9 ms·

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10. A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience isn't intentionally broken to sell an app, and export->import went without a hitch. Better, actually: it is the first time I have done an export/import and had the resulting data immediately work better in the second app. There's also the hope-springs-eternal factor of bitwarden giving me the option to host the sensitive stuff myself once I get off my butt and set up that server I've been meaning to for a while now. If you're thinking about lastpass, save yourself the trouble and try bitwarden first. Or something else, but bitwarden has been good to me and lastpass, well, hasn't, to put it politely :)

driverdan 8y ago
I second this. I was a long term LP user that switched to Bitwarden this year and haven't looked back.
Marsymars 8y ago
I've been looking into password managers for my team/department, and bitwarden has some good looking stuff, but they seem to only invoice in USD, which creates constant friction for recurring IT bills at my company.
arvinsim 8y ago
Hmmm, I have been using the Keepass + Dropbox combo. Wanted to change to a more streamlined experience. The current choices of 1Password, LastPass and Dashlane didn't seem to attract me. I will give Bitwarden a try.
- Lievelingsduif 8y ago
  I personally use keeanywhere to streamline my experience. It allows me to just log in and select my db
- J253 8y ago
  This is what I do too. Biggest complaint is the lack of official apps for mobile devices. I’ve used MiniKeePass in the past but am hesitant because there doesn’t seem to be much active development and I don’t see the source code anywhere. Do you access kbdx files on mobile devices? If so, what do you use?
  - jannes 8y ago
    Source code lives here: https://github.com/MiniKeePass/MiniKeePass https://github.com/MiniKeePass/MiniKeePass The biggest problem with MiniKeePass, in my opinion, is that it doesn't support the new iOS autofill API and that it doesn't support even basic syncing. You always have to make a manual copy of the database file and you can't really create logins on mobile because of that. There's a fork of MiniKeePass called KeePass Touch, but they don't publically host the source code anywhere. You have to email them to ask for a copy of the source code, which is technically GPL-compliant, but a bit annoying.
  - pritambarhate 8y ago
    On Android: keepassx2android offline app is pretty good.
  - arvinsim 8y ago
    I am using Keepass Touch in iOS
nickthemagicman 8y ago
I've never used any other password manager but just wanted to say I love Lastpass. It very rarely fails on autofill for me, it saves all my passowords nicely, has secure notes, organizational sharing for teams. I find it to be really great.
cabaalis 8y ago
I do love lastpass but since switching to Firefox 100% away from Chrome, the lack of copying a password to the clipboard without seeing it first really stings. What if someone is sitting next to me, or someone is grabbing screenshots or streaming my screen? It's like having this super secure electrified iron door installed but neglecting to lock it. Is anyone aware of a technical reason that copy to clipboard is absent in Firefox, or is just laziness? If laziness, I'll dump them tomorrow.
- jdubs 8y ago
  Install the lastpass binary in addition to the browser plugin. It re-adds that functionality back.
- toyg 8y ago
  In bitwarden it works out of the box, so I think it’s just laziness.
- nuclearcookie 8y ago
  I'm using lastpass with firefox nightly and I don't have this issue. copying the password to clipboard without seeing it works out of the box using the browser extension.
- 0db532a0 8y ago
  The clipboard can be accessed by any other application.
AuthorizedCust 8y ago
Install the LastPass binary, and you get copy password back in Firefox.
- thomasfedb 8y ago
  Not on Linux, and we've waited too long. 1Password supports it direct from the extension.
  - syntheticnature 8y ago
    Weirdly, I have been using Lastpass in Firefox on Linux and seem to have copy/paste. (Not that this whole thread hasn't had me re-evaluating whether there's a better solution for me now.)
- shafyy 8y ago
  Ah good to know. Does anyone know the reason they removed it from the Firefox addon?
  - syntheticnature 8y ago
    I believe it had to do with the change from the old addon format to the new one in Firefox.
    - jjoonathan 8y ago
      Bitwarden doesn't seem to have any problem copying passwords using a new-style extension with no binary install.
      - syntheticnature 8y ago
        I recall that the initial release of the Web Extension support was a bit threadbare, and/or that they had to change the extension ID or something of that sort, but it's also possible it was left out for existing design reasons/as a cudgel. In either case this whole thread has been useful for alerting me that I should re-evaluate if Lastpass is the optimal solution for me.
