31 ms·

LastPass bug leaks credentials from previous site

310 points by Daviey 7y ago

vortico 7y ago
Haha, lives up to its name. It exposes the last pass used before the current website.
paulnpace 7y ago
When an article states "...the bug relies on executing malicious JavaScript...", why is the bug considered to be in the plugin and not JavaScript?
- kaikai 7y ago
  Using a programming language to exploit something doesn't mean the programming language is flawed.
  - paulnpace 7y ago
    So, are they using the phrase "malicious JavaScript" correctly? Shouldn't they remove "malicious"?
    - woodrowbarlow 7y ago
      "malicious code" is code that was written with the express purpose of exploiting a weakness or flaw. they're not saying javascript is malicious. they're saying someone could write malicious javascript code (and then trick a user into executing it) that exploits a flaw in lastpass.
techntoke 7y ago
This is why I use pass and browserpass. I can't vouch for browserpass extension, but pass is just a wrapper for GnuPG. The encrypted files can be synced using almost any sync solution or even Git. There are apps for mobile too.
- Semaphor 7y ago
  That makes no sense as the point of attack here is exactly the extension. So wrt this type of bug you gain nothing.
  - techntoke 7y ago
    You have the option of not using the extension with this method, and the same vulnerability likely doesn't exist with Browserpass due to the communication method.
    - Semaphor 7y ago
      But you have the same option with lastpass.
tastroder 7y ago
Was prepared to change all my darn credentials when clicking on that. For those clicking the comments first, the byline is: "LastPass has released a fix last week. Vulnerability details are now public. Users advised to update."
- wglb 7y ago
  For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass. Just one example (this one from 2017) of many: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225 https://bugs.chromium.org/p/project-zero/issues/detail?id=12.... Fundamental architectural flaws. For more HN references, see https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=lastpass%20vulnerability&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
  - kretor 7y ago
    Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations: "KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them." Asked about the experience he had reporting a 1Password vulnerability, he says: "Astonishingly bad" (source: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392)
- JshWright 7y ago
  Your comment implies that you're no longer changing your credentials?
  - syntheticnature 7y ago
    Perhaps they mean just not all of them Right Now.
    - 7y ago
nerdjon 7y ago
I am seriously considering alternatives to LastPass. Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. Almost never actually fills in my passwords (often have to click copy password), often thinks I am on a different website than I am, or just gives me an empty white box when I click the LastPass button.
- simcop2387 7y ago
  While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser based applications (though I can't say I use that feature myself).
  - acidburnNSA 7y ago
    I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?
    - simcop2387 7y ago
      Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress. They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.
dzhiurgis 7y ago
Classic LastPass. Shoddiest pw manager out there with history of editing wiki pages to hide their sad track record.
- nailer 7y ago
  Interested in this. Got a link?
  - dzhiurgis 7y ago
    I've described it here: https://news.ycombinator.com/item?id=15756044 https://news.ycombinator.com/item?id=15756044
latchkey 7y ago
Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.
- jchw 7y ago
  I switched to Bitwarden as well, from 1password, which I switched off of from Lastpass. It’s not as pretty as 1password, but it’s cheaper, platform support is better (1password X helped here but it was too-little-too-late for me,) and it’s open source which is a nice touch. I have no regrets either; paying customer as well. I tried KeePass XC on the side and I’ve gotta say, very formidable option if you want one that is FOSS and with no central server. My only real issue is the mobile app story.
- bilal4hmed 7y ago
  +1 for bitwarden, moved to them a few months ago and its been rock solid.
- 2bluesc 7y ago
  +1 for Bitwarden. Considered doing the self-hosted approach, but wound up paying to support the project.
- rmilejczz 7y ago
  I tell everyone I can about bitwarden. I see many colleagues using Dashlane or even LastPass but bitwarden just takes the cake for me. It does a great job at staying out of the way and reliably doing whatever it is I need it to do and I can’t recommend it enough!
- nickthemagicman 7y ago
  Does Bitwarden do a phone app?
  - JshWright 7y ago
    Yep, both iOS and Android.
kmfrk 7y ago
1Password is very straightforward after they added cloud vaults. Before that, it was kind of a mess, but it works quite decently now.
- alanh 7y ago
  As far as I know, 1Password has never suffered any hacks or critical vulnerabilities the way that LassPass has. I have used both in the past; I would never, ever recommend LastPass to anyone. 1Password, however? A nearly perfect product (with great support)
  - kmfrk 7y ago
    LastPass support is positively abysmal by comparison, good lord does everything suck about that experience.
