3 ms·

> Given that all the cloud-based password managers have their own phone (and even desktop) apps, this seems like a moot point since a bad actor could push out a

> Given that all the cloud-based password managers have their own phone (and even desktop) apps, this seems like a moot point since a bad actor could push out an app update that does anything with your keys anyway. This seems to me like a great argument to avoid all cloud based providers and their mobie apps. Especially when opensource, time tested, self-hosted solutions exist. You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy.

Xylakant 8y ago
> You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy. From my practical observation: People will go to great length to avoid dealing with a crappy UX. That can include falling back to "YOLO, I'll just use the same password everywhere" if the password management process is sufficiently atrocious. So I'd say good UX is part of the security concept, bad UX will compromise it.
- techdragon 8y ago
  For me, the UX of maintaining an improved security posture is quite an important part of these products success, I get improved security and the product doesn’t make me think. The only way it could be better for me as a long term LastPass customer is if I had a good/safe tool to synchronise with the macOS keychain for improved redundancy and providing myself a future “exit strategy”, I rarely have to think about my use now that its integrated into the native iOS password prompt.
close04 8y ago
> You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy. Maybe, but a good UX goes a long way to convincing people to use the solution. The best security solution is the one you actually use.
rocqua 8y ago
> Compromising security for better comfort is not a very good strategy. This approach is exactly why the vast populace has essentially no security. I'd be glad if my parents were to switch to last-pass, as it is so much better then weak password re-use schemes. I'd say that compromising security for comfort is a given, its guaranteed to happen. The best strategy here is to make sure that users will have the most security after the compromise.
croon 8y ago
> You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy. People are reusing passwords and writing passwords down on post-its specifically because they haven't found sufficiently UI friendly options of password management. Regardless if that is out of ignorance of available options, UI not being friendly enough for them, or some other technical hinderance. A compromise isn't weighing between an ideal scenario and your current situation. A compromise is finding an optimum between value extremes in acceptable real world scenarios. An ideal security extreme is a disconnected system, but that's never something you can compromise towards since the comfort/usability reaches 0. You're trying to move security up by getting users away from pass reusage and post-its. In this case added comfort happens to also be increased security.
criddell 8y ago
> This seems to me like a great argument to avoid all cloud based providers and their mobie apps. Any app that gets updates is vulnerable to that type of attack.
geofft 8y ago
The open-source, "time tested," self-hosted solutions do not check that the website you're trying to paste a password onto is the website you should be pasting the password onto. That is a real and serious security risk, and the fact that the open-source solutions don't attempt to solve it does not mean it should not be solved. I think a lot of people feel uncomfortable giving a proprietary product access to their passwords, and feel more comfortable doing the copy-and-paste themselves. But compromising security for better comfort is not a very good strategy.
- gruez 8y ago
  >The open-source, "time tested," self-hosted solutions do not check that the website you're trying to paste a password onto is the website you should be pasting the password onto Keepass has a third party Firefox extension that does this. Bitwarden is open source and has their own extension that does the same.

Xylakant 8y ago

> You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy. From my practical observation: People will go to great length to avoid dealing with a crappy UX. That can include falling back to "YOLO, I'll just use the same password everywhere" if the password management process is sufficiently atrocious. So I'd say good UX is part of the security concept, bad UX will compromise it.

techdragon 8y ago
For me, the UX of maintaining an improved security posture is quite an important part of these products success, I get improved security and the product doesn’t make me think. The only way it could be better for me as a long term LastPass customer is if I had a good/safe tool to synchronise with the macOS keychain for improved redundancy and providing myself a future “exit strategy”, I rarely have to think about my use now that its integrated into the native iOS password prompt.

close04 8y ago

> You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy. Maybe, but a good UX goes a long way to convincing people to use the solution. The best security solution is the one you actually use.

rocqua 8y ago

> Compromising security for better comfort is not a very good strategy. This approach is exactly why the vast populace has essentially no security. I'd be glad if my parents were to switch to last-pass, as it is so much better then weak password re-use schemes. I'd say that compromising security for comfort is a given, its guaranteed to happen. The best strategy here is to make sure that users will have the most security after the compromise.

croon 8y ago

> You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy. People are reusing passwords and writing passwords down on post-its specifically because they haven't found sufficiently UI friendly options of password management. Regardless if that is out of ignorance of available options, UI not being friendly enough for them, or some other technical hinderance. A compromise isn't weighing between an ideal scenario and your current situation. A compromise is finding an optimum between value extremes in acceptable real world scenarios. An ideal security extreme is a disconnected system, but that's never something you can compromise towards since the comfort/usability reaches 0. You're trying to move security up by getting users away from pass reusage and post-its. In this case added comfort happens to also be increased security.

criddell 8y ago

> This seems to me like a great argument to avoid all cloud based providers and their mobie apps. Any app that gets updates is vulnerable to that type of attack.

geofft 8y ago

The open-source, "time tested," self-hosted solutions do not check that the website you're trying to paste a password onto is the website you should be pasting the password onto. That is a real and serious security risk, and the fact that the open-source solutions don't attempt to solve it does not mean it should not be solved. I think a lot of people feel uncomfortable giving a proprietary product access to their passwords, and feel more comfortable doing the copy-and-paste themselves. But compromising security for better comfort is not a very good strategy.

gruez 8y ago
>The open-source, "time tested," self-hosted solutions do not check that the website you're trying to paste a password onto is the website you should be pasting the password onto Keepass has a third party Firefox extension that does this. Bitwarden is open source and has their own extension that does the same.