29 ms·

LastPass Android app has got 7 trackers in it

310 points by aquir 6y ago

amelius 6y ago
Firefox Sync is quite good. And it's part of Firefox. Less convenient for passwords in native apps, but still usable.
aquir 6y ago
Germany based privacy research firm warns users, code signatures of 7 trackers found in the app
- anotherfish 6y ago
  So that means the overall reputation is withering as well. Even more than before probably. Is Lastpass a widely trusted thing? other than the obvious refrain: "of course it is - its a password manager"? Is its security known for being well regarded?
  - asaddhamani 6y ago
    Lastpass is the most widely used password manager. They've been the target of security breaches in the past and are currently receiving bad press because of a bait and switch they did with users on their free plan.
    - anotherfish 6y ago
      This is why I ask. A big target means lots of attention. A small target might have even worse security but no one is paying attention to the same extent.
    - aquir 6y ago
      Yes, I think people should know about this because LP is the most popular one. And it's collecting loads of data. Probably this is the reason why they never open sourced it
    - rsj_hn 6y ago
      I'm not sure I'd call reducing the functionality of the free tier as bait and switch. First, you aren't paying anything for that free tier, and bait and switched usually refers to a type of business fraud (which is illegal, btw) in which you are sold one good but then provided with a different good. If you didn't buy anything, and were not asked to buy anything, but were simply provided with less free stuff than last year, it's a bit of stretch, and even a bigger stretch to be so indignant that you are now getting less. Honestly, it sounds pretty damn entitled. What LastPass did was they removed functionality of a free plan -- functionality which they had for several years (I think over 5 years now) and then decided to remove it, most likely because they thought the marketing value of the free plan was no longer worth the potential sales cannibalization. (I'm not an employee and have no inside knowledge). This is a straightforward business decision that firms do all the time. You can always take your zero dollar business elsewhere. I wouldn't consider LastPass to be the most secure password manager, and I'm not sure I would recommend them as my favorite, but they are very easy to use, are the market leader, and it is important that they stay in business, as on balance these password managers do improve the overall security of the web.
  - 0xkd 6y ago
    2 years old, perhaps relevant: https://twitter.com/taviso/status/1167400178912882688 https://twitter.com/taviso/status/1167400178912882688
ignoramous 6y ago
See also: https://beta.pithus.org/report/5d58f9bd3fb3dd1ce5ec75796b87e296b20ec98075607ed274016f11a30f30e4 https://beta.pithus.org/report/5d58f9bd3fb3dd1ce5ec75796b87e...
Jsharm 6y ago
Eurgh it was so much work to get my parents used to using lastpass. I even pay for premium for the whole family, can't face having to migrate them all.
- sammorrowdrums 6y ago
  Don't know if you prefer it but the 1Password family plan is decent, and basically the transition is mostly just a case of pasting the dump from LP into 1password. They also have native Linux app and their browser plugins are good. Of course they still have plenty of critics, but I just don't think my family would use Bitwarden yet.
kwanbix 6y ago
Move to Bitwarden. It has a great free version but if you want to support them, you can pay 10 USD per year. Less than 1 dollar a month. Really reasonable.
- janandonly 6y ago
  added bonus, Bitwarden has " only " two trackers in it https://community.bitwarden.com/t/remove-embedded-trackers-from-bitwarden/18925 https://community.bitwarden.com/t/remove-embedded-trackers-f...
  - ro_bit 6y ago
    I feel like these trackers (Firebase Analytics and Visual Studio Crash Reporting) need to be looked at in context of the data they actually send and who they report to. According to the thread > In the Mobile apps, Firebase Cloud Messaging (often mistaken for a tracker) is used only for push notifications related to sync and performs absolutely no tracking functions. Microsoft Visual Studio App Center is used for crash reporting on a range of mobile devices. In the Web Vault, Stripe and PayPal scripts are used for payment processing only on payment pages. Compare this to LastPass where it was feeding data to Google Analytics and MixPanel, which do much more invasive levels of analysis in general.
    - thetanil 6y ago
      Firebase is Google. I don't know why they deserve different levels of trust. If Firebase has your permission to harvest your sync info, there is no reason to think this doesn't get copied right on over into googles 'track every click and movement' apparatus.
      - sofixa 6y ago
        Firebase is Google, yes, and the name of a suite of mobile-related products. They have ML Kit, Crash analytics, configuration management, auth etc. Also, Firebase Cloud Messaging is the only way to have push notifications on Android. Using either of their products ( outside of Firebase Analytics and maybe Firebase Auth) isn't tracking users and isn't harvesting user data. It's using tools to make apps, that's it.
