams 10y ago

Cost, 1Password is atleast 3 times the cost. And i use, 2nd factor on most sites + lastpass website only no app or no browser extension. I think using this way it is same as 1Password when it comes to security with 1 3rd of cost..

the8472 10y ago

don't use a browser addon. don't use one with cloud features. that takes away a lot of attack surface.

Anderkent 10y ago
And most of the convenience. I don't need a password manager if all I'm using is a single machine - an encrypted file in my homedir would do. It's the syncing of passwords across all devices that is the most useful.
- the8472 10y ago
  Syncing does not need cloud features built into a password manager.
  - brainfire 10y ago
    How else would it sync automatically?
    - the8472 10y ago
      Syncing of the encrypted store file between devices or your home server when they're in the same network.
      - Anderkent 10y ago
        What if they're never on the same network? I don't bring my work machine home, or my personal laptop to work, and yet they have to sync passwords somehow.

tvanantwerp 10y ago

As an enterprise customer, I previously tried getting people to use some Keepass databases available only on the local network. Compliance was roughly zero. The UI frightened people, it didn't integrate well into existing workflows, and, as an admin, I had no good way to segregate users into groups and only give them access to specific password sets. Since moving us to LastPass, compliance is through the roof. Using the browser extension makes it much easier for everyone. Administration is much simpler too. I'm actually considering moving some personal Keepass files to a personal LastPass account, as I now find myself comparatively frustrated when I have to use my Keepass files.

montycantsin 10y ago
Compliance with vulnerable software is much, much worse than non-compliance with safer software.

pluma 10y ago

The only good alternative everyone seems to agree on is Keepass. Keepass is useless if you need something that works in a group of people, especially across different devices. I can't speak to the vulnerabilities in 1Password but the reason we decided against 1Password is that the user experience for LastPass (Teams) is much better. There's no point in having a secure tool without compliance and bad UX is a show-stopper. Also the vulnerabilities so far have been mostly non-concerning: 1. The vulnerabilities of the browser extensions generally require the user to access malicious URLs, so they still require some degree of interaction. 2. The actual hacks of LastPass didn't result in any passwords or confidential information being leaked, so they're not very interesting. That 1Password hasn't seen similar disclosures doesn't mean 1Password doesn't have any vulnerabilities, nor that it didn't have them in the past. No software is without faults and so far LastPass has always reacted promptly. That 1Password doesn't have as many recent disclosures may simply mean that Tavis hasn't gotten around to looking at it yet.

brynjolf 10y ago

I used lastas for two years. When my student license expired I tried KeePass, 1password and Dashlane. Dashlane used over 1.2gb of memory, was slow and made no sense. You could add sites in the standalone client but NOT passwords. So you had to use the browser extension to create the password and copy paste it into the client. 1password might be amazing on Mac but on Windows it was so barwbonea I could just use lastpass without the extensions and still get more features. KeePass was fine just a bit cumbersome to integrate and browser integration would sometimes stop working. That being said the UX in lastpass is also horrible and getting worse. It is so slow now with the fancier graphics. I'm still surprised they are all so bad but lastpass is the least annoying to use.

patrec 10y ago

LastPass is terrible, but without alternative, at least if you want cross platform. People keep bringing up KeepPass, but apart from the bad UX, it's developers seem to be even more incompetent concerning basic security design. That leaves 1Password, which also hasn't covered itself in glory security-wise, but appears to be marginally more competent. No linux client though.