14 ms·
Should you be concerned about LastPass uploading your passwords to its server?
- ronnier 8y agoI am. So I don’t use it.
- vishwasanand 8y agoWonderful article. Even we were working on the similar issue. One way could be, instead of using Symmetric key (probably stored in the browser - hence not safe) to encrypt passwords before sending to LastPass server, they could have used Asymmetric crypto system. Solution similar to this can be very helpfull in this case : https://www.youtube.com/watch?v=Slhwunm4oT0&feature=youtu.be https://www.youtube.com/watch?v=Slhwunm4oT0&feature=youtu.be Notice the private key never leaves the mobile device and hence the client does not has to trust on LastPass browser client.
- mav3rick 8y agoFirefox Send uses something similar.
- astrodust 8y agoLastPass is just so damned ugly and terrible to use compared to well crafted products like 1Password. It's like the phpMyAdmin of password storage.
- mistermann 8y agoAs a not too impressed LastPass user, is it worth switching?
- rizwank 8y agoWhen LastPass got bought, I immediately looked for an out - I am happy with the move to 1Password.
- ClassyJacket 8y agoIt's shocking how badly designed and slow it is. They somehow manage to hide everything you'd use frequently under 10 clicks or taps, and by default organise things info irrelevant categories which you can only stop by removing each one individually.
- y4mi 8y agoAt least it works on all platforms well. 1password is a disaster on anything not Apple. It's usability (last pass) has been getting worse though....
- froindt 8y agoYou used to be able to go to a username or password field, hit the down arrow, and it'd let you select through your various accounts. I hate touching my mouse and loved that interaction. Really wish that came back. I hope they took it away for a good reason, like a security vulnerability.
- Biganon 8y ago1password works perfectly well as a browser extension on both my Arch and GalliumOS machines. There is also a CLI that spits out JSON, and you can find (or code) a wrapper around it (or use jq to display the JSON nicely). Client on windows at work works fine too. Don't really understand where you're getting at with your criticism.
- zumzumzum 8y agoHave you tried 1Password lately? They used to be trash, but I use them on mac, windows and android and it is far superior to last pass in almost every regard now.
- jes 8y agoI've been using 1Password for a few years. It feels a bit over-featured to me. It has worked reliably though.
- givehimagun 8y agoI don't get the hate. I've been a LastPass user for 5 years and it works for me most of the time. I've dabbled in 1Password, Chrome native password management, Firefox native, random Hacker News password manager recommendations. LastPass...still the best off...AND I got my brother and dad to use them and get excited about password safety. What's so terrible about people using better and better passwords? It's not perfect but I am so much happier with my dad using LastPass versus the shitty password strategy he had before...it was post-it note password management.
- jrockway 8y agoYeah, I also think it's interesting. I have been using LastPass forever and use 1password for work, and LastPass seems a lot easier to use for me. Both are better than using "password" as your password. I will admit that I don't store my Google password in any password manager. That is the root of trust for everything, so I remember the password and use 2FA. The other accounts aren't as important.
- telesilla 8y agoI live in fear of forgetting my Google password (although I have several locations where my backup codes are stored) so I broke it into several parts and stored them with innocuous sounding names like "sister's birthday" and "plumber's contact info", but using a poem I know well as the phrase key. The times I've needed to refresh my memory it was very easy for me to retrieve it.
- auslander 8y ago> ..my Google password in any password manager. That is the root of trust for everything Why? Google is an Ad company...
- zaphirplane 8y agoGmail. Reset password to almost any account via reset password Same is true for any email provider
- 8y ago
- gcommer 8y agoI recently made the switch from LP to bitwarden and have been incredibly happy about it. I can self host everything + the autofill and UI polish (browser extensions, mobile app, CLI) is much better. AND it's FLOSS ((A)GPLv3). Even including the self hosting setup, my all-in migration time was <30 minutes. I looked through a ton of other options like keepass and the author's own PfP. But mobile, web, and yubikey support are all very important requirements for me.
- hughes 8y agoI love bitwarden also. Having tried a few password managers, it has the most pleasant mobile experience.