JamesonNetworks 6y ago
If you haven't heard of it, I highly recommend checking out SQRL (secure quick reliable logon). It solves the problems of Identity on the internet in a nice, convenient, and decentralized way. While it isn't going to be widely adopted for a while, we should be talking about it anytime we see trackers in password management apps or breaches of websites. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm Disclosure: Started looking at it this weekend after hearing about it for a couple of years and starting to help contribute to various SQRL libs
- akvadrako 6y ago
  Thanks for the pointer, but I'm initially very skeptical. Not to judge a book by it's cover but that website looks like it was made in 1990. They also don't do a very good job explaining what this is. I found this: https://sqrl.grc.com/pages/introductory_questions_and_answers/ https://sqrl.grc.com/pages/introductory_questions_and_answer... It says "Using a SQRL app, a master identity is created and shared among the devices. Websites which support SQRL logon trigger the app to securely identify the user." How does this happen? How can a website talk to an app? Also where is the source code?
  - jeroenhd 6y ago
    The first document, SQRL explained, does a decent job describing how the system works. Having to download a PDF to read text on a website isn't the greatest of UX experiences. The talking to seems to happen through a custom sqrl: URI-scheme. That's something that's supported by most platforms I know of; Steam uses the same mechanism to start installing a game you purchased in the browser, if I remember correctly. Source code for several implementations is linked in the explainer document from the home page: https://www.grc.com/sqrl/SQRL_Explained.pdf https://www.grc.com/sqrl/SQRL_Explained.pdf I'm not sure if the Windows implementation is open source, but the algorithm itself is.
  - wccrawford 6y ago
    To me, it's much more concerning that they do such a bad job of telling me what SQRL does than the fact that the page looks dated. At least it's clean-looking. But I clicked around for a while and only found some videos that might show me what SQRL does, but I didn't actually feel like watching a video, so I still don't know. Based on what I read, it sounds like snake oil so far. Too good to be true. I don't remember the phrase, but it suggested it would be my last password solution ever, which just sounds like snakeoil. Also, it seems like only the Windows implementation is mature. All other implementations are by third parties and are marked as not being complete.
hackerman_fi 6y ago
Still wondering how it became the general consensus that password managers are secure. I wouldn't store my passwords in any online system.
- Closi 6y ago
  Because you can architect them to be provably secure via E2E encryption. See how 1Password deals with this for reference.
  - dingaling 6y ago
    You can architect it so, but the implementation is what counts. No program which knows your master password and which has network access can ever be considered secure.
    - neolog 6y ago
      There is no program that knows the master password. It's hashed.
    - gruez 6y ago
      Why do you use a web browser then? It doesn't know your master password, but you enter most/all of your passwords into it anyways. To make it worse, it runs third party code that also have access to your password (ie. addons with the "Access your data for all websites" permission, which is most of them).
- karamanolev 6y ago
  Isn't the general consensus that nothing is secure, you just have different levels of difficulty to break in? In that sense, they're just more secure than using a single simple password across multiple (potentially all) your logins. Or at least that's the goal...
- sverhagen 6y ago
  Come on, security isn't black or white, or absolute. I understand that my password manager may be flawed, but it sure was a huge upgrade from doing much simpler passwords, with my cats birthday in them, and +01, +02, +03 to make them "unique" between accounts. That sure made me feel vulnerable and unsecure. (And I do not really have a cat.)
popotamonga 6y ago
I go with Keepass + Onedrive for my personal stuff
- pmontra 6y ago
  Keepass and Syncthing. The laptop is where I update the database. Every other device is read only. Sometimes I also copy the db to my phone over gvfs (kdeconnect / gsconnect) from the command line so I don't have to start Syncthing.
  - txtsd 6y ago
    I do this, but other devices are configured as sources too, so I can add entries from my smart phone or wherever. KeepassDX on Android sets a AndroidApp attribute when an entry is used to autofill, because sometimes there isn't a website to match, so the com.X.Y format of the Android app's name will be used from the attribute next time. As a bonus, KeepassX on desktop reloads the DB automatically once syncthing syncs the changes, so you don't have to reload the DB manually after adding/changing an entry from your other devices.
    - jobigoud 6y ago
      Risk of bidirectional synching, apart from conflicts when you edit from both sides, is that if something catastrophic happens, like you mistakenly delete half of your passwords, it gets synchronized to the other instances.
