4 ms·

> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized ser

> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. 1pass user, while I know that it's not as secure as keeping them separated I view it as if someone has access to my 1password vault unencrypted I'm already screwed, but having 2FA coming from 1 tool still protects me from the case of my username/password pair getting leaked or MITMed.

J5892 7y ago
As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass. So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.
- dillondoyle 7y ago
  I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security https://www.lastpass.com/enterprise/security
  - J5892 7y ago
    I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.
  - camgunz 7y ago
    I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.
    - dillondoyle 7y ago
      thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here... https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/ https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...
      - camgunz 7y ago
        Oh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha. Mostly I'm making an appeal to authority to tptacek [1]. https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...
lastres0rt 7y ago
DashLane in the streets, 1pass in the sheets. My 1pass vault is decentralized, and also includes a robust password generator for making stuff on the fly -- something Dashlane lacks. I'm not sure I'm using either service fully, but one of them is a work freebie and the other is from back before 1pass went to a subscription model. ... the idea isn't that either are perfect, but since password sharing and phishing are a bigger attack vector than whether my phone falls into the wrong hands, using 2FA as anti-phishing insurance is still better than not.

J5892 7y ago

As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass. So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.

dillondoyle 7y ago
I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security https://www.lastpass.com/enterprise/security
- J5892 7y ago
  I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.
- camgunz 7y ago
  I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.
  - dillondoyle 7y ago
    thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here... https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/ https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...
    - camgunz 7y ago
      Oh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha. Mostly I'm making an appeal to authority to tptacek [1]. https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...

lastres0rt 7y ago

DashLane in the streets, 1pass in the sheets. My 1pass vault is decentralized, and also includes a robust password generator for making stuff on the fly -- something Dashlane lacks. I'm not sure I'm using either service fully, but one of them is a work freebie and the other is from back before 1pass went to a subscription model. ... the idea isn't that either are perfect, but since password sharing and phishing are a bigger attack vector than whether my phone falls into the wrong hands, using 2FA as anti-phishing insurance is still better than not.