- kevingrahl 8y ago+1 for Bitwarden! Switched to it somewhat over a year ago from LastPass after I read up on LastPass’ ‘security’. The only thing I dislike about Bitwarden is that on their iOS app it sometimes takes a while (>30s) to load the search function. I love that their chrome extension has a dark mode!
- toyg 8y ago30s seems a lot, I never see that. Maybe it depends on the amount of pwds saved...
- kevingrahl 8y agoI do have quite a lot of entries..
- lazycouchpotato 8y agoTheir Android app is notoriously slow as well in search.
- zaphodq 8y agoSame here migrated to bitwarden from lastpass. So far my experience with bitwarden has been great. Bitwarden apps are very good.
- mythrwy 8y agoWhy take chances or add complications? https://www.passwordstore.org/ https://www.passwordstore.org/ Keep it simple, keep it local, keep it CLI.
- bhhaskin 8y agoBeen using pass for years. It's great and I highly recommend it. There are also some great browser plugin for it as well.
- doublepg23 8y agoI am a password store user, however it is a very nerdy solution. The use of git is it's biggest strength because you can host it yourself super easily, but your also stuck with git's awful ux. Also the lack of file name encryption limits the options of using free git hosts - maybe that's for the best, but it clearly limits adoption even more.
- leg100 8y agoAll the major git providers provide free private repos.
- doublepg23 8y agoThe file names being stored in plaintext makes unwilling to recommend even private git servers - if your worried about leaking which porn or torrent sites you use.
- JumpCrisscross 8y agoWhat password manager does tptacek use?
- skelin 8y ago1password it seems: https://news.ycombinator.com/item?id=14777726 https://news.ycombinator.com/item?id=14777726 I’ve also seen it recommended by Troy Hunt (haveibeenpwned creator): https://www.troyhunt.com/password-managers-dont-have-to-be-perfect-they-just-have-to-be-better-than-not-having-one/ https://www.troyhunt.com/password-managers-dont-have-to-be-p... (I’m using bitwarden myself, couldn’t justify the subscription cost for my usage)
- jammygit 8y agoI'm also using bitwarden, but palent seemed skeptical about it in the comments. Here's a copy of the comment: Reply from Wladimir Palant: Unfortunately, I didn’t make notes last time I looked into this – the issues simply weren’t serious enough for reporting. And I only looked at a small portion of the codebase, so when I look at it now it will probably be some different code paths. So the getDomain() function I see under https://github.com/bitwarden/jslib/blob/dd46d5ecdd51f91dace5488272dd1f7bafd995c5/src/misc/utils.ts#L169 https://github.com/bitwarden/jslib/blob/dd46d5ecdd51f91dace5... is indeed using URL objects. It also knows that tld.js won’t handle IP addresses correctly, but it will only consider IPv4 addresses in dotted decimal notation and not IPv4 addresses in other notations or IPv6 addresses. All of that appears to be a minor risk but not an actual issue – assuming that URLs are already normalized when they get here (ok, let’s ignore the code prefixing URLs with http:// http:// here). The code at the bottom of this function is quite problematic however. Rather than ignoring non-HTTP URLs, this function will pass them to tld.js. But tld.js isn’t aware that non-HTTP URLs can have different semantics, so it will happily return “example.com” when it is fed something like “data://example.com,asdf/”. Oops, I think that one might even be exploitable… I think I’m going to stop here. This needs a structured effort, not spending ten minutes every now and then. As I said, the codebase isn’t bad. But there are obvious issues that shouldn’t have been there. As always, spotting the issues is the easy part – proving that they are exploitable is far harder. I’m not going to spend time on that right now, so let’s just file these under “minor quality issues” rather than “security problems.”
- Causality1 8y agoI've never trusted password managers. I write the unique portions of my passwords in a notepad and combine those with a common but unwritten alphanumeric sequence to form my full passwords.
- xur17 8y agoWhat happens if you lose your notepad?
- ben-schaaf 8y agoWhat if someone gets a series of leaked passwords from you, can they get back the alphanumeric sequence and brute force the unique portion? What happens if your notepad gets stolen, do you have backups?
