18 ms·

LastPass stores passwords so securely, not even its users can access them

257 points by jbredeche 7y ago

NopeNotToday 7y ago
Some alternatives: * https://keepass.info/ * https://bitwarden.com/ * https://1password.com/
- bilal4hmed 7y ago
  +1 for Bitwarden
- scandox 7y ago
  Yeah they'll never go down. Why don't these systems support local storage as well? Is there greater security risk in syncing to a local device? Edit: I do not mean browser localStorage
  - awinder 7y ago
    1Password does support local storage, cloud is used for syncing to local storage so obviously in case of an outage you wouldn’t be able to sync updates. But you would be able to access and modify locally and then it would push when things came back online.
    - yreg 7y ago
      It also lets you sync via alternative services like Dropbox/Mega.
  - Mountain_Skies 7y ago
    Bitwarden is open source for both its clients and its server. I haven't tried it but it appears you can set it up for yourself at home and not use their cloud.
  - tortasaur 7y ago
    Keepass does support storing the database file locally. It is the default way it works.
    - ed312 7y ago
      A local-only storage solution with your own syncing is by far the best way. Also, storing low security passwords (eg Netflix) in chrome / iOS keychain seems like a pretty safe trade off to me.
      - prophesi 7y ago
        I'm still having issues convincing friends/family that the initial friction of a password manager and replacing all of your reused passwords is worth it at all. Security is a battle of convenience, and we still haven't struck gold for the layman to have decent enough security hygiene.
  - trey-jones 7y ago
    My understanding of LastPass (I am a user) is that you _do_ in fact have offline access to your vault. Your Master Password is also the encryption key. Did I miss something?
  - matsz 7y ago
    Bitwarden can be hosted locally.
  - CtrlAltT5wpm 7y ago
    I was a paid user of LastPass for about a decade. I don't mind a subscription-based model, especially if there's cloud-syncing involved (I've evaluated the amount of risk I'm comfortable with, and cloud syncing is fine for my use case). Part of the benefit for a paid account is the ability to access your passwords when there's a network outage. However, in the year before I left LP, they went down three times, at most for about 4 hours. Each time, I could not access my local vault, not through the browser extension, not through the Android app, and certainly not through the website; no matter what I did, it was nothing but errors, and their support was useless. It just would not work. That was enough to spook me and get me off their service. I was complacent, thinking that no matter what, I could always see my vault, regardless of network status, until it actually hit the fan. I'm currently with 1Password, which is quite slick (their change on 2FA is what actually got me to give them a try), but I've killed network access to my devices and was able to access my vaults. Just in case, though, I have KeePassXC as well. You never know.
- kalleboo 7y ago
  I evaluated a bunch of team password managers last year. Lastpass was really buggy and had a confusing UI. Dashlane also had odd limitations. 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. I ended up recommending Bitwarden. Surprisingly the open source option had a great UI and great clients, with the bonus of being open source on both ends.
  - charles_f 7y ago
    > 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. Unsurprising, and at the same time it makes 1password's security scheme much more bullet proof. You need that piece of information to identify the client, and even 1password doesn't have it, which means that when inevitably one of these cloud services gets attacked with success, it will less likely be them. Plus they can't see your stuff, that's a plus. Security is not free.
  - MonadIsPronad 7y ago
    I think I may have read your review (did you make an article online?) and I'm now happily using Bitwarden. I just signed up for premium, not because I want the features, but because I want to support what they're doing.
  - docdeek 7y ago
    It’s surprising to me that the “master key” system on 1Password proved difficult for your users. For me, this is one of the simplest things about it: you remember one password that unlocks everything else. Am I talking about the same thing as you when I call this password the “master key”? I feel like I must be as this is flat-out the thing that makes 1Password easy to use.
    - oarsinsync 7y ago
      There are four bits of information you need with 1Password teams 1. The team address <team>.1password.com 2. Your login name (email usually) 3. Your 'secret key' 4. Your 'master password' I suspect GP is talking about item #3 being the point of confusion.
- quindecagon 7y ago
  I'd recomend the more modern looking and cross-platform by design, KeePassXC, over the original KeePass. https://keepassxc.org/ https://keepassxc.org/
- peterwwillis 7y ago
  Keepass is very difficult to use in an automated way and the open-source clients are buggy. I had to search for hours for an ancient Perl script which amazingly works with both 1.x and 2.x Keepass databases (still the only library I've found that does so), then write a custom app to convert the output into something else.
  - Evidlo 7y ago
    I help maintain a library called pykeepass which you might be interested in.
navidfarhadi 7y ago
If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.
- croon 7y ago
  I'm 3 years into Bitwarden and have never looked back. I backed the kickstarter that failed some while back, but it seems he/they ended up managing without it. I should probably subscribe even if I don't need the extra features.
- exhilaration 7y ago
  If you have a Raspberry Pi lying around, there's a docker image for the excellent bitwarden_rs server available that makes it a snap to get up and running: https://github.com/dani-garcia/bitwarden_rs/wiki/Which-container-image-to-use https://github.com/dani-garcia/bitwarden_rs/wiki/Which-conta...
  - mprev 7y ago
    Forgive my ignorance, and possibly laziness, but if the Pi SD card dies do your passwords go with it?
    - picantePepper 7y ago
      Yes but for something like this backups (NAS, google drive, even a usb) are a must
    - kingosticks 7y ago
      If you care about Pi reliability then don't have the root partition on an sd card.
  - fullstop 7y ago
    The cost of electricity and my time is probably more than $10 a year.
rb808 7y ago
Yeah I will never trust a third party password system. Writing down on paper works great. For most unimportant accounts use oauth or make up a random password and forget it - if you need it again reset the password.
- Whatarethese 7y ago
  I'm sorry but that is just ridiculous and time prohibitive.
  - perl4ever 7y ago
    You can use a manager that stores an encrypted database locally and prints it out for backup. Is this generally considered to be not viable?
filipn 7y ago
So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/
- jwineinger 7y ago
  Same. I switched after their thanksgiving 2018 outage and haven't looked back. Just about everything about 1Password is better than LastPass.
- agotterer 7y ago
  Same. I switched to 1Password a few years back after one of the lastpass security issues. I’ve been incredibly happy with the service and quality of software.
- willyyr 7y ago
  I tried that once but ran into so many errors for passwords that contained characters like ", or ;" that I gave up. Is there a way around this other then copying every entry manually?
  - selectodude 7y ago
    You can edit the password recipe for websites that suck and don't allow certain characters.
  - ReidZB 7y ago
    I did the same switch like 5 years ago, and I remember having to `sed` (i.e. global find + replace) the LastPass output .csv to fix special characters before importing it into 1Password. Sadly I don't remember any more detail than that, but yes, there may be some manual massaging required. YMMV.
  - frayesto 7y ago
    Yes, the lastpass exporter has an issue. You can do a search and replace. Or you can do what I did and when I reach a site that had an issue, I would just look at the password and there would be an obvious parsing error, e.g "&" is instead "amp&" and would just modify it manually. Only happened a few times and then all is good. https://github.com/bitwarden/help/blob/master/_articles/importing/import-from-lastpass.md https://github.com/bitwarden/help/blob/master/_articles/impo...
franga2000 7y ago