thomasfedb 8y ago
I moved from LastPass to 1Password recently. Had been using LastPass for several years, but filling failures, the lack of copy password in FF (and no binary workaround for Linux), and generally unhelpful support when I contacted them prompted me to move. Very happy with 1PasswordX (the browser-only version) - filling is much better, copy is supported out of the box, support have been very helpful when I've reached out. Much better customer experience.
- gcbirzan 8y ago
  Do they support automatically adding/updating sites yet?
  - ishitatsuyuki 8y ago
    It will prompt you to do so.
  - mplewis 8y ago
    Not on page submit, but you can do it when the form is still visible before you submit.
    - hellofunk 8y ago
      My 1Password always prompts me after I submit a form if I want to save the credentials used in that form.
      - thomasfedb 8y ago
        Might be different with 1PassX?
- matwood 8y ago
  I was a 1Password fan for many years, until the big push to go subscription. For now I'm just using Apple's keychain until I decide what tool to use next. If you're in Apple's ecosystem, keychain actually works pretty well.
jniedrauer 8y ago
+1 for bitwarden. Not a security professional, but it seems to be a good tradeoff between security and usability. Definitely better than lastpass on both counts.
silasdavis 8y ago
LastPass is one of my least liked most used tools. Everything about the implentation feels second rate; slow, unreliable login capture, unreliable form fill, occasional inability to edit records, buried password copy, clunky UI, inappropriate modal nagging in browser and app... Most times I use it I am cursing it. I tried to switch to pass, and I'm not sure if it was something to do with how I imported but it didn't list my passwords and the browser plugin was clunky and didn't work. Anyone had success with pass/gopass. Bitwarden seems like a happy Medium, I'd rather not do my password ops. The pricing seems fair (and rather optional). I'll try it, thanks.
- mrhappyunhappy 8y ago
  I have the same disappointing experience with LastPass and have grown tired of it. One of these days I will do something about it!
  - stingraycharles 8y ago
    Check out Keepass! Rather than syncing directly into a Cloud, it allows you to store a database file into any location. It supports MFA (e.g. by combining a password with a secret file, or a Yubikey). And everything is open-source. I like the model a lot, because it solves the "database ownership" issue, where your Password provider (be it LastPass, 1Password, etc) becomes in itself a weak link.
    - Cthulhu_ 8y ago
      I used to use KeePass but the lack of a proper crossplatform UI eventually broke it for me; KeePassX on linux looked and performed terribly, the Android app was just bad, etc etc etc. I switched to 1password which - at least at the time - offered a web-based fallback hosted from your own dropbox. Plus at the time you owned the data and were responsible for storing and syncing it. Dropbox support came out of the box but if you want you can use a local file.
      - stingraycharles 8y ago
pavanred 8y ago
I have been using Pass [0] with passff [1] and been pretty happy about it. Simple and offline password management where passwords live in gpg encrypted files. Additional features I like are tracking changes with git, bash completion and copying passwords to clipboard for few seconds temporarily, and a few very useful extensions. [0] https://www.passwordstore.org/ https://www.passwordstore.org/ [1] https://github.com/passff/passff#readme https://github.com/passff/passff#readme
- ams6110 8y ago
  Another pass user here. Simple and understandable, two strong positives for that type of application.
- fimdomeio 8y ago
  I use pass with keyboard Maestro on the mac it just gets a autofill input for the password I want, them opens a terminal and asks for the master password if needed and puts in the clipboard. Very friendly way to use it.
- konschubert 8y ago
  Pass ist definitely not as polished, but it's so dead simple, just a thin wrapper over gpg and git.
- bauruine 8y ago
  Pass is awesome. I use it in combination with a YubiKey to store the pgp key. Because every password is stored in an independent encrypted file and every decryption needs a press on the YubiKey even a stolen database and keylogger does not provide access to all passwords.
woolvalley 8y ago
I use 1password regularly, tried bitwarden, found it lacking in various quality of life features & polish that 1p has, so I didn't migrate. This is kind of yikes for a password manager too: https://github.com/bitwarden/core/issues/399 https://github.com/bitwarden/core/issues/399 But it's also pretty much the only polished open source password manager there is out there. For now I'll be sticking with 1password, but might check out bitwarden again once they have tests and more maturity as a password manager.