- Causality1 8y agoThe uniques are quite long so good luck trying to brute force them. As for it being stolen, it doesn't leave my house. I've never been robbed but if I was I doubt they'd steal a small worn notepad sitting in a desk drawer.
- ben-schaaf 8y agoWhat about backups, do you just lose access to everything internet if the notebook is lost? What do you do when you need to access something when you're not at home?
- DanBC 8y agoThe question was about backups, not about what a thief would steal. What happens if your home burns down: do you have backups of the notebook?
- handzbagz 8y agoWhat if you get a bang on the head and forget how to reconstruct your password.
- zncoder 8y agoLastPass is hard to use for me, so I wrote my own, https://addons.mozilla.org/en-US/firefox/addon/passcell/ https://addons.mozilla.org/en-US/firefox/addon/passcell/ https://chrome.google.com/webstore/detail/passcell/mjbndaapnghbmikhgjnbljiimmdhobdm?utm_source=chrome-ntp-icon https://chrome.google.com/webstore/detail/passcell/mjbndaapn... All encryption/decryption is done inside the browser, as you can verify the source code, https://github.com/zncoder/passcell https://github.com/zncoder/passcell.
- mnm1 8y agoI wouldn't trust any password service that uploads my data anywhere, with or without the key (though especially with the key like here). I wouldn't trust it if it uploaded the password data to Dropbox or any similar service under an account I own. Even if the data is encrypted, someone can get access to it and work on decrypting it offline. That's simply too big of a risk considering the power of state actors, although I assume state actors would just get the data directly from each website and not need my passwords. Still, can't assume anything about any adversary. Others could certainly be capable of cracking an encrypted file offline.
- ben-schaaf 8y agoTo the same effect that means you shouldn't trust anything going over any network ever. They can just as well decrypt your TLS connection offline as they can an encrypted data store. In which case, why do you not trust when you send your encrypted password over an encrypted connection, but not when your plaintext password gets sent over an encrypted connection?
- Deestan 8y ago> Even if the data is encrypted, someone can get access to it and work on decrypting it offline. That fear is irrational. While you go on to describe one reason for that, another is that cracking a solid encryption isn't something people can just do. The vast computer power necessary to maybe crack something like a humble RSA1024 in 8 years can more easily make enough BitCoin to buy a small nation.
- maibus2 8y agoThis is not an irrational fear given how Last Pass and many other password managers are designed. Last Pass (and others) derive encryption keys from their users passwords (via PBKDF-2). Thus a (smart) attacker needn't guess the user's encryption key directly. They just need guess the user's password, "hash" it via PBDKF-2 with the proper params and see if it decrypts the data. Using a sub $1,000 GPU and a table of common passwords obtained from popular website database leaks it's not that hard to crack the average joe's vault.
- godzillabrennus 8y agoI’ve been using Lastpass for years. It’s not as unique as it once was but it’s still good. Anecdotally, Joe Siegrist personally emailed me when I launched my first SaaS product to say he liked it. That felt great. Sucks that Logmein bought it (horrible company who hates their customers) but glad he got a win out of that business for himself.
- woile 8y agoI use gopass. It's like an extension of pass. The difference is that it has support for multiple stores. And you can add different people to the stores and synchronize each store with git. I wrote a tutorial and a cheatsheet (mostly for me) http://woile.github.io/posts/sharing-team-secrets/ http://woile.github.io/posts/sharing-team-secrets/
- alexozer 8y agoNice reference! On Linux I have a keybinding which opens a terminal with a fzf listing of my password entries. when I select the name I want, it types the password with xdotool into whatever is focused. I bet it's just as fast if not faster than the browser password managers' autofill.