deleted 7y ago
[deleted]
loteck 7y ago
It's interesting to note that browser extensions continue to be the primary point of vulnerability for password management solutions. IIRC, it's been quite a long time since vaults themselves were breached. It is an undeniably more secure option to use password managers without their associated extensions. Certainly less convenient, but ponder carefully your threat model.
- mook 7y ago
  Unfortunately the browsers persist in not providing the necessary APIs to allow the password managers to work safely. The Mozilla bug (1344788) has been open for three years with no meaningful action in 2. It's been stuck waiting for security review, with nobody empowered to do it.
celticmusic 7y ago
Is that true about LastPass being the most popular password manager? I just can't imagine it, I'm forced to use it with a client, and it has hands down the worst UI experience I've ever seen.
- paulddraper 7y ago
  Long time last pass user...what do you recommend? Team of 15-30 people, need shared username/password credentials for web, FTP, and DB systems. Also other arbitrary secure "notes", e.g. SSH key. Needs 2FA as well.
  - nathancahill 7y ago
    1Password is quite nice. Migrated a team from LastPass to 1Password recently, the experience was very smooth.
  - madamelic 7y ago
    If I recall correctly, you can use `pass` as a team and individually revoke / add keys as the team changes. With that said, LastPass or something similar is an easier solution for a team.
  - celticmusic 7y ago
    1pass has a much better UI imo.
  - MaKleSoft 7y ago
    https://padloc.app https://padloc.app (currently in beta. shoot me an email if you want to try it: martin@padloc.app)
- ashelmire 7y ago
  Really? I find this hard to believe, as a dev and internet user. Facebook, instagram, etc have far worse interfaces. You add the extension, easily add/generate/create/autofill your login info. It's usually as simple as clicking an icon that appears in the relevant field.
michannne 7y ago
I remember my account was locked out completely even though I never did anything. Tried all passwords I knew, but of course you only get limited attempts (Why? If I'm using a brute-forceable password I'm already screwed, I'd rather have unlimited attempts to guess my complex password). I went through all the hoops to get a One-Time Password or whatever it was, tried it on all machines I own, no luck. That's when I decided it wasn't worth it to entrust all of my passwords to an opaque entity like that, it's not ideal, but it's better than losing access to everything I use.
mdesq 7y ago
I've love to switch away from LastPass. I switched to LastPass Families when it came out due to their "digital contingency plan" so family members (or the trusted family attorney) can get access to passwords rather conveniently if I or another family member passes away. At the time, I didn't see that other offerings made this as easy. Any other good options out there for this use case?
- dkoston 7y ago
  1Password has a Families plan for this.
  - mdesq 7y ago
    I will look into this. I do trust certain family members with access to my vault password, but the notification of access and ability to give access to a trusted third party (my lawyer) that is available with LP is very compelling.
    - dkoston 7y ago
      1Password allows you to add family members with access to specific values either read-only or read/write. The system for adding access is multi-step so unless you add someone to a vault they shouldn’t see, you have the flexibility to share as little or as much as you want. Since you can name the vaults you can name them things like “Shared with M Toussant (Attorney)” or “Samir Martha and Paul” which can make it easy to determine where to store what secrets. Have been using Business for a few years with some of my companies and Family with my family and have had good experiences. You can initiate recoveries as the administrator as well which has been helpful in both cases.
- JshWright 7y ago
  I use BitWarden for this. If it's just you and a partner, their free version works. If you have a larger set of people you want to share sets of credentials with (up to 5), the family version is $1/mo. It's not exactly the same as LastPass' "contingency plan" feature (since you're simply sharing some credentials all the time), but it works well enough for me.
gorhill 7y ago
The bug report says: by iframing popupfilltab.html (i.e. via moz-extension, ms-browser-extension, chrome-extension, etc). It's a valid web_accessible_resource. [...] y.src="chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/popupfilltab.html"; // or y.src="moz-extension://..."; My understanding is that this should not work with the Firefox version of LastPass, since each installation of the extension is given a unique id which can't be guessed by web pages -- that is unless the unique id is made visible to web pages by the extension itself.
- P_I_Staker 7y ago
  I have not read the article in detail, but earlier news stories I've seen said that not all platforms were effected. Chrome and I believe Opera were mentioned, but not firefox.
a-ve 7y ago
I quit LastPass when they were acquired by LogmeIn and doubled their prices to $24 a year, and their constant issues with autofill (atleast for websites in my country). I switched to Bitwarden and haven't faced an issue since.
- syntheticnature 7y ago
