4 ms·
I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly
by arjie 10y ago
I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so.
It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.
- TheDong 10y agoThat's not an apt comparison. Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass. The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews. 1password has more recommendations by security engineers, and has been reviewed in significant depth. Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.
- arjie 10y agoThank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.
- DiNovi 10y agoI like the idea that you are just walking around asking security engineers for password managers
- tptacek 10y agoThat comment is not wrong.
- montycantsin 10y agoIs that weird?
- ryankask 10y ago1password has changed recently. Are security experts recommending their newer cloud subscription service or the older version that stored the vault on Dropbox or another storage service (or both)?
- brynjolf 10y agoI mean, you want us to take the word of people you asked? You could just be a shill for 1password as well.
- detaro 10y agoHow do you tell that LastPass has been vetted better than the alternatives? "Experts looked at X and found no major issues" normally doesn't get very much attention, and potentially isn't published at all, or just reflected in recommendations. (some of it is of course also depends on the threat-model: something with no (or with more caveats, an explicitly activated browser integration) is way less likely to be vulnerable against attacks launched from a website, reviewed or not)
- arjie 10y agoI do not know this. If you're informed, I would appreciate your advice.