- pinjiz 8y agoPassword managers like LastPass and 1Password have a significant advantage over offline database tools like KeePass: You can easily share individual passwords with your co-workers in a somewhat secure way. KeePass for instance lacks the ability to do just that. You can either a) share the entire database or b) use multiple databases with different passwords. However, a) is not secure as your co-workers get access to passwords they do not need and b) is very inconvenient. LastPass (or 1Password, Bitwarden) makes sharing individual passwords within your team very easy, convenient and secure enough. You can create shared folders and define permissions to access those by certain members of your team, and most importantly, deny access to other members. Is there any offline based password manager that allows you to do that (and is usable by the average Joe)?
- chmars 8y ago1Password does not support sharing (or transferring) of single passwords. You can for example not create an account for a user and send him the credentials through 1Password.
- nmec 8y agoThis is possible in the Web UI of 1Password for Teams: https://discussions.agilebits.com/discussion/comment/360497/#Comment_360497 https://discussions.agilebits.com/discussion/comment/360497/...
- finchisko 8y agoI think KeepassXC team is working on this one. Maybe it's even ready to use. Didn't try as I don't need this. https://github.com/keepassxreboot/keepassxc/blob/develop/docs/QUICKSTART.md#using-sharing https://github.com/keepassxreboot/keepassxc/blob/develop/doc...
- jeltz 8y agoI love the work of the KeePassXC team. I feel that they are constantly improving their password manager with the features I need.
- Deestan 8y agoSo given the requirement to access passwords across multiple devices, what alternatives exist that stand up to similar scrutiny? Ease-of-use and "looks pleasant" be damned, just security-wise. https://www.xkcd.com/937/ https://www.xkcd.com/937/
- trickstra 8y agoKeepass + Syncthing (with staggered backups)
- timw4mail 8y agoThis seems like the best solution for syncing with Keepass, especially since every new sync target needs to be approved. Sharing password files via Dropbox, Google Drive, etc. is convenient, but how is that really different than what Lastpass does? With Syncthing being peer to peer, there's a lot less opportunity for someone else to even know your password file exists.
- qwsxyh 8y agobitwarden_rs
- pimeys 8y agoI use KeepassXC which I sync to my home NAS from two computers and my phone. Keepass DX is the best Android app I've found and it supports opening the database with your fingerprint. I don't see the fuzz here if needing to have a browser extension. When a site asks me to login every now and then, I'm ok with opening the app and copying the password.
- finchisko 8y agoYes, KeepassXC rules them all :). I use KeepassXC on Linux and Windows, macPass on a mac (has same db format, but macOS Aqua interface) and MiniKeePass on a iPhone. I use two keepass databases (as data loss prevention). For Linux and Windows db is stored on a Dropbox. On a mac and iPhone on a iCloud. I merge them once a while. However for many years I used just a single db for every device and didn't had a single problem with it. Started to used two, after I switched from Dropbox to iCloud on a mac and iPhone.
- trickstra 8y agotry Syncthing instead of Dropbox and you will be completely free of any third party provider risk
- ericd 8y agoI wanted to like Keepass, but this is a lot of friction vs. the alternatives. Less context switching in my day is helpful for me keeping on task.
- jzl 8y agoThe threat scenario described by the article: If someone within LastPass wanted to gain access to your passwords (e.g. rogue employees, or via court order) there is a way that the extension could be made to upload your vault key back to LP if you click on certain things within the extension, namely some parts of the preferences, or something like that. Any such change would be publicly detectable, but could theoretically be targeted to avoid widespread notice. So in other words, the vault itself is not fundamentally flawed, but the design of the current extension doesn't proactively firewall against LastPass turning into a bad actor. My $.02: Given that all the cloud-based password managers have their own phone (and even desktop) apps, this seems like a moot point since a bad actor could push out an app update that does anything with your keys anyway. As a long-time LastPass user I appreciate this kind of analysis, but this is just not something I have enough cycles in the day to let bother me. BTW the last time I opened my preferences was 3 years ago. LastPass is quite open to scrutiny and what's important is how responsive they are to new findings -- very responsive, from everything I've ever seen. Including many findings from the author of the article. By far the biggest problem with LastPass is that it sometimes just doesn't apply (or misapplies) the password or username to the appropriate form entries, and I have to go find it and copy it. Occasionally it also misses the saving of a new password (that it generated) and I have to put it in the vault by hand. I suspect this is a really hard problem given the massive variety of forms out there, but would be curious to hear if other password managers never have these issues.