  I, too, began looking after the doubling in cost (without any notice that I noticed) plus the autofill issues, and switched to Bitwarden. This story reminded me that I hadn't deleted my LastPass account yet, and when I did I got a buggy error message, something to the effect of "Error: .A" after the double-confirm. Looks like the deletion went through, though... just an error in the process, which is uninspiring.
- ainiriand 7y ago
  Even worse, before it was just 12$ and now it is 24$ before taxes so you end up paying 29,52$. A 246% increase.
  - AnotherRainyDay 7y ago
    I got my renewal notice email in the other day. It's $36 now. "Your LastPass Premium subscription will renew at $36 per year; this reflects the 2019 updated list price." I think I'm going to switch to Bitwarden after reading some of the comments in the thread.
  - _salmon 7y ago
    People are really complaining about this, but honestly the features I get from the product absolutely justify paying $2/month. I'd probably pay $3-4 before it wouldn't become worth it for me
    - jdofaz 7y ago
      For me they have tripled the price since I first subscribed and the bugs aren't getting fixed. I'm tired of the fill problems on iOS and Firefox and the price increases compound my irritation.
zeven7 7y ago
I've been just using Chrome's built-in password storage feature, though I see a lot of people are still using extensions. Any reason to prefer an extension or third party over just using the built-in Chrome feature?
- sleepychu 7y ago
  Works outside of browser, I use mine for things on my phone with the LastPass Autofill. Doesn't tie me to one browser or their security model.
- anuragsoni 7y ago
  I like using a third party alternative since it gives me the option to use it outside the google ecosystem. I use Firefox and Chrome regularly so the seamless syncing without depending on any particular browser is important for me. The other feature I like in dedicated password managers is that they tend to have a lot more options about what kind of password/passphrase you can generate. Some other features that i regularly use is storing non password content like software licenses, sharing certain passwords with my spouse, etc.
- fasicle 7y ago
  Makes it harder to switch to another browser (I do also use the Chrome built-in password storage).
- symlinkk 7y ago
  The cool thing about 1Password and similar is that not only do they work in other browsers (Firefox), they also work outside of the browsers (e.g. in iOS I can autofill login boxes with credentials pulled from 1Password)
  - arawde 7y ago
    This feature exists on Android. I can sign in to my chess app with login credentials stored by Chrome (as an example)
w8rbt 7y ago
This is one reason why I believe that browser based password managers are flawed. I've written about this in the past (link below). These apps are popular with normal people (due to convenience), but long-term, we should not trust web browsers plugins or add-ons as password managers. https://github.com/w8rbt/dpg#why-traditional-password-managers-are-flawed https://github.com/w8rbt/dpg#why-traditional-password-manage...
- Someone1234 7y ago
  That only makes sense when you ignore the bigger picture. Before browser-based password managers people weren't using password managers at all. The two most common (and successful) attack vectors have been via password reuse and low password quality. Convenience, context aware, device agnostic, browser based, password managers have been successful in convincing the general public to use a password manager at all. The use of a password manager allows people to have per-site and higher quality (e.g. long/difficult to remember) passwords. This has had a positive impact on people's security. KeePass and similar "offline" solutions avoids some specific attack vectors. However, both "offline" solutions and browser-based extensions also share a great deal of vectors. For example if bad-ware has local execution inside the user's context, all bets are off (assuming you're running KeePass and the database is decrypted in memory, which you need to in order to retrieve a password). It is fine to suggest options people feel are superior, but ultimately the conveniences are a security benefit within themselves because people are actually using and sticking to password managers (thus avoiding password re-use/low quality passwords).
- CJefferson 7y ago
  While in browser password managers have drawbacks, they have the big advantage that they stop fishing / fake domain attacks. I think I'm much mor likely to fall for one of those, than my password manager get hacked. Also, generating all passwords off one master password deterministicly sounds like an awful, awful idea. If someone manages to get one of my passwords, they can try performing an offline attack against the encoding password. If they succeed, they have everything.
  - 7y ago
ifcho 7y ago
I have been using enpass, and I'm very satisfied. I was a LastPass user once, but never trusted their security model. Then switched to 1password, but the lack of good multiplatform support and their push to a cloud model made me look for alternatives. What I want is support for Mac, Windows, Linux, and Android; possibly one time payment; and local storage (most important). For syncing I use my own nextpass cloud. Bitwarden is close, but enpass fullfills all.
- rolltiide 7y ago
  I’m still using non-cloud 1password but I cant recommend it to anyone else or my employees because of the forced cloud thing