Wait, are they saying that the clients don't store a local copy? Or that the local copy is inaccessible without the servers working?? That seems incredibly irresponsible and I can't imagine a single reason for doing that. Or is there something else going on that corrupted the users' local copies? If the system is properly secure (i.e. data is encrypted and verifiable with the user's password-derived key) this shouldn't be possible, right?
- justincredible 7y ago
  Just from the comments it seems like a local copy is opt-in and also in the past the local copy was inaccessible when the servers weren't working.
tcd 7y ago
Keepass - choose your own way of syncing, can never go down, works without the internet etc etc. Cloud services...lol
sigwinch28 7y ago
I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/
- gregod 7y ago
  For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with. When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.
  - tdons 7y ago
    This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately) I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch). Did you find a better solution?
    - gregod 7y ago
      No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance. Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.
- jaifraic 7y ago
  With the dmenu wrapper (passmenu) or something similar for rofi there is almost no need for a browser extension.
  - 7y ago
overcast 7y ago
LastPass' UI is so clunky, confusing and under performant that storing passwords securely is the least path of resistance for end users. I dread using it daily at the office.
RealStickman 7y ago
Why one shouldn't use cloud-based services. I'm sticking to keepass. (I'm syncing the keepass file over a cloud, but I still have a local copy on all my devices against cases like these)
- daveoc64 7y ago
  I'm sorry, what is your justification for not using cloud-based services? Lastpass (like pretty much all of these online password managers) will work offline, so if the service goes down, you can still access your data locally.
  - harryf 7y ago
    Not the OP and personally less radically against cloud-based services... But storing something as critical as passwords with a SAAS company which is obviously going to be target of attack and may or may not have the engineering resources to provide a reliable quality of service... seems like a bad idea. Google(Drive) at least I trust to have the engineering resources to keep data secure, perhaps not from government secret services but at least random hackers
    - chousuke 7y ago
      They don't really store your passwords, just an encrypted blob that's openable with your master password (more accurately, a key that is derived from it using an expensive operation so that brute-forcing is unfeasible.) You do need to trust them enough that they will never sniff your master password (AFAIK even the web vault is local only) but eg. the command-line client is open source, so you can at least verify their protocol. That said, I might switch to bitwarden at some point purely because it can be self-hosted.
      - jupp0r 7y ago
        It depends on what plan you are on. Afaik, the enterprise plans have key escrow and an option to recover your account if you forgot your password.
LeifCarrotson 7y ago
The article went up an hour and a half ago, at the exact same time as https://status.lastpass.com/ https://status.lastpass.com/ updated to say they were investigating. In under an hour, they acknowledged, identified, fixed, and verified the issue. The fix went out less than half an hour after they learned about it, and this HN submission was posted 1 hour ago, so no one learning of the issue by means of this HN submission will have been able to reproduce the problem. Also, if you've enabled offline access to your vault (which used to be the default IIRC, and would be smart regardless of your password manager of choic) this won't affect you.
- djannzjkzxn 7y ago
  Life is so good that we are re-using brain structures evolved to avoid being eaten by lions to complain about buggy software.
  - Iolaum 7y ago
    Nowdays its more probable that one dies because of buggy software (Boeing MCAS) than get eaten by lions.
    - djannzjkzxn 7y ago
      If you find out about a bug in MCAS, you definitely should complain about it.
- deleted 7y ago
  [deleted]
- nullspace 7y ago
  That’s bullshit. In reality (I was affected by this and it’s now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it. I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now. This was not a quick response time, don’t give them credit for this one.
darkwater 7y ago
On a side, am I the only person that doesn't like The Register write style, especially the headings? Yeah, irony and fun all that you want, but it ends up looking like a gossip/tabloid magazine
- mprev 7y ago
  Not at all the only person.
- robocat 7y ago
  It is very “British” with wit, puns, long running silly gags, in-jokes, smart headlines, sarcasm, and self-deprecating jokes. However, The Register is usually technically correct and regularly breaks important news (good journalism). Minor technical (or grammatical) errors will be lambasted in comments. Essentially, the style meshes well with it’s target readership, and they are very happy that anyone that doesn’t like the style auto-excludes themselves from the readership/community.
  - dehrmann 7y ago
    "Biting the hand that feeds IT"
  - darkwater 7y ago
    Didn't mean to question the story quality, but even given the British humour, I still don't like The Register style.
- Havoc 7y ago
  >The Register write style, especially the headings Basically all mainstream journalism coming out of the UK is garbage (FT & economist excluded I guess). Even the BBC has been showing some partisan leanings lately
  - toyg 7y ago
    With that sort of bar, pretty much all journalism would be classed as “garbage”, UK or not. Which might well be true, I’m just saying it’s hardly a British phenomenon.
kefabean 7y ago
I like Enpass (enpass.io): - non-subscription version available - multi-platform (IOS, Android, MacOS, Linux, Windows) - offline access (local DB) - sync via non-Enpass servers (eg use dropbox, google drive, iCloud, box etc) - actively maintained I have been using for ~3 years on a revolving door of devices and have never experienced any issues - just works. (Not affiliated in any way with Enpass)
- casefields 7y ago
  Mobile free version limited to 25 items. That's not really free for 99% of people.
magd 7y ago
LP has a history of problems, but my company forces us to use that crappy product. I've complained about it for years. I use keepassx for personal, 1password for work, and lastpass for anything that I need to share with coworkers. I always wondered who got the kickback from LP.
- ryanmercer 7y ago
  >LP has a history of problems, but my company forces us to use that crappy product. I've been using them the better part of a decade, I've never had an issue and find calling it a 'crappy product' to be shocking. What sort of issues have you had?
  - iamaelephant 7y ago
    LastPass is riddled with problems, and the quality has dropped precipitously since their acquisition by LogMeIn. For a sampling of their problems I suggest searching this site for their name. https://hn.algolia.com/?q=lastpass https://hn.algolia.com/?q=lastpass
    - op00to 7y ago
      I’ve used them for a long time. I noticed zero change in the service.
      - iamaelephant 7y ago
        Ok man if it works for you then keep on keeping on. I have chosen to leave the service due to a huge drop in reliability and several major security and service incidents.
  - soraminazuki 7y ago
    Before I switched to another password manager, LP has: - constantly managed to lose newly generated passwords - consistently failed to register new passwords with the Safari extension - failed to autofill credentials on many websites I had used LP for years, but these problems never went away despite these being a failure of core functionality. After I finally switched to an alternative password manager, I was pleasantly surprised at how well everything seemed to work in addition to a much nicer UI. In LP's defense, it's great that they offer such an important service for free, but I'd really prefer my password manager to be of more higher quality.
JohnTHaller 7y ago
KeePass/KeePassXC on each device. Complex keyfile manually copied to each device (never in the cloud). Password database protected by the keyfile and a memorable complex password stored in your cloud folder of choice synced to your devices. You now have a free, open source, secure, cloud synced password service. For additional security, you can manually copy the database between devices as well. Or keep a separate manually copied database with your most secure logins.