- vezycash 8y agoThe user experience declined slightly after lastpass got acquired. For a year or two, lastpass for Firefox didn't have the copy option for usernames and passwords. I had to edit, show password, then copy. The autofill problem became pronounced after the acquisition as well probably through no fault of the new owner. Many sites like Google and Microsoft have switched to a multi-step login process where username is entered first and password is entered on a different page Also a proof of sites abusing autofill & hidden forms to steal passwords probably influenced the current situation.
- felixschl 8y ago
- djhworld 8y agoI subscribe to 1password where your data is synced to their servers. I'm not sure if this is a good idea now that I've read this...
- grewil2 8y agoI am using pass - the standard unix password manager. It's simple and just works. It's built on gpg and git, and resides on any disk you like. https://www.passwordstore.org/ https://www.passwordstore.org/
- 8fingerlouie 8y agoI also started using pass when migrating. I've been nothing but happy with it. It's fast, easy to host either at home, or through Bitbucket or Github, and has clients (which IMO could all be better) for just about everything i need. I wish the iOS app would support tombs/vaults though. https://github.com/roddhjav/pass-tomb#readme https://github.com/roddhjav/pass-tomb#readme
- ealhad 8y agoIt's only standard according to its website though.
- bspammer 8y agoAs an aside - pass was made by Jason Donenfeld, the same guy that created Wireguard.
- sha666sum 8y agopass is amazing, as it makes synchronization incredibly easy in comparison to keepass. It even has a decent Android app. My biggest issue is that using it isn't nearly as convenient on Windows as on Linux, although WSL makes it quite simple.
- nickjj 8y agoI have 250+ passwords in pass and it hasn't failed yet. Been using it for years. It's the only password tool I would consider using. It also happens to be great at storing any amount of sensitive text (API keys, etc.).
- dbg31415 8y agoAll the hate towards LastPass... but man, there are so many great tools with LastPass that the other services simply don't have yet. Given I haven't looked into it in a year or so... but the Dead Man's Switch alone makes it worthwhile for me. My lawyer has this, and 30 days after I kick it he can go in and delete all my accounts. Sharing passwords with a team, it's really helpful. Being able to share access, but not the password itself... really nice feature. The password audit, showing me how old my passwords are, or which ones are weak... it's nice to have a sanity check on all this stuff. Anyway, been on LastPass for a decade or so... tried a few others, always find myself back with LastPass since the others don't quite have all the features I want.
- ttty 8y ago> Being able to share access, but not the password itself... really nice feature. How you just share access? You mean the password is autofilled?
- bwoodruff 8y ago> Sharing passwords with a team, it's really helpful. Being able to share access, but not the password itself... really nice feature. 1Password offers this as well. Not allowing the end user to reveal passwords it isn't an ideal solution. The password can easily be obtained by anyone who is capable of using the browser's developer tools. Simply inspect the input element after it has been filled and the browser will give the secret away. The only way to be sure someone doesn't have access to an account after you've shared credentials with them (even "hidden" credentials) is to change the credentials for that account. > The password audit, showing me how old my passwords are, or which ones are weak... it's nice to have a sanity check on all this stuff. 1Password also offers these sorts of checks. > Given I haven't looked into it in a year or so... but the Dead Man's Switch alone makes it worthwhile for me. My lawyer has this, and 30 days after I kick it he can go in and delete all my accounts. This, admittedly, we haven't found a good secure way to implement yet. Our current recommendation is to share your Emergency Kit with your lawyer, or whoever needs access, perhaps in a sealed envelope marked to only be opened upon your death. Full disclosure: I work for 1Password.
- 8y ago
- auslander 8y agoI use KeepassXC, sync the DB via file syncing, no 3rd party servers to trust.
- Kiro 8y agoAm I the only one who uses Google's built-in password manager?