  - gr2020 7y ago
    FYI, 1Password doesn’t force you to use their cloud service. Even if you subscribe (as opposed to standalone), you still don’t have to actually use it. I switched from an older standalone version to the current subscription version, but I’m not using their cloud service to sync my vault.
    - gr8pes 7y ago
      Can you point me to some documentation that describes how to get rid of the subscription cloud service? I just want a one time fee to purchase 1P and then I want to just iCloud sync my 1P vaults.
danielsmay1 7y ago
I've been very disappointed with LastPass in the past year or so. I've had multiple instances where it doesn't actually save a password or secure note that I tried to save. This has caused me a lot of stress the few times it happened, including one login permanently. Sadly I paid for a 10 year plan and have 4 years to go. Saved me some money, but for what product? I use 1Password for work, and it is MUCH better than LastPass.
nickthemagicman 7y ago
Confused as to why tech people in this thread are giving LastPass flak for a single bug. They've had a pretty good track record for the past half decade or so since I've been using them and they submitted a fix immediately for this bug. Bugs happen, and this is a particularly obscure/esoteric bug. Right?
- travisp 7y ago
  I disagree that they've had a good track record. https://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ https://www.martinvigo.com/even-the-lastpass-will-be-stolen-... https://twitter.com/tqbf/status/836619941805764609 https://twitter.com/tqbf/status/836619941805764609 https://twitter.com/taviso/status/843965519371812864 https://twitter.com/taviso/status/843965519371812864 I've seen very few security researchers recommend it, while they will recommend other services.
  - Barrin92 7y ago
    what is the generally recommended service?
hnarn 7y ago
This is a good time to remind everyone that if you don't have 2-part authentication to a service, that's because you don't care about other people accessing it.
vz8 7y ago
For anyone who needs to confirm they have updated Lastpass, this link[0] documents reinstallation / updates. [0] https://support.logmeininc.com/lastpass/help/how-do-i-enable-the-lastpass-web-browser-extension-lp070006 https://support.logmeininc.com/lastpass/help/how-do-i-enable...
wj 7y ago
I hope this fixes the issue I have with one of my banking sites where it propoluates the login with my old username and password which aren't stored in LastPass anymore. Really weird that it seems to have them cached somewhere so I have manually select the bank's credentials in order to log in.
nogridbag 7y ago
I've been using LastPass for a long time, but I don't understand why they don't support FIDO2 as a MFA option.
wging 7y ago
Seems likely that the link will be replaced by a link to Tavis's write-up https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 https://bugs.chromium.org/p/project-zero/issues/detail?id=19..., but media coverage is interesting on its own, so I'll note the link is currently https://www.zdnet.com/article/lastpass-bug-leaks-credentials-from-previous-site/ https://www.zdnet.com/article/lastpass-bug-leaks-credentials... / title "LastPass bug leaks credentials from previous site". I won't quote specific passages, it's just interesting to watch attempts to distill a technical issue into something for the general public's consumption.
some1else 7y ago
Password managers are great, just don't use the browser extension. Don't even use the Grammarly extension.
- highhedgehog 7y ago
  Care to elaborate?
  - some1else 7y ago
    Generally, I don't enjoy sending every keypress to a spellcheck API. Every extension increases the attack surface area. The browser should remain secure, use the native apps.
majinuub 7y ago
Switched from LastPass to KeePass a couple months ago. Glad that I made the move.
rkagerer 7y ago
They listed it as "Security: Minor bug fixes" in their release notes (v4.33.0, https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=1 https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=...) Leakage of credentials seems like more than a "minor" bug - particularly for software whose whole purpose is to securely store those credentials.
- ggg3 7y ago
  well, users already leave passwords in the clipboard as normal usage...
JOnAgain 7y ago
I don’t use the browser extensions. I deal with copy paste BS every day, but i rest easier.
_iyig 7y ago
I looked into LastPass and similar options a couple years ago, and ultimately decided on the Chrome password manager (with option for the never-transmitted encryption passphrase). Among other reasons, the Google Security Team seemed bigger and better funded, and I already trust them with my e-mail anyway. I supplement this with a text file that I encrypt/decrypt with the OpenSSL command-line utility, since the latter is available on Linux, Mac, and Windows via Cygwin. So far it’s been a pleasant experience.
kretor 7y ago
Password manager recommendations from Tavis Ormandy, who found the bug: "KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them." He adds about Lastpass: "I consider them competent, I've reported some pretty complex issues and found they handle them well. Attack surface is definitely massive, I always recommend KeePass or just use a book if that's too complicated" (source: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392)