      - txtsd 6y ago
        Syncthing can store histories, so you can retrieve your database from before the conflicts, if it happens. Personally, it hasn't happened to me. I keep my eye on syncthing's notification anyway, so it's not a problem to me.
        aerique 6y ago
        And to be absolutely sure I have a cronjob that backs up the DB at regular times :-)
S_A_P 6y ago
I rarely see mention of 1Password. Anyone have thoughts about its security and privacy?
- aquir 6y ago
  I see it recommended a lot but I am happy with Bitwarden so never had a look. Maybe I will before my next billing cycle starts...
- gopkarthik 6y ago
  According to the same researcher, 1Password has no trackers. 1Password does use UserID & DeviceID as identifiers though. FWIW they do conduct regular security audits and post it at https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ . The most recent one was done by Cure53 in 2020-Oct [1]. I've been a happy 1Password Family user for a few years now. Very easy to share common account login credentials, important documents etc with the family. [1] https://bucket.agilebits.com/security/Cure53-B5_1PW-06-report.v2.pdf https://bucket.agilebits.com/security/Cure53-B5_1PW-06-repor...
- seanieb 6y ago
  Rather than link to their whitepaper etc, I’ll just offer my endorsement as a security engineer of 1Password as being the most secure and best password manager. LastPass has been a clown show for years. Unbelievably sloppy work.
- arepublicadoceu 6y ago
  Probably because, for most of us, the reasoning goes like this: Security wise they're probably about the same, if you use the cloud vault. Ok, 1Password is slightly more polished than bitwarden but it's not 3.6x (36usd vs 10 usd) more polished than bitwarden.
woliveirajr 6y ago
Original blog: https://www.kuketz-blog.de/lastpass-android-drittanbieter-ueberwachen-jeden-schritt/ https://www.kuketz-blog.de/lastpass-android-drittanbieter-ue...
freeCandy 6y ago
I recently switched to pass, and found it much better than any available password management service. It makes use of tools that I use on a daily basis, which helps a lot with simplicity. And I don't have to trust a single provider with all my data. https://www.passwordstore.org https://www.passwordstore.org
- k4runa 6y ago
  I love the Git integration on this, it's saved me so many times when my computer failed.
- rjmunro 6y ago
  How well does the chrome browser plugin work? I like the idea that it's a standard way to store passwords that can be easily manipulated with whatever tools you like, including git.
  - freeCandy 6y ago
    Can't comment on the chrome plugin, but the firefox extension(passff) feels pretty much like a drop-in replacement for it's default password backup feature. But I've mostly switched to using the dmenu script, since it's much more snappier and available everywhere.
HenryBemis 6y ago
LastPass on my phone also tried to talk to Facebook on every launch. I consider those parasites to be trackers. That said, I use NoRoot Firewall so these are not problems. I make a global Block rule and I get rid of them 'nice folks' for everything (stock, bloatware, apps) on the phone. Also, if you can edit/replace your HOSTS file I always suggest this: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/
thegeekbin 6y ago
I expect the iPhone edition has the same trackers in it. It's quite disgusting, frankly. I don't see a logical need for these trackers.
raws 6y ago
Oh they even have an exodus app to scan your phone!
hestefisk 6y ago
I was just about to pay for my LastPass subscription (after years on being on free tier), given the recent price changes. This made me change my mind - why a password manager, which I entrust with my personal passwords, notes and credit card info, needs to dial home to 7 different trackers is just beyond relief. I like LastPass because it works across my phone and multiple machines / browsers (I use Firefox). Can anyone please shed some light on good alternatives? I will happily pay for it.
- buster 6y ago
  KeepassXC plus some file sync tool works great for me across multiple devices (Android, Linux, Windows)
  - hestefisk 6y ago
    iOS?
    - hanklazard 6y ago
      Last I checked, there were some third party iOS apps but the Bitwarden iOS app was far superior.
    - 40four 6y ago
      I have found KeePassium to be an excellent iOS KeePass client.
    - chewz 6y ago
      Strongbox is good on both iOS and macOS...
    - delogos 6y ago
      KyPass has been excellent for me for the last several years.
    - Fnoord 6y ago
      KeePass only officially works on Windows. All non-Windows versions are unofficial versions. See [1] for a list. [1] https://keepass.info/download.html https://keepass.info/download.html
stabbles 6y ago
password-store has 0: https://reports.exodus-privacy.eu.org/en/reports/dev.msfjarvis.aps/latest/ https://reports.exodus-privacy.eu.org/en/reports/dev.msfjarv... but it's commonly used with OpenKeyChain, which does have a tracker: https://reports.exodus-privacy.eu.org/en/reports/org.sufficientlysecure.keychain/latest/ https://reports.exodus-privacy.eu.org/en/reports/org.suffici...
