4 ms·

I don't understand the hate against Lastpass. Why would I trade it's awfully simple features (autofill on Android, automatically save/update passwords from webs

I don't understand the hate against Lastpass. Why would I trade it's awfully simple features (autofill on Android, automatically save/update passwords from website forms in browser, cheap etc.) for something like Keepass, even if the latter is purportedly a bit more secure? Some people also say that Lastpass's UI isn't great, but who cares about a password manager's UI as long as it does the job?

Royalaid 9y ago
I use it but as others have mentioned it seems the browser extensions are getting slower and buggier
ktta 9y ago
>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a software engineer who wasn't a security researcher found a bug[4], which again, gives all your passwords. 4. The bug in (3) wasn't fixed properly, which lead to this [5] Other bugs, but not as terrible as the ones I listed above Jul 27 2016 [6] Mar 25 2017 [7] Jun 17, 2015 [8] Nov 17, 2015 [9] You are also forgetting a whole another class of attacks - Phishing [10] [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1209 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [2]: https://news.ycombinator.com/item?id=13924737 https://news.ycombinator.com/item?id=13924737 [3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1217 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [4]: https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... [5]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&desc=2 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... [6]: https://bugs.chromium.org/p/project-zero/issues/detail?id=884 https://bugs.chromium.org/p/project-zero/issues/detail?id=88... [7]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&desc=6 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [8]: http://www.businessinsider.com/security-expert-describes-lastpass-vulnerabilities-posted-to-pastebin-in-2013-2015-6 http://www.businessinsider.com/security-expert-describes-las... [9]: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d... [10]: https://www.seancassidy.me/lostpass.html https://www.seancassidy.me/lostpass.html
- 6ak74rfy 9y ago
  Oh my. Thanks for taking the time to list these down. Will work right away to get off Lastpass. No, seriously!
  - ktta 9y ago
    What ever password manager you move to, chose something that will stay far away from your browser. And don't use anything that autofills your passwords. This includes KeePassHTTP.

Royalaid 9y ago

I use it but as others have mentioned it seems the browser extensions are getting slower and buggier

ktta 9y ago

>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a software engineer who wasn't a security researcher found a bug[4], which again, gives all your passwords. 4. The bug in (3) wasn't fixed properly, which lead to this [5] Other bugs, but not as terrible as the ones I listed above Jul 27 2016 [6] Mar 25 2017 [7] Jun 17, 2015 [8] Nov 17, 2015 [9] You are also forgetting a whole another class of attacks - Phishing [10] [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1209 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [2]: https://news.ycombinator.com/item?id=13924737 https://news.ycombinator.com/item?id=13924737 [3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1217 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [4]: https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... [5]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&desc=2 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... [6]: https://bugs.chromium.org/p/project-zero/issues/detail?id=884 https://bugs.chromium.org/p/project-zero/issues/detail?id=88... [7]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&desc=6 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [8]: http://www.businessinsider.com/security-expert-describes-lastpass-vulnerabilities-posted-to-pastebin-in-2013-2015-6 http://www.businessinsider.com/security-expert-describes-las... [9]: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d... [10]: https://www.seancassidy.me/lostpass.html https://www.seancassidy.me/lostpass.html

6ak74rfy 9y ago
Oh my. Thanks for taking the time to list these down. Will work right away to get off Lastpass. No, seriously!
- ktta 9y ago
  What ever password manager you move to, chose something that will stay far away from your browser. And don't use anything that autofills your passwords. This includes KeePassHTTP.