310 points by Daviey 7y ago

Haha, lives up to its name. It exposes the last pass used before the current website.

When an article states "...the bug relies on executing malicious JavaScript...", why is the bug considered to be in the plugin and not JavaScript?

kaikai 7y ago
Using a programming language to exploit something doesn't mean the programming language is flawed.
- paulnpace 7y ago
  So, are they using the phrase "malicious JavaScript" correctly? Shouldn't they remove "malicious"?
  - woodrowbarlow 7y ago
    "malicious code" is code that was written with the express purpose of exploiting a weakness or flaw. they're not saying javascript is malicious. they're saying someone could write malicious javascript code (and then trick a user into executing it) that exploits a flaw in lastpass.

techntoke 7y ago

This is why I use pass and browserpass. I can't vouch for browserpass extension, but pass is just a wrapper for GnuPG. The encrypted files can be synced using almost any sync solution or even Git. There are apps for mobile too.

Semaphor 7y ago
That makes no sense as the point of attack here is exactly the extension. So wrt this type of bug you gain nothing.
- techntoke 7y ago
  You have the option of not using the extension with this method, and the same vulnerability likely doesn't exist with Browserpass due to the communication method.
  - Semaphor 7y ago
    But you have the same option with lastpass.

tastroder 7y ago

Was prepared to change all my darn credentials when clicking on that. For those clicking the comments first, the byline is: "LastPass has released a fix last week. Vulnerability details are now public. Users advised to update."

wglb 7y ago
For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass. Just one example (this one from 2017) of many: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225 https://bugs.chromium.org/p/project-zero/issues/detail?id=12.... Fundamental architectural flaws. For more HN references, see https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=lastpass%20vulnerability&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- kretor 7y ago
  Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations: "KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them." Asked about the experience he had reporting a 1Password vulnerability, he says: "Astonishingly bad" (source: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392)
JshWright 7y ago
Your comment implies that you're no longer changing your credentials?
- syntheticnature 7y ago
  Perhaps they mean just not all of them Right Now.
  - 7y ago

nerdjon 7y ago

I am seriously considering alternatives to LastPass. Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. Almost never actually fills in my passwords (often have to click copy password), often thinks I am on a different website than I am, or just gives me an empty white box when I click the LastPass button.

simcop2387 7y ago
While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser based applications (though I can't say I use that feature myself).
- acidburnNSA 7y ago
  I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?
  - simcop2387 7y ago
    Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress. They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.

dzhiurgis 7y ago

Classic LastPass. Shoddiest pw manager out there with history of editing wiki pages to hide their sad track record.

nailer 7y ago
Interested in this. Got a link?
- dzhiurgis 7y ago
  I've described it here: https://news.ycombinator.com/item?id=15756044 https://news.ycombinator.com/item?id=15756044

latchkey 7y ago

Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.

jchw 7y ago
I switched to Bitwarden as well, from 1password, which I switched off of from Lastpass. It’s not as pretty as 1password, but it’s cheaper, platform support is better (1password X helped here but it was too-little-too-late for me,) and it’s open source which is a nice touch. I have no regrets either; paying customer as well. I tried KeePass XC on the side and I’ve gotta say, very formidable option if you want one that is FOSS and with no central server. My only real issue is the mobile app story.
bilal4hmed 7y ago
+1 for bitwarden, moved to them a few months ago and its been rock solid.
2bluesc 7y ago
+1 for Bitwarden. Considered doing the self-hosted approach, but wound up paying to support the project.
rmilejczz 7y ago
I tell everyone I can about bitwarden. I see many colleagues using Dashlane or even LastPass but bitwarden just takes the cake for me. It does a great job at staying out of the way and reliably doing whatever it is I need it to do and I can’t recommend it enough!
nickthemagicman 7y ago
Does Bitwarden do a phone app?
- JshWright 7y ago
  Yep, both iOS and Android.

kmfrk 7y ago

1Password is very straightforward after they added cloud vaults. Before that, it was kind of a mess, but it works quite decently now.

alanh 7y ago
As far as I know, 1Password has never suffered any hacks or critical vulnerabilities the way that LassPass has. I have used both in the past; I would never, ever recommend LastPass to anyone. 1Password, however? A nearly perfect product (with great support)
- kmfrk 7y ago
  LastPass support is positively abysmal by comparison, good lord does everything suck about that experience.