- tsukurimashou 8y agoIf you mean Chrome you shouldn't do that, Chrome stores your passwords in a SQLite database locally, anyone can access that very easily
- rdl 8y agoI never really trust a binary provided by someone which also talks to a server operated by the same entity. There is no way for me to audit an arbitrary binary (or application with source, in any reasonable way), particularly since it is regularly updated on both ends.
- FullyFunctional 8y agoFor me, cross platform, offline access, and good UI are paramount. LP checks all that but random scripts on a Linux command line doesn't even remotely cut it. Firefox's password safe comes close it seems, but I haven't read too many opinions about it.
- edoo 8y agoIf you can login to a browser and use the one password they can reset on a whim to pull your passwords then it is all in their hands anyway.
- yinyang_in 8y agoI never got comfortable with lastpass or 1password, i usually find enpass in middle ground. They don't have recurring cost to maintain webserver and security. For me ideal is keepass but once got db corruption when syncing with dropbox like service. Hence went with enpass which allows me to sync password across devices and encrypt with keyfile and master password like in keepass. .
- jonathanstrange 8y agoI use my own password manager and would not trust many proprietary third-party developers to get things right. Most of them have a long history of failures. It's safer to self-host and store encrypted backups elsewhere for integrity. If you're not familiar with encryption or cryptanalysis, then you can use some open source encryption programs and a text file on an encrypted partition. That's a thousand times more secure than any proprietary online password manager. For some passwords it is also more secure to keep them in plaintext on physically secured notes. It depends on the threat scenario.
- ploped 8y agoCurious about your thoughts on the macOS keychain app? is it a better solution than Lastpass or any other passwords manager?
- kome 8y agoI never used a password manager, call me paranoid, but giving my password to a third-party (often not free software) for me is just pure madness.
- Phenix88be 8y agoI don't understand how people could use LastPass or any company that provide cloud password manager. Any password uploaded to a server you don't control should be considered disclosed. They can say what ever they want about their encryption pipeline, even release it as open source software, you can't be 100% certain that they run it unmodified. You simply can't trust a company (that want to make profit at any cost, like all companies) with profitable data (like your login/password). One day someone will sell them.
- ramraj07 8y agoParanoia is good but do you also never go in any vehicle? Surely you know people die in them all the time! Everyone takes some risks and the vast majority of people I trust to take the most calculated ones use a password manager. Incidentally I do too. However I do not upload my bank passwords, and my Gmail / Facebook passwords there, so I did account for the absolute faint possibility of LastPass being compromised. I guess I just don't care about my Reddit or HN account that much!
- Phenix88be 8y agoWe are talking about login and password, not cars. Taking drugs is also a calculated risk, still, most people agree that you shouldn't...
- geofft 8y agoThis is why I don't use CPUs that other companies have built, and solder my CPUs myself from transistors I bought in Shenzhen while wearing a ski mask and sunglasses. You never know if Intel is secretly copying your data.
- ernesth 8y agoHow do you login to any service if you do not upload your password to their server?
- Phenix88be 8y agoUploading a whole database of all your login/password and using on single login/password already know by the company doesn't sounds the same to me.
- Razengan 8y agoI've only ever used Apple's iCloud Keychain [0]. It has always worked great, and seems to have good security in order to enable; it asks for the local login password that you signed onto one of your other devices with, but it feels scarily easy to see ALL your passwords in plaintext with just a single Face ID authentication. I'd be more comfortable with bio-authenticating per password (though that might use more battery) and preferably asking for the password/code if you look up more than 5 passwords too quickly, but I'd rather have to trust a big company than a smaller third-party that gets acquired and sold around. What are the advantages of LastPass and other password managers over iCloud Keychain? [0] https://support.apple.com/en-ae/HT204085 https://support.apple.com/en-ae/HT204085
- lotsofpulp 8y agoI use keychain for convenience, but I also don’t enable touchID or faceID for this very reason. Too easy for someone to gain access to all of your credentials. With touchID, anytime you’re unconscious, anyone can get access to all of your stuff. KeepassX works well as the actual database of credentials.
- sneak 8y agoWhat is your threat model where someone has access to you while you are unconscious who also wants your web passwords?
