4 ms·

I am seriously considering alternatives to LastPass. Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. Al

I am seriously considering alternatives to LastPass. Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. Almost never actually fills in my passwords (often have to click copy password), often thinks I am on a different website than I am, or just gives me an empty white box when I click the LastPass button.

simcop2387 7y ago
While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser based applications (though I can't say I use that feature myself).
- acidburnNSA 7y ago
  I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?
  - simcop2387 7y ago
    Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress. They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.
    - simcop2387 7y ago
      Forgot to mention, the syncing is all done via Nextcloud (open source dropbox like system, but also does a lot more).
ashelmire 7y ago
> Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. What do you mean? They still have browser extensions for all major browsers.
- nerdjon 7y ago
  Unless I am missing it, the only way to install it on Mac now is to install an App that acts as your vault and it installs the plugins. (if I click "Open my Vault" it opens a dedicated LastPass App on my Mac)
  - ashelmire 7y ago
    If you mean "the only way to USE it on Mac" is to install an app, I don't think that's true. At least, I've never done it. I use the browser extensions exclusively. Go to the extension store for your browser (example: chrome web store) and search for lastpass[1]. 1. https://chrome.google.com/webstore/detail/lastpass-free-password-ma/hdokiejnpimakedhajhdlcegeplioahd?hl=en-US https://chrome.google.com/webstore/detail/lastpass-free-pass...
  - jdeibele 7y ago
    I believe that's only true for Safari, which is moving away from the browser extension model that Firefox and Chrome (Brave, Opera, IE are/will be Chromium-based) use. I use Firefox and the LastPass extension without needing to use the Mac app.
sylens 7y ago
I moved to 1Password from LastPass a little over a year ago and have no complaints.
Angostura 7y ago
If you are only on Apple devices I would stay with Keychain Acess. Multi-platform? Bitwarden for me - if only for the external security audit they've done.
- bobbylarrybobby 7y ago
  Keychain does not provide 2fa support, which is kind of a deal breaker
  - cactus2093 7y ago
    It that true? Apple does support 2FA for logging into your Apple ID which AFAIK is the only way to access synced keychain data. Their approach is somewhat unique though. Once you log into any Apple device with a secure enclave (including all current macbooks, iphones, and ipads) that device becomes a second factor for authenticating future logins (which is prompted via an OS-level popup instead of a separate app or hardware dongle). So your computer itself can be the second factor which means you don't ever notice the 2FA enforcement, unlike most other systems that use a TOTP code or dongle.
lotsofpulp 7y ago
Keychain on macOS and iOS and keepassXC.
driverdan 7y ago
Try BitWarden. It's what LP used to be before the bloat and is open source.

simcop2387 7y ago

While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser based applications (though I can't say I use that feature myself).

acidburnNSA 7y ago
I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?
- simcop2387 7y ago
  Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress. They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.
  - simcop2387 7y ago
    Forgot to mention, the syncing is all done via Nextcloud (open source dropbox like system, but also does a lot more).

ashelmire 7y ago

> Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. What do you mean? They still have browser extensions for all major browsers.

nerdjon 7y ago
Unless I am missing it, the only way to install it on Mac now is to install an App that acts as your vault and it installs the plugins. (if I click "Open my Vault" it opens a dedicated LastPass App on my Mac)
- ashelmire 7y ago
  If you mean "the only way to USE it on Mac" is to install an app, I don't think that's true. At least, I've never done it. I use the browser extensions exclusively. Go to the extension store for your browser (example: chrome web store) and search for lastpass[1]. 1. https://chrome.google.com/webstore/detail/lastpass-free-password-ma/hdokiejnpimakedhajhdlcegeplioahd?hl=en-US https://chrome.google.com/webstore/detail/lastpass-free-pass...
- jdeibele 7y ago
  I believe that's only true for Safari, which is moving away from the browser extension model that Firefox and Chrome (Brave, Opera, IE are/will be Chromium-based) use. I use Firefox and the LastPass extension without needing to use the Mac app.

sylens 7y ago

I moved to 1Password from LastPass a little over a year ago and have no complaints.

Angostura 7y ago

If you are only on Apple devices I would stay with Keychain Acess. Multi-platform? Bitwarden for me - if only for the external security audit they've done.

bobbylarrybobby 7y ago
Keychain does not provide 2fa support, which is kind of a deal breaker
- cactus2093 7y ago
  It that true? Apple does support 2FA for logging into your Apple ID which AFAIK is the only way to access synced keychain data. Their approach is somewhat unique though. Once you log into any Apple device with a secure enclave (including all current macbooks, iphones, and ipads) that device becomes a second factor for authenticating future logins (which is prompted via an OS-level popup instead of a separate app or hardware dongle). So your computer itself can be the second factor which means you don't ever notice the 2FA enforcement, unlike most other systems that use a TOTP code or dongle.

lotsofpulp 7y ago

Keychain on macOS and iOS and keepassXC.

driverdan 7y ago

Try BitWarden. It's what LP used to be before the bloat and is open source.