deleted 7y ago

[deleted]

loteck 7y ago

It's interesting to note that browser extensions continue to be the primary point of vulnerability for password management solutions. IIRC, it's been quite a long time since vaults themselves were breached. It is an undeniably more secure option to use password managers without their associated extensions. Certainly less convenient, but ponder carefully your threat model.

mook 7y ago
Unfortunately the browsers persist in not providing the necessary APIs to allow the password managers to work safely. The Mozilla bug (1344788) has been open for three years with no meaningful action in 2. It's been stuck waiting for security review, with nobody empowered to do it.

celticmusic 7y ago

Is that true about LastPass being the most popular password manager? I just can't imagine it, I'm forced to use it with a client, and it has hands down the worst UI experience I've ever seen.

paulddraper 7y ago
Long time last pass user...what do you recommend? Team of 15-30 people, need shared username/password credentials for web, FTP, and DB systems. Also other arbitrary secure "notes", e.g. SSH key. Needs 2FA as well.
- nathancahill 7y ago
  1Password is quite nice. Migrated a team from LastPass to 1Password recently, the experience was very smooth.
- madamelic 7y ago
  If I recall correctly, you can use `pass` as a team and individually revoke / add keys as the team changes. With that said, LastPass or something similar is an easier solution for a team.
- celticmusic 7y ago
  1pass has a much better UI imo.
- MaKleSoft 7y ago
  https://padloc.app https://padloc.app (currently in beta. shoot me an email if you want to try it: martin@padloc.app)
ashelmire 7y ago
Really? I find this hard to believe, as a dev and internet user. Facebook, instagram, etc have far worse interfaces. You add the extension, easily add/generate/create/autofill your login info. It's usually as simple as clicking an icon that appears in the relevant field.

michannne 7y ago

I remember my account was locked out completely even though I never did anything. Tried all passwords I knew, but of course you only get limited attempts (Why? If I'm using a brute-forceable password I'm already screwed, I'd rather have unlimited attempts to guess my complex password). I went through all the hoops to get a One-Time Password or whatever it was, tried it on all machines I own, no luck. That's when I decided it wasn't worth it to entrust all of my passwords to an opaque entity like that, it's not ideal, but it's better than losing access to everything I use.

mdesq 7y ago

I've love to switch away from LastPass. I switched to LastPass Families when it came out due to their "digital contingency plan" so family members (or the trusted family attorney) can get access to passwords rather conveniently if I or another family member passes away. At the time, I didn't see that other offerings made this as easy. Any other good options out there for this use case?

dkoston 7y ago
1Password has a Families plan for this.
- mdesq 7y ago
  I will look into this. I do trust certain family members with access to my vault password, but the notification of access and ability to give access to a trusted third party (my lawyer) that is available with LP is very compelling.
  - dkoston 7y ago
    1Password allows you to add family members with access to specific values either read-only or read/write. The system for adding access is multi-step so unless you add someone to a vault they shouldn’t see, you have the flexibility to share as little or as much as you want. Since you can name the vaults you can name them things like “Shared with M Toussant (Attorney)” or “Samir Martha and Paul” which can make it easy to determine where to store what secrets. Have been using Business for a few years with some of my companies and Family with my family and have had good experiences. You can initiate recoveries as the administrator as well which has been helpful in both cases.
JshWright 7y ago
I use BitWarden for this. If it's just you and a partner, their free version works. If you have a larger set of people you want to share sets of credentials with (up to 5), the family version is $1/mo. It's not exactly the same as LastPass' "contingency plan" feature (since you're simply sharing some credentials all the time), but it works well enough for me.

gorhill 7y ago

The bug report says: by iframing popupfilltab.html (i.e. via moz-extension, ms-browser-extension, chrome-extension, etc). It's a valid web_accessible_resource. [...] y.src="chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/popupfilltab.html"; // or y.src="moz-extension://..."; My understanding is that this should not work with the Firefox version of LastPass, since each installation of the extension is given a unique id which can't be guessed by web pages -- that is unless the unique id is made visible to web pages by the extension itself.