- Valodim 6y ago
  The piwik in OpenKeychain is gone in the 5.6 release. And it was always opt-in, of course. In defense of trackers: knowing what features your users use and don't use is a huge deal to decide where to spend time on and where not. This doesn't cease to be true when software is open source. Giving users a simple way to give feedback of how they use the app is totally fair. Similar to how distros collect stats about installed packages, you wouldn't stop using Debian because it had an opt-in mechanism to send such stats upstream. That said, multiple trackers is ridiculous, and by multiple third parties no less. I can understand that the abuse of tracking due to blind optimization for profit leads users to adopt a "trackers are generally bad" stance, since more nuanced views quickly get complicated.
jafingi 6y ago
1Password for Android have 0 trackers. And 1/3 of the permissions needed.
jakub_g 6y ago
In other news, my banking app used to have 17 trackers (!) but they reduced to 6 some time ago (I pinged them about that, not sure if this was related but it's good to put some pressure on the businesses to let them know users care). https://reports.exodus-privacy.eu.org/en/reports/search/com.boursorama.android.clients/ https://reports.exodus-privacy.eu.org/en/reports/search/com.... BTW CrashLytics/Firebase Analytics are a de facto standard in every Android app if you want to roll out the new versions responsibly so I'm less worried about it than some random unknown company (though this cements the Google monopoly, so yeah it sucks).
SamuelAdams 6y ago
Does this still apply to the enterprise edition?
jeffrallen 6y ago
I chose LastPass, then it got sold to the current owners, so i switched to 1Password the next day, and I'm glad I did.
jerry1979 6y ago
I use Firefox as my password manager. Does Lastpass or Bitwarden have benefits that I am missing out on?
TeeWEE 6y ago
I moved to bitwarden. Their app / product is top notch. Actually easier to use than LastPass.
fx32s 6y ago
Reading the comments it almost seems that folks assume passwords are shared plain text with these trackers. I don't have any issue with Lastpass having anonymized logs of how often people visit which part of the app if it leads to improvements in usability.
- danpalmer 6y ago
  From a security standpoint this is kinda the point – we don't know what it's sharing and it has the ability to, so we have to assume it. Obviously it's unlikely, but through accident, ignorance, or malice, it's possible. I think for a security product the onus is on the author to show that this can't happen (not just that it doesn't), which means either not having trackers (easy) or somehow showing that trackers are isolated from the sensitive data (hard). This isn't uncommon. Apple have published a bunch about how they do iOS security, and it's quite clear that there's strong sandboxing between untrusted code and sensitive data, in some cases even enforced at the hardware level.
- Fnoord 6y ago
  > I don't have any issue with Lastpass having anonymized logs of how often people visit which part of the app if it leads to improvements in usability. I do. Some don't. Some do. So give the user the choice instead. I also wonder if this is even GDPR compliant...
imagine99 6y ago
We just moved a whole org over to Bitwarden anyway because of the way they threatened to hold free accounts hostage ("Pay us or you will not be able to access your password from mobile (or desktop) anymore"). We had previously actually planned to switch to a paid plan with them by July anyway (to nobody's surprise, management can be extremely slow to approve these things) - but their deadline was March and they way they forced our hand got management to act surprisingly quickly in transitioning us to Bitwarden. I wonder which, excuse me, brain-dead executive honestly thought waving a pistol in users' faces like an amateur highwayman to force them to pay was by any stretch of the imagination an acceptable way to improve user confidence, especially in such a sensitive area where they store (access to) your most personal and private secrets. The same holds true for these trackers. I mean, I see all these weird decisions and just ask myself, who are these people in positions of significant power of larger companies who make such obvious, crazy bad management decisions? Whenever I meet them, they all seem so normal and well-dressed ;-) Boggles my mind every time. I must say, for years now I've had the impression all the amazing products that LogMeIn (who own LastPass) touches, get toxic for the end-user quickly. Hamachi was so great in the olden days. GoToMeeting couldn't be rescued even by Covid. They had, at one point, one of the greatest remote desktop solutions around (which you could even completely self-host) but they were basically killed by TeamViewer because of their boneheaded licensing decisions. Of course, TeamViewer has been going down the same drain and has significantly killed mass appeal since their IPO, which leads me to believe that this is just the "circle of liiiive"...
- danpalmer 6y ago
  LogMeIn was bought a few years ago by a private equity company. The standard PE playbook is to buy things that are popular and stable but maybe not growing like this and then milk them for all they can, particularly in things that are hard to move away from (see Travis CI).