- tarwich 8y ago
  Just for the record, I don't believe that 1Password has unit tests either. I was unable to find evidence of unit tests, but I did find this: https://discussions.agilebits.com/discussion/comment/156429/#Comment_156429 https://discussions.agilebits.com/discussion/comment/156429/... We have a tendency to compare opaque with transparent and balk at what we find, but I question what you would feel if you could see through the opaque.
  - woolvalley 8y ago
    That is true, but at least they have code review and multiple people ;) I'm just estimating from my experience that after a certain point, most companies start writing automated tests. And if you look at their jobs page, one of the job description points is "Create unit tests for existing code to run faster and more reliably.": https://1password.com/jobs/droid-builder/ https://1password.com/jobs/droid-builder/ They might even have a few QA people AFAIK! I understand why the single founder / engineer of bitwarden doesn't have tests. When you're a startup not writing tests can speed you up significantly. But after a certain point they are going to need automated testing, especially for something as vital as this. For me, the lack of open source in 1p has been a sticking point, and I was planning to migrate after the audit. But seeing no tests, 1p documenting their security model and bitwarden not being good enough compared to 1p in UI has me sticking to 1p for now. I have high hopes that bitwarden will get to that maturity point one day.
- tashoecraft 8y ago
  I found the same thing with their client apps, should have checked core to see if there weren't any there as well. I switched over about a week ago and find it pretty solid, but it's missing alot of the quality of life features that last pass had. You can't just hit command + c whilst on a entry and have it copy the password, they haven't implemented the new ios 12 features that make password managers much better on ios. I'm running them both right now as I'm not fully committed to the switch over, but I'll see how the features get added over time.
guardian5x 8y ago
I would like to recommend keepass. It's open source as well.
- Jenz 8y ago
  +1 to this :)
  - joking 8y ago
    +2, keepass and plain google drive / dropbox / icloud file sync to have it available in several machines.
    - tyfon 8y ago
      +3 Though I sync it on my synology instead of teh cloud.
      - itsmyrun 8y ago
        I've thought about setting up a personal NAS for this purpose. But I'm concerned about having a single point of failure/loss in the event of a house fire or burglary. Any chance you've addressed this risk in your implementation?
- remedan 8y ago
  Yep, I use KeePass synced over my selfhosted nginx server. But you can use Dropbox/Google Drive/etc. just as easily. I would like to also recommend the Firefox extension 'Kee' for autofill. On Android there is the 'Keepass2Android' app. Both are open source and work well. I also recommend the KeePass plugin 'Yet Another Favicon Downloader'. It downloads favicons from websites for your password entries. Also 'Keebuntu' is a plugin that makes 'minimize to tray icon' work for me on Linux.
- blacksmith_tb 8y ago
  Agreed, a very functional manager for me, though I am using the KeePassXC [1] version on macOS (via brew cask) and Ubuntu (via snap). 1: https://keepassxc.org/ https://keepassxc.org/
sfilargi 8y ago
+1 recommendation for Bitwarden
welly 8y ago
I migrated over from Lastpass to Dashlane a few years ago. Couldn't be happier. It integrates with everything and as far as I understand their encryption is better than Lastpass, although I couldn't say how.
- hnzix 8y ago
  Another vote for Dashlane. The password management is stellar, it even alerts you about breaches and prompts you to change compromised passwords. I run a unique password for every site so it doesn't matter if a provider gets rumbled, and I don't reuse passwords or have to remember multiple ones. The form autofill is pretty awful compared to Lastpass, but I can live with that.
LondonAppDev 8y ago
Something about storing every password in a single cloud service to improve security sounds counterintuitive to me.
- jjoonathan 8y ago
  What do you do?
- konschubert 8y ago
  The passwords are all encrypted with the master password and ideally an additional salt such as in the case of 1password.
chiefalchemist 8y ago
Are you in paid bitwarden? For Premium and/or family?
bonsai80 8y ago
I'm also a happy Bitwarden customer. I especially like that it is all Free Software (combination of GPL 3 and AGPL across various parts), which to me is important for security and privacy related software. I've also had good experiences with Bitwarden support from Kyle, the lead developer and founder.