P_I_Staker 7y ago
I have not read the article in detail, but earlier news stories I've seen said that not all platforms were effected. Chrome and I believe Opera were mentioned, but not firefox.

a-ve 7y ago

I quit LastPass when they were acquired by LogmeIn and doubled their prices to $24 a year, and their constant issues with autofill (atleast for websites in my country). I switched to Bitwarden and haven't faced an issue since.

syntheticnature 7y ago
I, too, began looking after the doubling in cost (without any notice that I noticed) plus the autofill issues, and switched to Bitwarden. This story reminded me that I hadn't deleted my LastPass account yet, and when I did I got a buggy error message, something to the effect of "Error: .A" after the double-confirm. Looks like the deletion went through, though... just an error in the process, which is uninspiring.
ainiriand 7y ago
Even worse, before it was just 12$ and now it is 24$ before taxes so you end up paying 29,52$. A 246% increase.
- AnotherRainyDay 7y ago
  I got my renewal notice email in the other day. It's $36 now. "Your LastPass Premium subscription will renew at $36 per year; this reflects the 2019 updated list price." I think I'm going to switch to Bitwarden after reading some of the comments in the thread.
- _salmon 7y ago
  People are really complaining about this, but honestly the features I get from the product absolutely justify paying $2/month. I'd probably pay $3-4 before it wouldn't become worth it for me
  - jdofaz 7y ago
    For me they have tripled the price since I first subscribed and the bugs aren't getting fixed. I'm tired of the fill problems on iOS and Firefox and the price increases compound my irritation.

zeven7 7y ago

I've been just using Chrome's built-in password storage feature, though I see a lot of people are still using extensions. Any reason to prefer an extension or third party over just using the built-in Chrome feature?

sleepychu 7y ago
Works outside of browser, I use mine for things on my phone with the LastPass Autofill. Doesn't tie me to one browser or their security model.
anuragsoni 7y ago
I like using a third party alternative since it gives me the option to use it outside the google ecosystem. I use Firefox and Chrome regularly so the seamless syncing without depending on any particular browser is important for me. The other feature I like in dedicated password managers is that they tend to have a lot more options about what kind of password/passphrase you can generate. Some other features that i regularly use is storing non password content like software licenses, sharing certain passwords with my spouse, etc.
fasicle 7y ago
Makes it harder to switch to another browser (I do also use the Chrome built-in password storage).
symlinkk 7y ago
The cool thing about 1Password and similar is that not only do they work in other browsers (Firefox), they also work outside of the browsers (e.g. in iOS I can autofill login boxes with credentials pulled from 1Password)
- arawde 7y ago
  This feature exists on Android. I can sign in to my chess app with login credentials stored by Chrome (as an example)

w8rbt 7y ago

This is one reason why I believe that browser based password managers are flawed. I've written about this in the past (link below). These apps are popular with normal people (due to convenience), but long-term, we should not trust web browsers plugins or add-ons as password managers. https://github.com/w8rbt/dpg#why-traditional-password-managers-are-flawed https://github.com/w8rbt/dpg#why-traditional-password-manage...

Someone1234 7y ago
That only makes sense when you ignore the bigger picture. Before browser-based password managers people weren't using password managers at all. The two most common (and successful) attack vectors have been via password reuse and low password quality. Convenience, context aware, device agnostic, browser based, password managers have been successful in convincing the general public to use a password manager at all. The use of a password manager allows people to have per-site and higher quality (e.g. long/difficult to remember) passwords. This has had a positive impact on people's security. KeePass and similar "offline" solutions avoids some specific attack vectors. However, both "offline" solutions and browser-based extensions also share a great deal of vectors. For example if bad-ware has local execution inside the user's context, all bets are off (assuming you're running KeePass and the database is decrypted in memory, which you need to in order to retrieve a password). It is fine to suggest options people feel are superior, but ultimately the conveniences are a security benefit within themselves because people are actually using and sticking to password managers (thus avoiding password re-use/low quality passwords).
CJefferson 7y ago
While in browser password managers have drawbacks, they have the big advantage that they stop fishing / fake domain attacks. I think I'm much mor likely to fall for one of those, than my password manager get hacked. Also, generating all passwords off one master password deterministicly sounds like an awful, awful idea. If someone manages to get one of my passwords, they can try performing an offline attack against the encoding password. If they succeed, they have everything.
- 7y ago

ifcho 7y ago

I have been using enpass, and I'm very satisfied. I was a LastPass user once, but never trusted their security model. Then switched to 1password, but the lack of good multiplatform support and their push to a cloud model made me look for alternatives. What I want is support for Mac, Windows, Linux, and Android; possibly one time payment; and local storage (most important). For syncing I use my own nextpass cloud. Bitwarden is close, but enpass fullfills all.

