5 ms·

Was prepared to change all my darn credentials when clicking on that. For those clicking the comments first, the byline is: "LastPass has released a fix last we

Was prepared to change all my darn credentials when clicking on that. For those clicking the comments first, the byline is: "LastPass has released a fix last week. Vulnerability details are now public. Users advised to update."

wglb 7y ago
For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass. Just one example (this one from 2017) of many: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225 https://bugs.chromium.org/p/project-zero/issues/detail?id=12.... Fundamental architectural flaws. For more HN references, see https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=lastpass%20vulnerability&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- kretor 7y ago
  Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations: "KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them." Asked about the experience he had reporting a 1Password vulnerability, he says: "Astonishingly bad" (source: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392)
JshWright 7y ago
Your comment implies that you're no longer changing your credentials?
- syntheticnature 7y ago
  Perhaps they mean just not all of them Right Now.
  - tastroder 7y ago
    Yeah, that and especially not all the nonsense that's stored in there at once. I kind of wanted to migrate away to something local I'd also trust with mail and banking credentials but lastpass is one of those things for me that works just well enough to not push me over the edge to actually change anything.

wglb 7y ago

For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass. Just one example (this one from 2017) of many: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225 https://bugs.chromium.org/p/project-zero/issues/detail?id=12.... Fundamental architectural flaws. For more HN references, see https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=lastpass%20vulnerability&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

kretor 7y ago
Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations: "KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them." Asked about the experience he had reporting a 1Password vulnerability, he says: "Astonishingly bad" (source: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392)

JshWright 7y ago

Your comment implies that you're no longer changing your credentials?

syntheticnature 7y ago
Perhaps they mean just not all of them Right Now.
- tastroder 7y ago
  Yeah, that and especially not all the nonsense that's stored in there at once. I kind of wanted to migrate away to something local I'd also trust with mail and banking credentials but lastpass is one of those things for me that works just well enough to not push me over the edge to actually change anything.