- geekamongus 7y ago
  OK but can you tell my 80 year-old mom how to do this?
  - JohnTHaller 7y ago
    You can set it up for a non-techie and then just let it do its thing. I've set this up for a few people who don't have a clue what a key file is.
notlukesky 7y ago
SAASPASS personal password manager and Authenticator works offline (with cloud syncing options). You can also use it for teams or companies (online and offline options set by admin) and it is by default protected by 2FA. www.saaspass.com (I work for an IAM SI/consultancy and we use and implement SAASPASS for IAM needs including enterprise password management, 2FA, directory services and SAML-based single sign-on).
criley2 7y ago
I'm shocked to see a post of such low quality on hacker news. It reads like an instagram post or twitter replies. I'm not familiar with "theregister.co.uk" but I honestly think it's the lowest quality article I've ever seen on this website
- iamaelephant 7y ago
  > I'm not familiar with "theregister.co.uk" Then you're not qualified to be discussing software or the tech industry, frankly.
  - yarrel 7y ago
    Or we're in an era where that sneering prototype for clickbait blogs is being rightly consigned to the dustbin of history. When faced with a link to an article on The Register, searching for the source it's been copied from is a good first step.
    - perl4ever 7y ago
      I never go out of my way to look for their articles, but their shtick is mildly amusing and they seem like an institution. As long as they are at least a bit different from the rest of the tech press, something would be lost if they went away.
  - deleted 7y ago
    [deleted]
  - criley2 7y ago
    You seem toxic with this completely unnecessary gatekeeping attempt. I bet working with you is a joy. Let me put it to you this way, if your concept of competency in this industry is driven by knowledge of tabloids and not actually skill and talent in engineering, then I'm willing to bet you lack the latter two and rely on the former to fake it.
doque 7y ago
So in response to this story I decided to delete my (premium) account with them. After confirming multiple times (good thing), I was shown this error: https://i.imgur.com/4dpn6d5.png https://i.imgur.com/4dpn6d5.png How does error handling like this even make it to production? I got an email as well confirming my account deletion and I can no longer log in. But all in all this clearly does increase my trust in Lastpass's security competence.
- wiether 7y ago
  Reading this post reminded me of my LP account so I went to delete it and had the exact same experience than you...
- MoronInAHurry 7y ago
  I got the same error while deleting my account over a month ago when it was announced that their parent company LogMeIn had been bought by private equity: https://www.zdnet.com/article/logmein-sells-to-private-equity-firms-for-4-3-billion/ https://www.zdnet.com/article/logmein-sells-to-private-equit... So the deletion process has been erroring in that way for at least a month now.
- deadbunny 7y ago
  I got that same error when killing off my account after moving to Bitwarden. It really made me laugh as it encapsulated everything wrong with the service in a succinct error message.
- Maximus9000 7y ago
  Yup, I switched after the company was sold recently. I got that error as well. I moved to 1password
- MivLives 7y ago
  I actually have a bone to pick with them too. I tried canceling my families accounts recently. Despite two confirmation emails I was still charged. Their site makes it very hard to find support.
anderspitman 7y ago
IMO[0] everyone should have at most one password - to their email account. Everything else should be something along the lines of (in order of preference): 1) SSO (federated! Not the Google/Twitter/Facebook/GitHub oligopoly nonsense we have now), using email addresses as ids. 2) Emailed login links, a la Slack's magic links. Email addresses aren't perfect, but they're the globally unique, federated IDs we have, and good enough. Plus they have the advantage of years of figuring out how to handle of realities of federation. [0] I am biased. I recently launched a service in this space: https://emauth.io https://emauth.io
- sib 7y ago
  I hope that emailed login links cease to exist. I work at a large company. As a combination of lots of security scanning and, I think, intentional slowdown for virus spread mitigation, external email can take minutes to be delivered. More than 50% of the time I receive such a link (including from Slack, for example), it has timed out before it gets to me. Just let me use a good, long, randomly-according-to-a-recipe-generated (and, if needed, 2FA) for services and I'm happy.
  - anderspitman 7y ago
    Seems pretty specific to large organizations though? That's a completely different thread model than someone wanting to log in to their social network to share cat memes. You're completely right that it needs to be handling differently and appropriately. But for everyday use, I've never had an issue with delivery on commodity email providers.
- LeoTolstoyJr 7y ago
  Email is an incredibly vulnerable single point of failure. Plus the existing password infrastructure of the web isn't going away. Password managers are the best and most realistic option for most people.
  - perl4ever 7y ago
    Yes, but it's an incredibly vulnerable single point of failure now, not just as a hypothetical. I found out that when I added a backup email to my gmail that it had the opposite effect that was desired - losing access to the backup email meant I couldn't recover the account even though I still had access to the primary. I still can't get over the perverse, Kafka-esque feeling, years later. Partly because I am still logged in, yet I have no way of restoring my "ownership" and using it again.
Fritsdehacker 7y ago
A lot of people here are saying this is why you shouldn't trust cloud services for password management. And I agree. I use Keepass myself, however, that is not a viable solution for most of my family and friends. They need something dead simple, which is what cloud services like LastPass, Bitwarden etc. offer. I think the LastPass user interface is horrible, though...
jagged-chisel 7y ago
I feel like there have been enough incidents with LastPass that no one should be using them. Am I biased due to reporting, or is it the case that they can't be trusted?
- ryanmercer 7y ago
  I've been using them the better part of a decade, I've never had a single issue and am quite surprised to see so many people complaining about them/mentioning issues in this thread.
zipwitch 7y ago
Not even a mention of Password Safe? https://en.wikipedia.org/wiki/Password_Safe https://en.wikipedia.org/wiki/Password_Safe It's what I've been using for Windows-running non-savvy relatives for decades.
BuildTheRobots 7y ago
Not actually related to the article, but the headline makes me think of the "Muddy Puddle Test" for crypto, which goes like this: 1) Drop your device(s) into a muddy puddle (destroying them). 2) Slip in said puddle so you hit your head. On waking up you're absolutely fine, but are entirely incapable of remembering your passwords or encryption keys. 3) Can you get your cloud data back? If you can, then it's not actually secure.
- whatshisface 7y ago
  What about biometrics?
  - playeren 7y ago
    Don't use biometrics for anything but convenience type features. You can't change your fingerprint if bad actors gets a hold of it.
  - BuildTheRobots 7y ago
    Biometrics are good for usernames but not passwords. It's much harder for someone to get something out of your head than cutting off your thumb. - and as playeren says, it's impossible to change it. http://news.bbc.co.uk/1/hi/world/asia-pacific/4396831.stm http://news.bbc.co.uk/1/hi/world/asia-pacific/4396831.stm
- arminiusreturns 7y ago
  This is what paper keys stored in a secure location are for.
arghblarg 7y ago
An alternative to avoid electronic systems entirely: https://www.tindie.com/stores/russtopia/ https://www.tindie.com/stores/russtopia/
hannofcart 7y ago
Does anyone here use LessPass? I've been using it for a while now and am very happy. No storage needed. One master password to generate reproducible passwords based on the site's domain.
sys_64738 7y ago
Let's put our passwords on a remote server which convinces us they're secure. How did we even get here that such information leaves our control?