rolltiide 7y ago
I’m still using non-cloud 1password but I cant recommend it to anyone else or my employees because of the forced cloud thing
- gr2020 7y ago
  FYI, 1Password doesn’t force you to use their cloud service. Even if you subscribe (as opposed to standalone), you still don’t have to actually use it. I switched from an older standalone version to the current subscription version, but I’m not using their cloud service to sync my vault.
  - gr8pes 7y ago
    Can you point me to some documentation that describes how to get rid of the subscription cloud service? I just want a one time fee to purchase 1P and then I want to just iCloud sync my 1P vaults.

danielsmay1 7y ago

I've been very disappointed with LastPass in the past year or so. I've had multiple instances where it doesn't actually save a password or secure note that I tried to save. This has caused me a lot of stress the few times it happened, including one login permanently. Sadly I paid for a 10 year plan and have 4 years to go. Saved me some money, but for what product? I use 1Password for work, and it is MUCH better than LastPass.

nickthemagicman 7y ago

Confused as to why tech people in this thread are giving LastPass flak for a single bug. They've had a pretty good track record for the past half decade or so since I've been using them and they submitted a fix immediately for this bug. Bugs happen, and this is a particularly obscure/esoteric bug. Right?

travisp 7y ago
I disagree that they've had a good track record. https://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ https://www.martinvigo.com/even-the-lastpass-will-be-stolen-... https://twitter.com/tqbf/status/836619941805764609 https://twitter.com/tqbf/status/836619941805764609 https://twitter.com/taviso/status/843965519371812864 https://twitter.com/taviso/status/843965519371812864 I've seen very few security researchers recommend it, while they will recommend other services.
- Barrin92 7y ago
  what is the generally recommended service?

hnarn 7y ago

This is a good time to remind everyone that if you don't have 2-part authentication to a service, that's because you don't care about other people accessing it.

vz8 7y ago

For anyone who needs to confirm they have updated Lastpass, this link[0] documents reinstallation / updates. [0] https://support.logmeininc.com/lastpass/help/how-do-i-enable-the-lastpass-web-browser-extension-lp070006 https://support.logmeininc.com/lastpass/help/how-do-i-enable...

wj 7y ago

I hope this fixes the issue I have with one of my banking sites where it propoluates the login with my old username and password which aren't stored in LastPass anymore. Really weird that it seems to have them cached somewhere so I have manually select the bank's credentials in order to log in.

nogridbag 7y ago

I've been using LastPass for a long time, but I don't understand why they don't support FIDO2 as a MFA option.

wging 7y ago

Seems likely that the link will be replaced by a link to Tavis's write-up https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 https://bugs.chromium.org/p/project-zero/issues/detail?id=19..., but media coverage is interesting on its own, so I'll note the link is currently https://www.zdnet.com/article/lastpass-bug-leaks-credentials-from-previous-site/ https://www.zdnet.com/article/lastpass-bug-leaks-credentials... / title "LastPass bug leaks credentials from previous site". I won't quote specific passages, it's just interesting to watch attempts to distill a technical issue into something for the general public's consumption.

some1else 7y ago

Password managers are great, just don't use the browser extension. Don't even use the Grammarly extension.

highhedgehog 7y ago
Care to elaborate?
- some1else 7y ago
  Generally, I don't enjoy sending every keypress to a spellcheck API. Every extension increases the attack surface area. The browser should remain secure, use the native apps.

majinuub 7y ago

Switched from LastPass to KeePass a couple months ago. Glad that I made the move.

rkagerer 7y ago

They listed it as "Security: Minor bug fixes" in their release notes (v4.33.0, https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=1 https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=...) Leakage of credentials seems like more than a "minor" bug - particularly for software whose whole purpose is to securely store those credentials.

ggg3 7y ago
well, users already leave passwords in the clipboard as normal usage...

JOnAgain 7y ago

I don’t use the browser extensions. I deal with copy paste BS every day, but i rest easier.

_iyig 7y ago

I looked into LastPass and similar options a couple years ago, and ultimately decided on the Chrome password manager (with option for the never-transmitted encryption passphrase). Among other reasons, the Google Security Team seemed bigger and better funded, and I already trust them with my e-mail anyway. I supplement this with a text file that I encrypt/decrypt with the OpenSSL command-line utility, since the latter is available on Linux, Mac, and Windows via Cygwin. So far it’s been a pleasant experience.

kretor 7y ago

Password manager recommendations from Tavis Ormandy, who found the bug: "KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them." He adds about Lastpass: "I consider them competent, I've reported some pretty complex issues and found they handle them well. Attack surface is definitely massive, I always recommend KeePass or just use a book if that's too complicated" (source: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392)