3 ms·

I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustwo

I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security https://www.lastpass.com/enterprise/security

J5892 7y ago
I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.
camgunz 7y ago
I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.
- dillondoyle 7y ago
  thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here... https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/ https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...
  - camgunz 7y ago
    Oh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha. Mostly I'm making an appeal to authority to tptacek [1]. https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...

J5892 7y ago

I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.

camgunz 7y ago

I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.

dillondoyle 7y ago
thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here... https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/ https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...
- camgunz 7y ago
  Oh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha. Mostly I'm making an appeal to authority to tptacek [1]. https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...