driverdan 8y ago

I second this. I was a long term LP user that switched to Bitwarden this year and haven't looked back.

Marsymars 8y ago

I've been looking into password managers for my team/department, and bitwarden has some good looking stuff, but they seem to only invoice in USD, which creates constant friction for recurring IT bills at my company.

arvinsim 8y ago

Hmmm, I have been using the Keepass + Dropbox combo. Wanted to change to a more streamlined experience. The current choices of 1Password, LastPass and Dashlane didn't seem to attract me. I will give Bitwarden a try.

Lievelingsduif 8y ago
I personally use keeanywhere to streamline my experience. It allows me to just log in and select my db
J253 8y ago
This is what I do too. Biggest complaint is the lack of official apps for mobile devices. I’ve used MiniKeePass in the past but am hesitant because there doesn’t seem to be much active development and I don’t see the source code anywhere. Do you access kbdx files on mobile devices? If so, what do you use?
- jannes 8y ago
  Source code lives here: https://github.com/MiniKeePass/MiniKeePass https://github.com/MiniKeePass/MiniKeePass The biggest problem with MiniKeePass, in my opinion, is that it doesn't support the new iOS autofill API and that it doesn't support even basic syncing. You always have to make a manual copy of the database file and you can't really create logins on mobile because of that. There's a fork of MiniKeePass called KeePass Touch, but they don't publically host the source code anywhere. You have to email them to ask for a copy of the source code, which is technically GPL-compliant, but a bit annoying.
- pritambarhate 8y ago
  On Android: keepassx2android offline app is pretty good.
- arvinsim 8y ago
  I am using Keepass Touch in iOS

nickthemagicman 8y ago

I've never used any other password manager but just wanted to say I love Lastpass. It very rarely fails on autofill for me, it saves all my passowords nicely, has secure notes, organizational sharing for teams. I find it to be really great.

cabaalis 8y ago

I do love lastpass but since switching to Firefox 100% away from Chrome, the lack of copying a password to the clipboard without seeing it first really stings. What if someone is sitting next to me, or someone is grabbing screenshots or streaming my screen? It's like having this super secure electrified iron door installed but neglecting to lock it. Is anyone aware of a technical reason that copy to clipboard is absent in Firefox, or is just laziness? If laziness, I'll dump them tomorrow.

jdubs 8y ago
Install the lastpass binary in addition to the browser plugin. It re-adds that functionality back.
toyg 8y ago
In bitwarden it works out of the box, so I think it’s just laziness.
nuclearcookie 8y ago
I'm using lastpass with firefox nightly and I don't have this issue. copying the password to clipboard without seeing it works out of the box using the browser extension.
0db532a0 8y ago
The clipboard can be accessed by any other application.

AuthorizedCust 8y ago

Install the LastPass binary, and you get copy password back in Firefox.

thomasfedb 8y ago
Not on Linux, and we've waited too long. 1Password supports it direct from the extension.
- syntheticnature 8y ago
  Weirdly, I have been using Lastpass in Firefox on Linux and seem to have copy/paste. (Not that this whole thread hasn't had me re-evaluating whether there's a better solution for me now.)
shafyy 8y ago
Ah good to know. Does anyone know the reason they removed it from the Firefox addon?
- syntheticnature 8y ago
  I believe it had to do with the change from the old addon format to the new one in Firefox.
  - jjoonathan 8y ago
    Bitwarden doesn't seem to have any problem copying passwords using a new-style extension with no binary install.
    - syntheticnature 8y ago
      I recall that the initial release of the Web Extension support was a bit threadbare, and/or that they had to change the extension ID or something of that sort, but it's also possible it was left out for existing design reasons/as a cudgel. In either case this whole thread has been useful for alerting me that I should re-evaluate if Lastpass is the optimal solution for me.