- fullstop 7y ago
  Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how. It's not the best option, of course, but certainly better than weak and reused passwords, right?
  - sys_64738 7y ago
    Is convenience more important than security? That's what you're saying here.
    - fullstop 7y ago
      No. I'm saying that the vast majority of people are not capable of doing this, and that it's a better option than weak passwords.
    - rodgerd 7y ago
      Convenience is security.
    - stordoff 7y ago
      Before using a password manager: I'm using short, memorable (often repeated) passwords that are rarely, if ever, changed. After using a password manager: I'm using long (generally 64 characters), unique passwords, and if one is compromised, it's a 30s job to change it on all of my devices. Convenience _enables_ security. I could probably roll my syncing solution, but I would _not_ be convinced it is secure (I don't have that level of expertise), and I would probably end up using a third party anyway (Dropbox/Digital Ocean). I'm not going to sync it manually to the 6 or so devices I regularly use, plus others I use less frequently (it may be more secure, but it's not practical). Because it's low friction, I end up using it more, so it's a _net_ gain in security, even if it isn't perfect.
anderspitman 7y ago
keepassxc (just a simple encrypted password file) + syncthing (copies that file to all your devices) has been working pretty well for me on Linux/Android. I believe there's still no syncthing client for iOS unfortunately. [0] https://keepassxc.org/ https://keepassxc.org/ [1] https://syncthing.net/ https://syncthing.net/
spookyuser 7y ago
I never see the app I am currently using for my password manager on HN password manager threads so I will recommend it now. I have been using Safeincloud https://www.safe-in-cloud.com/en/ https://www.safe-in-cloud.com/en/ for I feel like forever. The dev is quick to add new features, like autofill on android, and windows hello on windows. It's a one time payment on android and IOS, Desktop apps are free. I know that 1password is prob better and more secure, but I can't afford the monthly rate.
iamaelephant 7y ago
One of the best things I've done in my personal software life recently is getting off LastPass. The only other piece of software I have seen decay in quality so rapidly and markedly is PocketCasts.
- ryanmercer 7y ago
  Ugh, they ruined PocketCasts when they bought it and did that major 'update'. Fortunately I found Podcast Republic the day mine updated and haven't looked back.
uptown 7y ago
What’s the best (translation: easiest) password manager for non-technical users with Windows and iOS devices? I’m trying to find a good solution to help protect the accounts of my older parents. I use a legacy non-subscription 1Password version for myself so I’m not up to date about the subscription model or product changes of recent versions.
- casefields 7y ago
  I moved myself and the whole family to the often-mentioned Bitwarden 3 years ago. It's been fantastic.
ghastmaster 7y ago
Given the possibility of software failure, would it be wise to use multiple password managers? I have the feeling this is a .45 vs 9mm question that doesn't have a real answer. More software exposes risk of data being exposed vs redundancy. I do not use software managers. I use a password protected spreadsheet(100 passwords). I hope they are safely encrypted.
- zndr 7y ago
  A seccond PW manager? Not necessary, an offline backup? Great idea. Most PW managers allow you to export in some way shape or form. Doing so and encrypting said file is a great idea, but also something that's hard to do enough for most people that I don't have a good solution.
  - ghastmaster 7y ago
    Excellent points.
generalpass 7y ago
I have been using and paying LastPass since it launched with no serious issues and a few minor ones. The Register article makes gives no indication as to the number of users having trouble with the current issue. My single issue with LastPass is that they don't offer an APK download options separate from the Google Play store, so my slow and steady migration will require, at some point, migrating to a different password manager. I made a trouble ticket regarding this issue and they informed me they have no plans to offer a separately downloadable APK.
fortran77 7y ago
I was just thinking, it may be a good idea for me to print out my vital passwords and put them in my safe....
draw_down 7y ago
I’ll never forget when I was issued a new computer at a new job with LastPass installed. It kept popping up a modal dialog (modal to the entire browser) with some inscrutable network error message. I never even bothered trying to use it after that.
fortran77 7y ago
Based on this news, I just looked around and discovered that LastPass has a way to export a CSV file of all the passwords in plaintext. I just did that and have a PGP'd archive of my passwords stored locally. Not a bad thing to do with any password manager.
- cuillevel3 7y ago
  I think I did this once with one password service and was surprised that they don't even send a warning email to inform me, that that just happened... very scary.
beanaroo 7y ago
Another open-source, open-pgp based password manager worth mentioning is https://www.passbolt.com/ https://www.passbolt.com/
dentemple 7y ago
The reactionary nature of the typical HN poster is on full display here. Lastpass had a bug that affected a small percentage of users. They identified and fixed the bug within several days. What more do you want? Is there really a competing product out there that guarantees NO BUGS? So, then, why the extreme nod to #CancelCulture for what appeared to be just a temporary issue?
- geekamongus 7y ago
  Probably because of the way the handled it (or didn't for a few days, as was the case here). Just guessing.
- riffic 7y ago
  They've been circling the toilet for a while now. Quality matters.
rafaelvasco 7y ago
Been using LastPass for years. Couldn't imagine living without it, with the gazzilon of passwords we have to handle. There's other services of course, but I've never felt compelled to leave. But I'd much prefer to not have to deal with any passwords at all in any service;
Kiro 7y ago
Am I the only one using Google's own password manager? Ideology aside I can't think of someone with more engineering resources to prevent hickups and breaches. Are there any benefits of other pw managers I'm missing out on?
instaheat 7y ago
I switched to Bitwarden after certain grievances with LastPass which I don't even recall what they were now.
- dole 7y ago
  Security breaches?
- eteb 7y ago
  The final straw for me was LastPass being very late on going WebExtension for Firefox. Not having a working password manager was not an option and the move to Bitwarden was very smooth.
tomaszs 7y ago
What is unclear is if it was an application bug or server bug. In the first case it is not so bad. Since you can downgrade. In the second case it may be disturbing that LastPass requires server connection at all...
elliotec 7y ago
Longing for the day that passwords become obsolete.
riffic 7y ago
I've migrated to Bitwarden. LastPass has been lacking in quality for a while and this outage was the last straw.
aussieguy1234 7y ago
I'd rather be locked out for a while, than to have my passwords stored unencrypted. I've been using LastPass as a paid user for about 5 years.
stevefan1999 7y ago
My recommended alternative to LastPass: Bitwarden at https://github.com/bitwarden/server https://github.com/bitwarden/server The ability to host it yourself is a big kudo to me, then we are no longer constrained by LastPass like this case here.
joemccall86 7y ago
This will probably get buried, but this story had me shudder at the possibility of being locked out of my 1password vault in a similar scenario. In case anyone is in the same boat: * My airplane-mode test passed both on my mobile device and browser (1password X). * The team is aware of the situation with LP and wrote a very thoughtful response: https://discussions.agilebits.com/discussion/comment/544136/#Comment_544136 https://discussions.agilebits.com/discussion/comment/544136/... * From the response above, 1password is SOC2 certified, so availability is taken very seriously.
jcam1960 7y ago
As an alternative, lately, I've been using Passfindr. It's web-based but they have an offline solution so that as long as you have made a backup. This kind of crap won't shut you down. It will read out of the backup file through the browser. And I use it for a lot more than passwords. I pretty much use it for any kind of access. Works good.

