7 ms·

> not something like LastPass Why? Friends have found LastPass to be pretty reliable and user friendly so far.

notzorbo3 9y ago
https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues
zeveb 9y ago
Among other things, they apparently use webpage encryption (their technology page indicates that AES is implemented in JavaScript for their website), which means that they have the ability to target any user at any point in time. Also, they're proprietary software. Password security is too important to entrust to proprietary software.
- pythonaut_16 9y ago
  When talking about Password Managers (and security in general), I think it's important to keep your threat model in mind. Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes. I generally agree though that this is an area where open source software is preferable. I'm also really intrigued by the work Keybase is doing and hope that it might spur some interesting solutions for web auth as well.
  - gruez 9y ago
    >Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes. but using keepass does protect you in the case that lastpass' servers get compromised into serving malicious javascript.
xorfish 9y ago
LastPass is not open source.
- seppin 9y ago
  what about 1password ?
  - earenndil 9y ago
    No good either.
    - seppin 9y ago
      b/c not open source? any other reason?
- senectus1 9y ago
  BitWarden is... I swapped from lastpass and have been loving it...
  - MattSteelblade 9y ago
    I've been thinking about switching, but I'm leery of it, as it is the work of a sole developer and it lacks a security audit.

https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues

Among other things, they apparently use webpage encryption (their technology page indicates that AES is implemented in JavaScript for their website), which means that they have the ability to target any user at any point in time. Also, they're proprietary software. Password security is too important to entrust to proprietary software.

pythonaut_16 9y ago
When talking about Password Managers (and security in general), I think it's important to keep your threat model in mind. Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes. I generally agree though that this is an area where open source software is preferable. I'm also really intrigued by the work Keybase is doing and hope that it might spur some interesting solutions for web auth as well.
- gruez 9y ago
  >Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes. but using keepass does protect you in the case that lastpass' servers get compromised into serving malicious javascript.

xorfish 9y ago

LastPass is not open source.

seppin 9y ago
what about 1password ?
- earenndil 9y ago
  No good either.
  - seppin 9y ago
    b/c not open source? any other reason?
senectus1 9y ago
BitWarden is... I swapped from lastpass and have been loving it...
- MattSteelblade 9y ago
  I've been thinking about switching, but I'm leery of it, as it is the work of a sole developer and it lacks a security audit.