6 ms·

I just moved from LastPass to 1Password7, and this sentence will make me consider moving back: > Surprisingly, we found that it is less secure in the running s

I just moved from LastPass to 1Password7, and this sentence will make me consider moving back: > Surprisingly, we found that it is less secure in the running state compared to 1Password4. 1Password7 decrypted all individual passwords in our test database as soon as it is unlocked and caches them in memory, unlike 1Password4 which kept only one entry at a time in memory. Compounding this, we found that 1Password7 scrubs neither the individual passwords, the master password, nor the secret key (an extra field introduced in 1Password6 that combines with the master password to derive the encryption key) from memory when transitioning from unlocked to locked. That is unacceptable, what type of developers do they have?

Ajedi32 8y ago
If you're going to hold that against them, LastPass is just as bad: > During a workflow to derive the decryption key, the master password is leaked into a string buffer in memory and never scrubbed, even when LastPass is placed into a locked state.
- SlowRobotAhead 8y ago
  Not that storing a masterpass as sting is acceptable - nor that I readily believe that statement entirely. But why would you be using any of these without 2FA?
SlowRobotAhead 8y ago
If it’s an interesting annecodte to you, I moved myself an 5 people in my company from 1Pass v4 to LastPass, no complaints from anyone and the iPhone integration is unbeatable. Altogether I’ve moved 100 people to LastPass and some of those users have been not-exactly-power-users, yet, zero complaints from 100 people. A year later almost every single one is still using and the downstream effect of children/friends/kids is surely in the hundreds. They owe me a shirt or something really! LastPass isn’t perfect but it’s pretty great for the price. What made you switch to 1P v7?
- johnmarcus 8y ago
  As an admin, laspass is anything but great. Having to create a shared folder for every user and group is ridiculous. I will switch to 1Password teams soon most likely, although bitwarden is the new hotness these days.
  - jsutton 8y ago
    Why do you have to create a shared folder for every user and group? You should be able to add any users and groups all to a single shared folder.
    - johnmarcus 8y ago
      oh, that's a really good idea. I should put all my apps and logins in a single folder and then share them all with everyone in the company. security shmurity!
- throwawaymath 8y ago
  Are the people using LastPass commenting on how nice the interface is, or are they just not saying anything at all? I have to use both LastPass (enterprise) and 1Password 7 (personal). The experience is pretty incomparable: the LastPass user interface and browser extension are abysmal, whereas 1Password is very enjoyable. On the most recent version of Chrome, the LastPass extension is slower, less intuitive and less organized than the 1Password extension. 1Password also has more features and a fast desktop application for macOS. Note that I'm not saying LastPass doesn't work. It works...but it's an incredible pain for me to use every day at work after using 1Password at home. I think the design sucks, to put it bluntly.
  - SlowRobotAhead 8y ago
    I've had a few questions about interface, but for the most part it's intuitive and I've had very few questions even from older people. Not hearing anything is a good sign. I've had none of the UI issues you have (Firefox, Safari) and have heard none from any user. Weird!
mediocrejoker 8y ago
They also address that in their response. It stems from the fact that they use memory-managed programming environments, so they don't have that level of control over memory.
- kevin_thibedeau 8y ago
  A competent developer would use native code for these critical areas.
  - UncleMeat 8y ago
    Why? Native is often riddled with bugs and the threat model of reading the data out of memory is basically irrelevant.
  - throwawaymath 8y ago
    That's a pretty extraordinary claim, considering that securing native code is highly nontrivial and increases the attack surface of an application significantly.
    - ripdog 8y ago
      Is that still true with Rust?
      - regnerba 8y ago
        The 1password devs specifically say that the Windows team has been playing around with Rust. So they at least seem to be looking into it and treating it as a real possibility. I don't imagine anything will come from it for a while however.
        steveklabnik 8y ago
        Supposedly it is already in production, or at least that’s how I read https://twitter.com/sergeygalich/status/1091060842047492096 https://twitter.com/sergeygalich/status/1091060842047492096

Ajedi32 8y ago

If you're going to hold that against them, LastPass is just as bad: > During a workflow to derive the decryption key, the master password is leaked into a string buffer in memory and never scrubbed, even when LastPass is placed into a locked state.

SlowRobotAhead 8y ago
Not that storing a masterpass as sting is acceptable - nor that I readily believe that statement entirely. But why would you be using any of these without 2FA?

SlowRobotAhead 8y ago

If it’s an interesting annecodte to you, I moved myself an 5 people in my company from 1Pass v4 to LastPass, no complaints from anyone and the iPhone integration is unbeatable. Altogether I’ve moved 100 people to LastPass and some of those users have been not-exactly-power-users, yet, zero complaints from 100 people. A year later almost every single one is still using and the downstream effect of children/friends/kids is surely in the hundreds. They owe me a shirt or something really! LastPass isn’t perfect but it’s pretty great for the price. What made you switch to 1P v7?

johnmarcus 8y ago
As an admin, laspass is anything but great. Having to create a shared folder for every user and group is ridiculous. I will switch to 1Password teams soon most likely, although bitwarden is the new hotness these days.
- jsutton 8y ago
  Why do you have to create a shared folder for every user and group? You should be able to add any users and groups all to a single shared folder.
  - johnmarcus 8y ago
    oh, that's a really good idea. I should put all my apps and logins in a single folder and then share them all with everyone in the company. security shmurity!
throwawaymath 8y ago
Are the people using LastPass commenting on how nice the interface is, or are they just not saying anything at all? I have to use both LastPass (enterprise) and 1Password 7 (personal). The experience is pretty incomparable: the LastPass user interface and browser extension are abysmal, whereas 1Password is very enjoyable. On the most recent version of Chrome, the LastPass extension is slower, less intuitive and less organized than the 1Password extension. 1Password also has more features and a fast desktop application for macOS. Note that I'm not saying LastPass doesn't work. It works...but it's an incredible pain for me to use every day at work after using 1Password at home. I think the design sucks, to put it bluntly.
- SlowRobotAhead 8y ago
  I've had a few questions about interface, but for the most part it's intuitive and I've had very few questions even from older people. Not hearing anything is a good sign. I've had none of the UI issues you have (Firefox, Safari) and have heard none from any user. Weird!

mediocrejoker 8y ago

They also address that in their response. It stems from the fact that they use memory-managed programming environments, so they don't have that level of control over memory.

kevin_thibedeau 8y ago
A competent developer would use native code for these critical areas.
- UncleMeat 8y ago
  Why? Native is often riddled with bugs and the threat model of reading the data out of memory is basically irrelevant.
- throwawaymath 8y ago
  That's a pretty extraordinary claim, considering that securing native code is highly nontrivial and increases the attack surface of an application significantly.
  - ripdog 8y ago
    Is that still true with Rust?
    - regnerba 8y ago
      The 1password devs specifically say that the Windows team has been playing around with Rust. So they at least seem to be looking into it and treating it as a real possibility. I don't imagine anything will come from it for a while however.
      - steveklabnik 8y ago
        Supposedly it is already in production, or at least that’s how I read https://twitter.com/sergeygalich/status/1091060842047492096 https://twitter.com/sergeygalich/status/1091060842047492096