257 points by jbredeche 7y ago

NopeNotToday 7y ago

Some alternatives: * https://keepass.info/ * https://bitwarden.com/ * https://1password.com/

bilal4hmed 7y ago
+1 for Bitwarden
scandox 7y ago
Yeah they'll never go down. Why don't these systems support local storage as well? Is there greater security risk in syncing to a local device? Edit: I do not mean browser localStorage
- awinder 7y ago
  1Password does support local storage, cloud is used for syncing to local storage so obviously in case of an outage you wouldn’t be able to sync updates. But you would be able to access and modify locally and then it would push when things came back online.
  - yreg 7y ago
    It also lets you sync via alternative services like Dropbox/Mega.
- Mountain_Skies 7y ago
  Bitwarden is open source for both its clients and its server. I haven't tried it but it appears you can set it up for yourself at home and not use their cloud.
- tortasaur 7y ago
  Keepass does support storing the database file locally. It is the default way it works.
  - ed312 7y ago
    A local-only storage solution with your own syncing is by far the best way. Also, storing low security passwords (eg Netflix) in chrome / iOS keychain seems like a pretty safe trade off to me.
    - prophesi 7y ago
      I'm still having issues convincing friends/family that the initial friction of a password manager and replacing all of your reused passwords is worth it at all. Security is a battle of convenience, and we still haven't struck gold for the layman to have decent enough security hygiene.
- trey-jones 7y ago
  My understanding of LastPass (I am a user) is that you _do_ in fact have offline access to your vault. Your Master Password is also the encryption key. Did I miss something?
- matsz 7y ago
  Bitwarden can be hosted locally.
- CtrlAltT5wpm 7y ago
  I was a paid user of LastPass for about a decade. I don't mind a subscription-based model, especially if there's cloud-syncing involved (I've evaluated the amount of risk I'm comfortable with, and cloud syncing is fine for my use case). Part of the benefit for a paid account is the ability to access your passwords when there's a network outage. However, in the year before I left LP, they went down three times, at most for about 4 hours. Each time, I could not access my local vault, not through the browser extension, not through the Android app, and certainly not through the website; no matter what I did, it was nothing but errors, and their support was useless. It just would not work. That was enough to spook me and get me off their service. I was complacent, thinking that no matter what, I could always see my vault, regardless of network status, until it actually hit the fan. I'm currently with 1Password, which is quite slick (their change on 2FA is what actually got me to give them a try), but I've killed network access to my devices and was able to access my vaults. Just in case, though, I have KeePassXC as well. You never know.
kalleboo 7y ago
I evaluated a bunch of team password managers last year. Lastpass was really buggy and had a confusing UI. Dashlane also had odd limitations. 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. I ended up recommending Bitwarden. Surprisingly the open source option had a great UI and great clients, with the bonus of being open source on both ends.
- charles_f 7y ago
  > 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. Unsurprising, and at the same time it makes 1password's security scheme much more bullet proof. You need that piece of information to identify the client, and even 1password doesn't have it, which means that when inevitably one of these cloud services gets attacked with success, it will less likely be them. Plus they can't see your stuff, that's a plus. Security is not free.
- MonadIsPronad 7y ago
  I think I may have read your review (did you make an article online?) and I'm now happily using Bitwarden. I just signed up for premium, not because I want the features, but because I want to support what they're doing.
- docdeek 7y ago
  It’s surprising to me that the “master key” system on 1Password proved difficult for your users. For me, this is one of the simplest things about it: you remember one password that unlocks everything else. Am I talking about the same thing as you when I call this password the “master key”? I feel like I must be as this is flat-out the thing that makes 1Password easy to use.
  - oarsinsync 7y ago
    There are four bits of information you need with 1Password teams 1. The team address <team>.1password.com 2. Your login name (email usually) 3. Your 'secret key' 4. Your 'master password' I suspect GP is talking about item #3 being the point of confusion.
quindecagon 7y ago
I'd recomend the more modern looking and cross-platform by design, KeePassXC, over the original KeePass. https://keepassxc.org/ https://keepassxc.org/
peterwwillis 7y ago
Keepass is very difficult to use in an automated way and the open-source clients are buggy. I had to search for hours for an ancient Perl script which amazingly works with both 1.x and 2.x Keepass databases (still the only library I've found that does so), then write a custom app to convert the output into something else.
- Evidlo 7y ago
  I help maintain a library called pykeepass which you might be interested in.

navidfarhadi 7y ago

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

croon 7y ago
I'm 3 years into Bitwarden and have never looked back. I backed the kickstarter that failed some while back, but it seems he/they ended up managing without it. I should probably subscribe even if I don't need the extra features.
exhilaration 7y ago
If you have a Raspberry Pi lying around, there's a docker image for the excellent bitwarden_rs server available that makes it a snap to get up and running: https://github.com/dani-garcia/bitwarden_rs/wiki/Which-container-image-to-use https://github.com/dani-garcia/bitwarden_rs/wiki/Which-conta...
- mprev 7y ago
  Forgive my ignorance, and possibly laziness, but if the Pi SD card dies do your passwords go with it?
  - picantePepper 7y ago
    Yes but for something like this backups (NAS, google drive, even a usb) are a must
  - kingosticks 7y ago
    If you care about Pi reliability then don't have the root partition on an sd card.
- fullstop 7y ago
  The cost of electricity and my time is probably more than $10 a year.

rb808 7y ago

Yeah I will never trust a third party password system. Writing down on paper works great. For most unimportant accounts use oauth or make up a random password and forget it - if you need it again reset the password.

Whatarethese 7y ago
I'm sorry but that is just ridiculous and time prohibitive.
- perl4ever 7y ago
  You can use a manager that stores an encrypted database locally and prints it out for backup. Is this generally considered to be not viable?

filipn 7y ago

So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/

jwineinger 7y ago
Same. I switched after their thanksgiving 2018 outage and haven't looked back. Just about everything about 1Password is better than LastPass.
agotterer 7y ago
Same. I switched to 1Password a few years back after one of the lastpass security issues. I’ve been incredibly happy with the service and quality of software.
willyyr 7y ago
I tried that once but ran into so many errors for passwords that contained characters like ", or ;" that I gave up. Is there a way around this other then copying every entry manually?
- selectodude 7y ago
  You can edit the password recipe for websites that suck and don't allow certain characters.
- ReidZB 7y ago
  I did the same switch like 5 years ago, and I remember having to `sed` (i.e. global find + replace) the LastPass output .csv to fix special characters before importing it into 1Password. Sadly I don't remember any more detail than that, but yes, there may be some manual massaging required. YMMV.
- frayesto 7y ago
  Yes, the lastpass exporter has an issue. You can do a search and replace. Or you can do what I did and when I reach a site that had an issue, I would just look at the password and there would be an obvious parsing error, e.g "&" is instead "amp&" and would just modify it manually. Only happened a few times and then all is good. https://github.com/bitwarden/help/blob/master/_articles/importing/import-from-lastpass.md https://github.com/bitwarden/help/blob/master/_articles/impo...

