5 ms·
As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA comp
by J5892 7y ago
As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass.
So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.
- dillondoyle 7y agoI'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security https://www.lastpass.com/enterprise/security
- J5892 7y agoI trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.
- camgunz 7y agoI'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.
- dillondoyle 7y agothanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here... https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/ https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...
- camgunz 7y agoOh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha. Mostly I'm making an appeal to authority to tptacek [1]. https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...