thomasfedb 8y ago

I moved from LastPass to 1Password recently. Had been using LastPass for several years, but filling failures, the lack of copy password in FF (and no binary workaround for Linux), and generally unhelpful support when I contacted them prompted me to move. Very happy with 1PasswordX (the browser-only version) - filling is much better, copy is supported out of the box, support have been very helpful when I've reached out. Much better customer experience.

gcbirzan 8y ago
Do they support automatically adding/updating sites yet?
- ishitatsuyuki 8y ago
  It will prompt you to do so.
- mplewis 8y ago
  Not on page submit, but you can do it when the form is still visible before you submit.
  - hellofunk 8y ago
    My 1Password always prompts me after I submit a form if I want to save the credentials used in that form.
    - thomasfedb 8y ago
      Might be different with 1PassX?
matwood 8y ago
I was a 1Password fan for many years, until the big push to go subscription. For now I'm just using Apple's keychain until I decide what tool to use next. If you're in Apple's ecosystem, keychain actually works pretty well.

jniedrauer 8y ago

+1 for bitwarden. Not a security professional, but it seems to be a good tradeoff between security and usability. Definitely better than lastpass on both counts.

silasdavis 8y ago

LastPass is one of my least liked most used tools. Everything about the implentation feels second rate; slow, unreliable login capture, unreliable form fill, occasional inability to edit records, buried password copy, clunky UI, inappropriate modal nagging in browser and app... Most times I use it I am cursing it. I tried to switch to pass, and I'm not sure if it was something to do with how I imported but it didn't list my passwords and the browser plugin was clunky and didn't work. Anyone had success with pass/gopass. Bitwarden seems like a happy Medium, I'd rather not do my password ops. The pricing seems fair (and rather optional). I'll try it, thanks.

mrhappyunhappy 8y ago
I have the same disappointing experience with LastPass and have grown tired of it. One of these days I will do something about it!
- stingraycharles 8y ago
  Check out Keepass! Rather than syncing directly into a Cloud, it allows you to store a database file into any location. It supports MFA (e.g. by combining a password with a secret file, or a Yubikey). And everything is open-source. I like the model a lot, because it solves the "database ownership" issue, where your Password provider (be it LastPass, 1Password, etc) becomes in itself a weak link.
  - Cthulhu_ 8y ago
    I used to use KeePass but the lack of a proper crossplatform UI eventually broke it for me; KeePassX on linux looked and performed terribly, the Android app was just bad, etc etc etc. I switched to 1password which - at least at the time - offered a web-based fallback hosted from your own dropbox. Plus at the time you owned the data and were responsible for storing and syncing it. Dropbox support came out of the box but if you want you can use a local file.
    - stingraycharles 8y ago

pavanred 8y ago

I have been using Pass [0] with passff [1] and been pretty happy about it. Simple and offline password management where passwords live in gpg encrypted files. Additional features I like are tracking changes with git, bash completion and copying passwords to clipboard for few seconds temporarily, and a few very useful extensions. [0] https://www.passwordstore.org/ https://www.passwordstore.org/ [1] https://github.com/passff/passff#readme https://github.com/passff/passff#readme

ams6110 8y ago
Another pass user here. Simple and understandable, two strong positives for that type of application.
fimdomeio 8y ago
I use pass with keyboard Maestro on the mac it just gets a autofill input for the password I want, them opens a terminal and asks for the master password if needed and puts in the clipboard. Very friendly way to use it.
konschubert 8y ago
Pass ist definitely not as polished, but it's so dead simple, just a thin wrapper over gpg and git.
bauruine 8y ago
Pass is awesome. I use it in combination with a YubiKey to store the pgp key. Because every password is stored in an independent encrypted file and every decryption needs a press on the YubiKey even a stolen database and keylogger does not provide access to all passwords.

woolvalley 8y ago

I use 1password regularly, tried bitwarden, found it lacking in various quality of life features & polish that 1p has, so I didn't migrate. This is kind of yikes for a password manager too: https://github.com/bitwarden/core/issues/399 https://github.com/bitwarden/core/issues/399 But it's also pretty much the only polished open source password manager there is out there. For now I'll be sticking with 1password, but might check out bitwarden again once they have tests and more maturity as a password manager.