franga2000 7y ago

Wait, are they saying that the clients don't store a local copy? Or that the local copy is inaccessible without the servers working?? That seems incredibly irresponsible and I can't imagine a single reason for doing that. Or is there something else going on that corrupted the users' local copies? If the system is properly secure (i.e. data is encrypted and verifiable with the user's password-derived key) this shouldn't be possible, right?

justincredible 7y ago
Just from the comments it seems like a local copy is opt-in and also in the past the local copy was inaccessible when the servers weren't working.

tcd 7y ago

Keepass - choose your own way of syncing, can never go down, works without the internet etc etc. Cloud services...lol

sigwinch28 7y ago

I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/

gregod 7y ago
For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with. When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.
- tdons 7y ago
  This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately) I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch). Did you find a better solution?
  - gregod 7y ago
    No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance. Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.
jaifraic 7y ago
With the dmenu wrapper (passmenu) or something similar for rofi there is almost no need for a browser extension.
- 7y ago

overcast 7y ago

LastPass' UI is so clunky, confusing and under performant that storing passwords securely is the least path of resistance for end users. I dread using it daily at the office.

RealStickman 7y ago

Why one shouldn't use cloud-based services. I'm sticking to keepass. (I'm syncing the keepass file over a cloud, but I still have a local copy on all my devices against cases like these)

daveoc64 7y ago
I'm sorry, what is your justification for not using cloud-based services? Lastpass (like pretty much all of these online password managers) will work offline, so if the service goes down, you can still access your data locally.
- harryf 7y ago
  Not the OP and personally less radically against cloud-based services... But storing something as critical as passwords with a SAAS company which is obviously going to be target of attack and may or may not have the engineering resources to provide a reliable quality of service... seems like a bad idea. Google(Drive) at least I trust to have the engineering resources to keep data secure, perhaps not from government secret services but at least random hackers
  - chousuke 7y ago
    They don't really store your passwords, just an encrypted blob that's openable with your master password (more accurately, a key that is derived from it using an expensive operation so that brute-forcing is unfeasible.) You do need to trust them enough that they will never sniff your master password (AFAIK even the web vault is local only) but eg. the command-line client is open source, so you can at least verify their protocol. That said, I might switch to bitwarden at some point purely because it can be self-hosted.
    - jupp0r 7y ago
      It depends on what plan you are on. Afaik, the enterprise plans have key escrow and an option to recover your account if you forgot your password.

LeifCarrotson 7y ago

The article went up an hour and a half ago, at the exact same time as https://status.lastpass.com/ https://status.lastpass.com/ updated to say they were investigating. In under an hour, they acknowledged, identified, fixed, and verified the issue. The fix went out less than half an hour after they learned about it, and this HN submission was posted 1 hour ago, so no one learning of the issue by means of this HN submission will have been able to reproduce the problem. Also, if you've enabled offline access to your vault (which used to be the default IIRC, and would be smart regardless of your password manager of choic) this won't affect you.

djannzjkzxn 7y ago
Life is so good that we are re-using brain structures evolved to avoid being eaten by lions to complain about buggy software.
- Iolaum 7y ago
  Nowdays its more probable that one dies because of buggy software (Boeing MCAS) than get eaten by lions.
  - djannzjkzxn 7y ago
    If you find out about a bug in MCAS, you definitely should complain about it.
deleted 7y ago
[deleted]
nullspace 7y ago
That’s bullshit. In reality (I was affected by this and it’s now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it. I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now. This was not a quick response time, don’t give them credit for this one.

darkwater 7y ago

On a side, am I the only person that doesn't like The Register write style, especially the headings? Yeah, irony and fun all that you want, but it ends up looking like a gossip/tabloid magazine

mprev 7y ago
Not at all the only person.
robocat 7y ago
It is very “British” with wit, puns, long running silly gags, in-jokes, smart headlines, sarcasm, and self-deprecating jokes. However, The Register is usually technically correct and regularly breaks important news (good journalism). Minor technical (or grammatical) errors will be lambasted in comments. Essentially, the style meshes well with it’s target readership, and they are very happy that anyone that doesn’t like the style auto-excludes themselves from the readership/community.
- dehrmann 7y ago
  "Biting the hand that feeds IT"
- darkwater 7y ago
  Didn't mean to question the story quality, but even given the British humour, I still don't like The Register style.
Havoc 7y ago
>The Register write style, especially the headings Basically all mainstream journalism coming out of the UK is garbage (FT & economist excluded I guess). Even the BBC has been showing some partisan leanings lately
- toyg 7y ago
  With that sort of bar, pretty much all journalism would be classed as “garbage”, UK or not. Which might well be true, I’m just saying it’s hardly a British phenomenon.

kefabean 7y ago

I like Enpass (enpass.io): - non-subscription version available - multi-platform (IOS, Android, MacOS, Linux, Windows) - offline access (local DB) - sync via non-Enpass servers (eg use dropbox, google drive, iCloud, box etc) - actively maintained I have been using for ~3 years on a revolving door of devices and have never experienced any issues - just works. (Not affiliated in any way with Enpass)

casefields 7y ago
Mobile free version limited to 25 items. That's not really free for 99% of people.

magd 7y ago

LP has a history of problems, but my company forces us to use that crappy product. I've complained about it for years. I use keepassx for personal, 1password for work, and lastpass for anything that I need to share with coworkers. I always wondered who got the kickback from LP.

ryanmercer 7y ago
>LP has a history of problems, but my company forces us to use that crappy product. I've been using them the better part of a decade, I've never had an issue and find calling it a 'crappy product' to be shocking. What sort of issues have you had?
- iamaelephant 7y ago
  LastPass is riddled with problems, and the quality has dropped precipitously since their acquisition by LogMeIn. For a sampling of their problems I suggest searching this site for their name. https://hn.algolia.com/?q=lastpass https://hn.algolia.com/?q=lastpass
  - op00to 7y ago
    I’ve used them for a long time. I noticed zero change in the service.
    - iamaelephant 7y ago
      Ok man if it works for you then keep on keeping on. I have chosen to leave the service due to a huge drop in reliability and several major security and service incidents.
- soraminazuki 7y ago
  Before I switched to another password manager, LP has: - constantly managed to lose newly generated passwords - consistently failed to register new passwords with the Safari extension - failed to autofill credentials on many websites I had used LP for years, but these problems never went away despite these being a failure of core functionality. After I finally switched to an alternative password manager, I was pleasantly surprised at how well everything seemed to work in addition to a much nicer UI. In LP's defense, it's great that they offer such an important service for free, but I'd really prefer my password manager to be of more higher quality.