- lotsofpulp 8y agoI don’t understand the question. I don’t want anyone to be able to get access to my credentials while I’m unconscious or incapacitated, so I don’t use touchID or faceID.
- aloer 8y agoIf only there would be a browser extension for anything other than safari on OS X. Manually copying passwords (and then saving in chrome) gets real annoying
- izzydata 8y agoIsn't the goal of password managers like LastPass convenience at the cost of security? They might take security as seriously as they can, but it is ultimately less secure than memorizing dozens of unique passwords if you could.
- lvh 8y agoNot only do humans demonstrably not do that, no: they cant memorize that much data. Secondly, a password manager does not have to upload your passwords anywhere directly, they can be protected with a master password or a different encryption mechanism (eg smartcard).
- brookside 8y ago‘If you could’ being the key phrase. Password managers are widely recommended in almost all ‘protect yourself being hacked’ writings.
- Spooky23 8y agoYou should always be concerned about giving private information to third parties. The integrity of that information is only protected by your contract and the law.
- ubermonkey 8y agoI know it's probably simplistic, but I'm horrified by the shift in the password vault market from local control and security to this cloud-based model. Even my choice, 1Password, has gotten on board - though it's still possible to store locally and avoid their sync, thank goodness.
- dddddaviddddd 8y agoAgreed, I expect to leave 1Password when/if they remove local storage or make it untenable.
- OnlyRepliesToBS 8y agodownplay reality; promote product
- deleted 8y ago[deleted]
- systematical 8y agoI assume last pass will be hacked someday. And when it is that person will have my Reddit, Hacker news, amazon etc.. But not my email or financials. I store super important items to human memory only. For many accounts like my github they will have to defeat two factor authentication. I hope people keep polling password managers for exploits to make it more secure. I know it's not perfect. I understand the risk-reward.
- cik 8y agoI store everything in a Keepass. I maintain that keepass on a SpiderOak Hive that syncs between multiple machines, and mobile. The password for SpiderOak is not one I know - it's in my password safe and written on paper in a safety deposit box. The password for my password safe is one three passwords I know: unlocking my root partition, my desktop account passwords, and this. I have infinitely more faith in something whose encryption is zero knowledge with multiple tiers, as opposed to LastPass. I'll never understand the notion of password as a service being an acceptable risk.
- squegles 8y agoWow, I was thinking about this just yesterday. LastPass should offer some kind of self hosted version for businesses.
- zumzumzum 8y agoJust a little PSA, 1Password7 let's you run entirely on local vault files. I have a NAS at home (Synology, but you could use whatever) to sync that vault file between it and all my devices, mobile included, only on wifi. I subscribe to 1Password's monthly model with the cloud services, but I just don't use any of them, and they have settings on every client which let you choose the default vault for saving, and I just use the local one. Best in class apps, local password storage only. Best of both worlds, unless there is some angle I'm missing.
- tzs 8y ago> I subscribe to 1Password's monthly model with the cloud services, but I just don't use any of them, and they have settings on every client which let you choose the default vault for saving, and I just use the local one. For those who wonder why one might subscribe to the cloud service when one is only going to use local vaults, rather than buying a license for the non-cloud version, the non-cloud version requires separate licenses for your Macs and for your Windows PCs, and major upgrades cost a substantial fraction of the initial price. With the cloud service one purchase covers all your devices and all major upgrades for as long as your subscription is active. I think it worked out when I did the math almost a year ago that if you have both Macs and PCs, then the cloud came out cheaper if you assumed a major upgrade every couple of years.
- dontbenebby 8y agoAs a die hard linux geek, why does the PW manager have to handle cloud storage? I use keepass + spideroak to sync. Keeps things simpler, IMHO. Maybe slightly more effort to log into things but I value having control and simplicity in my workflow.
- sneak 8y agoMany of us often use the web on our telephones.
- hello_tyler 8y agoSince no company is totally secure, of course you should be concerned. I would never use a cloud based system even if it is more convenient. I'll stick with a local keepass backups thankyouverymuch. Though I suppose if I was a real target I would trust LastPass before my own security.