tarwich 8y ago
Just for the record, I don't believe that 1Password has unit tests either. I was unable to find evidence of unit tests, but I did find this: https://discussions.agilebits.com/discussion/comment/156429/#Comment_156429 https://discussions.agilebits.com/discussion/comment/156429/... We have a tendency to compare opaque with transparent and balk at what we find, but I question what you would feel if you could see through the opaque.
- woolvalley 8y ago
  That is true, but at least they have code review and multiple people ;) I'm just estimating from my experience that after a certain point, most companies start writing automated tests. And if you look at their jobs page, one of the job description points is "Create unit tests for existing code to run faster and more reliably.": https://1password.com/jobs/droid-builder/ https://1password.com/jobs/droid-builder/ They might even have a few QA people AFAIK! I understand why the single founder / engineer of bitwarden doesn't have tests. When you're a startup not writing tests can speed you up significantly. But after a certain point they are going to need automated testing, especially for something as vital as this. For me, the lack of open source in 1p has been a sticking point, and I was planning to migrate after the audit. But seeing no tests, 1p documenting their security model and bitwarden not being good enough compared to 1p in UI has me sticking to 1p for now. I have high hopes that bitwarden will get to that maturity point one day.
tashoecraft 8y ago
I found the same thing with their client apps, should have checked core to see if there weren't any there as well. I switched over about a week ago and find it pretty solid, but it's missing alot of the quality of life features that last pass had. You can't just hit command + c whilst on a entry and have it copy the password, they haven't implemented the new ios 12 features that make password managers much better on ios. I'm running them both right now as I'm not fully committed to the switch over, but I'll see how the features get added over time.

guardian5x 8y ago

I would like to recommend keepass. It's open source as well.

Jenz 8y ago
+1 to this :)
- joking 8y ago
  +2, keepass and plain google drive / dropbox / icloud file sync to have it available in several machines.
  - tyfon 8y ago
    +3 Though I sync it on my synology instead of teh cloud.
    - itsmyrun 8y ago
      I've thought about setting up a personal NAS for this purpose. But I'm concerned about having a single point of failure/loss in the event of a house fire or burglary. Any chance you've addressed this risk in your implementation?
remedan 8y ago
Yep, I use KeePass synced over my selfhosted nginx server. But you can use Dropbox/Google Drive/etc. just as easily. I would like to also recommend the Firefox extension 'Kee' for autofill. On Android there is the 'Keepass2Android' app. Both are open source and work well. I also recommend the KeePass plugin 'Yet Another Favicon Downloader'. It downloads favicons from websites for your password entries. Also 'Keebuntu' is a plugin that makes 'minimize to tray icon' work for me on Linux.
blacksmith_tb 8y ago
Agreed, a very functional manager for me, though I am using the KeePassXC [1] version on macOS (via brew cask) and Ubuntu (via snap). 1: https://keepassxc.org/ https://keepassxc.org/

sfilargi 8y ago

+1 recommendation for Bitwarden

welly 8y ago

I migrated over from Lastpass to Dashlane a few years ago. Couldn't be happier. It integrates with everything and as far as I understand their encryption is better than Lastpass, although I couldn't say how.

hnzix 8y ago
Another vote for Dashlane. The password management is stellar, it even alerts you about breaches and prompts you to change compromised passwords. I run a unique password for every site so it doesn't matter if a provider gets rumbled, and I don't reuse passwords or have to remember multiple ones. The form autofill is pretty awful compared to Lastpass, but I can live with that.

LondonAppDev 8y ago

Something about storing every password in a single cloud service to improve security sounds counterintuitive to me.

jjoonathan 8y ago
What do you do?
konschubert 8y ago
The passwords are all encrypted with the master password and ideally an additional salt such as in the case of 1password.

chiefalchemist 8y ago

Are you in paid bitwarden? For Premium and/or family?

bonsai80 8y ago

I'm also a happy Bitwarden customer. I especially like that it is all Free Software (combination of GPL 3 and AGPL across various parts), which to me is important for security and privacy related software. I've also had good experiences with Bitwarden support from Kyle, the lead developer and founder.