JohnTHaller 7y ago

KeePass/KeePassXC on each device. Complex keyfile manually copied to each device (never in the cloud). Password database protected by the keyfile and a memorable complex password stored in your cloud folder of choice synced to your devices. You now have a free, open source, secure, cloud synced password service. For additional security, you can manually copy the database between devices as well. Or keep a separate manually copied database with your most secure logins.

geekamongus 7y ago
OK but can you tell my 80 year-old mom how to do this?
- JohnTHaller 7y ago
  You can set it up for a non-techie and then just let it do its thing. I've set this up for a few people who don't have a clue what a key file is.

notlukesky 7y ago

SAASPASS personal password manager and Authenticator works offline (with cloud syncing options). You can also use it for teams or companies (online and offline options set by admin) and it is by default protected by 2FA. www.saaspass.com (I work for an IAM SI/consultancy and we use and implement SAASPASS for IAM needs including enterprise password management, 2FA, directory services and SAML-based single sign-on).

criley2 7y ago

I'm shocked to see a post of such low quality on hacker news. It reads like an instagram post or twitter replies. I'm not familiar with "theregister.co.uk" but I honestly think it's the lowest quality article I've ever seen on this website

iamaelephant 7y ago
> I'm not familiar with "theregister.co.uk" Then you're not qualified to be discussing software or the tech industry, frankly.
- yarrel 7y ago
  Or we're in an era where that sneering prototype for clickbait blogs is being rightly consigned to the dustbin of history. When faced with a link to an article on The Register, searching for the source it's been copied from is a good first step.
  - perl4ever 7y ago
    I never go out of my way to look for their articles, but their shtick is mildly amusing and they seem like an institution. As long as they are at least a bit different from the rest of the tech press, something would be lost if they went away.
- deleted 7y ago
  [deleted]
- criley2 7y ago
  You seem toxic with this completely unnecessary gatekeeping attempt. I bet working with you is a joy. Let me put it to you this way, if your concept of competency in this industry is driven by knowledge of tabloids and not actually skill and talent in engineering, then I'm willing to bet you lack the latter two and rely on the former to fake it.

doque 7y ago

So in response to this story I decided to delete my (premium) account with them. After confirming multiple times (good thing), I was shown this error: https://i.imgur.com/4dpn6d5.png https://i.imgur.com/4dpn6d5.png How does error handling like this even make it to production? I got an email as well confirming my account deletion and I can no longer log in. But all in all this clearly does increase my trust in Lastpass's security competence.

wiether 7y ago
Reading this post reminded me of my LP account so I went to delete it and had the exact same experience than you...
MoronInAHurry 7y ago
I got the same error while deleting my account over a month ago when it was announced that their parent company LogMeIn had been bought by private equity: https://www.zdnet.com/article/logmein-sells-to-private-equity-firms-for-4-3-billion/ https://www.zdnet.com/article/logmein-sells-to-private-equit... So the deletion process has been erroring in that way for at least a month now.
deadbunny 7y ago
I got that same error when killing off my account after moving to Bitwarden. It really made me laugh as it encapsulated everything wrong with the service in a succinct error message.
Maximus9000 7y ago
Yup, I switched after the company was sold recently. I got that error as well. I moved to 1password
MivLives 7y ago
I actually have a bone to pick with them too. I tried canceling my families accounts recently. Despite two confirmation emails I was still charged. Their site makes it very hard to find support.

anderspitman 7y ago

IMO[0] everyone should have at most one password - to their email account. Everything else should be something along the lines of (in order of preference): 1) SSO (federated! Not the Google/Twitter/Facebook/GitHub oligopoly nonsense we have now), using email addresses as ids. 2) Emailed login links, a la Slack's magic links. Email addresses aren't perfect, but they're the globally unique, federated IDs we have, and good enough. Plus they have the advantage of years of figuring out how to handle of realities of federation. [0] I am biased. I recently launched a service in this space: https://emauth.io https://emauth.io

sib 7y ago
I hope that emailed login links cease to exist. I work at a large company. As a combination of lots of security scanning and, I think, intentional slowdown for virus spread mitigation, external email can take minutes to be delivered. More than 50% of the time I receive such a link (including from Slack, for example), it has timed out before it gets to me. Just let me use a good, long, randomly-according-to-a-recipe-generated (and, if needed, 2FA) for services and I'm happy.
- anderspitman 7y ago
  Seems pretty specific to large organizations though? That's a completely different thread model than someone wanting to log in to their social network to share cat memes. You're completely right that it needs to be handling differently and appropriately. But for everyday use, I've never had an issue with delivery on commodity email providers.
LeoTolstoyJr 7y ago
Email is an incredibly vulnerable single point of failure. Plus the existing password infrastructure of the web isn't going away. Password managers are the best and most realistic option for most people.
- perl4ever 7y ago
  Yes, but it's an incredibly vulnerable single point of failure now, not just as a hypothetical. I found out that when I added a backup email to my gmail that it had the opposite effect that was desired - losing access to the backup email meant I couldn't recover the account even though I still had access to the primary. I still can't get over the perverse, Kafka-esque feeling, years later. Partly because I am still logged in, yet I have no way of restoring my "ownership" and using it again.

Fritsdehacker 7y ago

A lot of people here are saying this is why you shouldn't trust cloud services for password management. And I agree. I use Keepass myself, however, that is not a viable solution for most of my family and friends. They need something dead simple, which is what cloud services like LastPass, Bitwarden etc. offer. I think the LastPass user interface is horrible, though...

jagged-chisel 7y ago

I feel like there have been enough incidents with LastPass that no one should be using them. Am I biased due to reporting, or is it the case that they can't be trusted?

ryanmercer 7y ago
I've been using them the better part of a decade, I've never had a single issue and am quite surprised to see so many people complaining about them/mentioning issues in this thread.

zipwitch 7y ago

Not even a mention of Password Safe? https://en.wikipedia.org/wiki/Password_Safe https://en.wikipedia.org/wiki/Password_Safe It's what I've been using for Windows-running non-savvy relatives for decades.

BuildTheRobots 7y ago

Not actually related to the article, but the headline makes me think of the "Muddy Puddle Test" for crypto, which goes like this: 1) Drop your device(s) into a muddy puddle (destroying them). 2) Slip in said puddle so you hit your head. On waking up you're absolutely fine, but are entirely incapable of remembering your passwords or encryption keys. 3) Can you get your cloud data back? If you can, then it's not actually secure.

whatshisface 7y ago
What about biometrics?
- playeren 7y ago
  Don't use biometrics for anything but convenience type features. You can't change your fingerprint if bad actors gets a hold of it.
- BuildTheRobots 7y ago
  Biometrics are good for usernames but not passwords. It's much harder for someone to get something out of your head than cutting off your thumb. - and as playeren says, it's impossible to change it. http://news.bbc.co.uk/1/hi/world/asia-pacific/4396831.stm http://news.bbc.co.uk/1/hi/world/asia-pacific/4396831.stm
arminiusreturns 7y ago
This is what paper keys stored in a secure location are for.

arghblarg 7y ago

An alternative to avoid electronic systems entirely: https://www.tindie.com/stores/russtopia/ https://www.tindie.com/stores/russtopia/

hannofcart 7y ago

Does anyone here use LessPass? I've been using it for a while now and am very happy. No storage needed. One master password to generate reproducible passwords based on the site's domain.

sys_64738 7y ago

Let's put our passwords on a remote server which convinces us they're secure. How did we even get here that such information leaves our control?

fullstop 7y ago
Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how. It's not the best option, of course, but certainly better than weak and reused passwords, right?
- sys_64738 7y ago
  Is convenience more important than security? That's what you're saying here.
  - fullstop 7y ago
    No. I'm saying that the vast majority of people are not capable of doing this, and that it's a better option than weak passwords.
  - rodgerd 7y ago
    Convenience is security.
  - stordoff 7y ago
    Before using a password manager: I'm using short, memorable (often repeated) passwords that are rarely, if ever, changed. After using a password manager: I'm using long (generally 64 characters), unique passwords, and if one is compromised, it's a 30s job to change it on all of my devices. Convenience _enables_ security. I could probably roll my syncing solution, but I would _not_ be convinced it is secure (I don't have that level of expertise), and I would probably end up using a third party anyway (Dropbox/Digital Ocean). I'm not going to sync it manually to the 6 or so devices I regularly use, plus others I use less frequently (it may be more secure, but it's not practical). Because it's low friction, I end up using it more, so it's a _net_ gain in security, even if it isn't perfect.

anderspitman 7y ago

keepassxc (just a simple encrypted password file) + syncthing (copies that file to all your devices) has been working pretty well for me on Linux/Android. I believe there's still no syncthing client for iOS unfortunately. [0] https://keepassxc.org/ https://keepassxc.org/ [1] https://syncthing.net/ https://syncthing.net/

spookyuser 7y ago

I never see the app I am currently using for my password manager on HN password manager threads so I will recommend it now. I have been using Safeincloud https://www.safe-in-cloud.com/en/ https://www.safe-in-cloud.com/en/ for I feel like forever. The dev is quick to add new features, like autofill on android, and windows hello on windows. It's a one time payment on android and IOS, Desktop apps are free. I know that 1password is prob better and more secure, but I can't afford the monthly rate.

iamaelephant 7y ago

One of the best things I've done in my personal software life recently is getting off LastPass. The only other piece of software I have seen decay in quality so rapidly and markedly is PocketCasts.

ryanmercer 7y ago
Ugh, they ruined PocketCasts when they bought it and did that major 'update'. Fortunately I found Podcast Republic the day mine updated and haven't looked back.

uptown 7y ago

What’s the best (translation: easiest) password manager for non-technical users with Windows and iOS devices? I’m trying to find a good solution to help protect the accounts of my older parents. I use a legacy non-subscription 1Password version for myself so I’m not up to date about the subscription model or product changes of recent versions.

casefields 7y ago
I moved myself and the whole family to the often-mentioned Bitwarden 3 years ago. It's been fantastic.

ghastmaster 7y ago

Given the possibility of software failure, would it be wise to use multiple password managers? I have the feeling this is a .45 vs 9mm question that doesn't have a real answer. More software exposes risk of data being exposed vs redundancy. I do not use software managers. I use a password protected spreadsheet(100 passwords). I hope they are safely encrypted.

zndr 7y ago
A seccond PW manager? Not necessary, an offline backup? Great idea. Most PW managers allow you to export in some way shape or form. Doing so and encrypting said file is a great idea, but also something that's hard to do enough for most people that I don't have a good solution.
- ghastmaster 7y ago
  Excellent points.

generalpass 7y ago

I have been using and paying LastPass since it launched with no serious issues and a few minor ones. The Register article makes gives no indication as to the number of users having trouble with the current issue. My single issue with LastPass is that they don't offer an APK download options separate from the Google Play store, so my slow and steady migration will require, at some point, migrating to a different password manager. I made a trouble ticket regarding this issue and they informed me they have no plans to offer a separately downloadable APK.

fortran77 7y ago

I was just thinking, it may be a good idea for me to print out my vital passwords and put them in my safe....

draw_down 7y ago

I’ll never forget when I was issued a new computer at a new job with LastPass installed. It kept popping up a modal dialog (modal to the entire browser) with some inscrutable network error message. I never even bothered trying to use it after that.

fortran77 7y ago

Based on this news, I just looked around and discovered that LastPass has a way to export a CSV file of all the passwords in plaintext. I just did that and have a PGP'd archive of my passwords stored locally. Not a bad thing to do with any password manager.

cuillevel3 7y ago
I think I did this once with one password service and was surprised that they don't even send a warning email to inform me, that that just happened... very scary.

beanaroo 7y ago

Another open-source, open-pgp based password manager worth mentioning is https://www.passbolt.com/ https://www.passbolt.com/

dentemple 7y ago

The reactionary nature of the typical HN poster is on full display here. Lastpass had a bug that affected a small percentage of users. They identified and fixed the bug within several days. What more do you want? Is there really a competing product out there that guarantees NO BUGS? So, then, why the extreme nod to #CancelCulture for what appeared to be just a temporary issue?

geekamongus 7y ago
Probably because of the way the handled it (or didn't for a few days, as was the case here). Just guessing.
riffic 7y ago
They've been circling the toilet for a while now. Quality matters.

rafaelvasco 7y ago

Been using LastPass for years. Couldn't imagine living without it, with the gazzilon of passwords we have to handle. There's other services of course, but I've never felt compelled to leave. But I'd much prefer to not have to deal with any passwords at all in any service;

Kiro 7y ago

Am I the only one using Google's own password manager? Ideology aside I can't think of someone with more engineering resources to prevent hickups and breaches. Are there any benefits of other pw managers I'm missing out on?

instaheat 7y ago

I switched to Bitwarden after certain grievances with LastPass which I don't even recall what they were now.

dole 7y ago
Security breaches?
eteb 7y ago
The final straw for me was LastPass being very late on going WebExtension for Firefox. Not having a working password manager was not an option and the move to Bitwarden was very smooth.

tomaszs 7y ago

What is unclear is if it was an application bug or server bug. In the first case it is not so bad. Since you can downgrade. In the second case it may be disturbing that LastPass requires server connection at all...

elliotec 7y ago

Longing for the day that passwords become obsolete.

riffic 7y ago

I've migrated to Bitwarden. LastPass has been lacking in quality for a while and this outage was the last straw.

aussieguy1234 7y ago

I'd rather be locked out for a while, than to have my passwords stored unencrypted. I've been using LastPass as a paid user for about 5 years.

stevefan1999 7y ago

My recommended alternative to LastPass: Bitwarden at https://github.com/bitwarden/server https://github.com/bitwarden/server The ability to host it yourself is a big kudo to me, then we are no longer constrained by LastPass like this case here.

joemccall86 7y ago

This will probably get buried, but this story had me shudder at the possibility of being locked out of my 1password vault in a similar scenario. In case anyone is in the same boat: * My airplane-mode test passed both on my mobile device and browser (1password X). * The team is aware of the situation with LP and wrote a very thoughtful response: https://discussions.agilebits.com/discussion/comment/544136/#Comment_544136 https://discussions.agilebits.com/discussion/comment/544136/... * From the response above, 1password is SOC2 certified, so availability is taken very seriously.

jcam1960 7y ago

As an alternative, lately, I've been using Passfindr. It's web-based but they have an offline solution so that as long as you have made a backup. This kind of crap won't shut you down. It will read out of the backup file through the browser. And I use it for a lot more than passwords. I pretty much use it for any kind of access. Works good.