  - troymc 6y ago
    I knew that LogMeIn had acquired LastPass, but I didn't know that private equity had gobbled up LogMeIn (which used to be publicly traded on the stock market). Apparently the private equity deal was only finalized in August of last year, see: [1] https://www.nasdaq.com/press-release/francisco-partners-and-evergreen-coast-capital-complete-acquisition-of-logmein-2020 https://www.nasdaq.com/press-release/francisco-partners-and-...
jgoyvaerts 6y ago
No serious user should still be using LastPass in 2021. On a previous project the company I joined used LastPass as their password solution, we had 2 root admins, me and a senior colleague. One day my senior colleague tries to log in to check/change a password and is unable to log in to his account. Account recovery/password lost doesn't work either. I log in to verify if his account is blocked or disabled in anyway, and I can't even find his account. The account was completely GONE. I checked the audit logs of the account (which should include user creation, deletion, logins, etc) and there is no mention of the account ever being deleted, it's like it never existed. We contacted their support but never got a serious reply to this behavior, so we moved over to 1Password the next day and never looked back. Stay away from LastPass, they just lose data out of nowhere and their support sucks.
gamesbrainiac 6y ago
This sucks. I decided to buy LastPass premium after having used it for many years. This makes me sad, because I cannot ask for a refund, and I am stuck with it for a year.
juancampa 6y ago
These specific trackers are not normally used for advertising or selling your data to third parties afaik. These trackers are used for fixing bugs and understanding how your users use the app so it can be improved.
imwillofficial 6y ago
RememBear is the unsung hero, awesome interface, apps for different platforms, and a bear who loves you. (Runner up is bitwarden, great price, great tech, great project, poor UI)
janoc 6y ago
I just don't get why people think that uploading all their passwords that are protecting some potentially extremely sensitive data to some random internet company is a good idea. And then wonder when they are being extorted ("you better subscribe and pay or else!"), datamined (article) or have their data stolen (LastPass was hacked before). People, stop giving these businesses the loaded guns to hold at your head! There are plenty of offline password managers that will do you equal or better service than this.
- capableweb 6y ago
  > There are plenty of offline password managers that will do you equal or better service than this That's cool, I didn't know that and I'm eager to hear of replacements. I regularly use 5+ devices, currently all via 1password and have about 3 family members including myself using 1password (so in total maybe 10 devices or something like that). None of us want to host a server by ourselves (as both time and security is of a concern there). What do you suggest we use in my household? Would have to work on Windows, Linux, macOS, Android, iPhone, web and unix terminals. It should be able to store passwords, photos, credit cards and also have browser extensions for Safari, Firefox and Chrome for making it easy to fill out. + if it has a password generator as well, but not required. Many thanks!
  - janoc 6y ago
    I am using KeepassXC and keeping the encrypted password file in a Google Drive, shared across my devices. That would likely cover most of your use cases too (the file is locally cached so even if there is no network connection I am not screwed). For cases where you really can't use an offline password manager (e.g. because you are using some sort of gadget that doesn't allow you to connect to Google Drive or whatever), sync the relevant (not all!) passwords using your browser account. Why is the above better than your 1password, LastPass or something else? Well, I don't need to take the company at their word that they are properly encrypting the file and properly protecting it - I know it is because it has been encrypted locally by Keepass (easy to check, the source code is all available too). Google only ever gets to see a binary encrypted blob. And if I need to move to another service (e.g. I have been using Dropbox before), I simply move the file, that's all. No mess, no fuss. My data (especially passwords!) aren't held hostage anywhere.
crazygringo 6y ago
Why is this an issue? These aren't advertising trackers. They're not selling your data. They're name-brand, industry-standard product analytics, for measuring the usage of app features etc. They're for improving UX and the product generally. I mean, one of them is solely for crash reporting. This is zero privacy or security risk here. This is standard for essentially any commercial app. There is absolutely nothing unique or different or exceptional about LastPass here. And there is nothing about being a password manager that somehow makes this inappropriate. It's not like it's uploading your passwords to its analytics or anything. Seriously, this is just spreading FUD. I get that a lot of people hate LastPass for a lot of reasons, but this isn't a good reason.
- capableweb 6y ago
  First, who said it's an issue that you have to care about? People feel different things are issues. Not sure how facts are FUD. The submission here is saying "got 7 trackers in it" which are facts. What those trackers are tracking is irrelevant. They are tracking you and your usage, and get more information that way compared to if they only used backend tracking. "This is standard for essentially any commercial app" sounds more like FUD that this submission, as that statement is obviously easy to check if it's true or not. In this case, I don't think it's true, as many apps don't do client-side tracking. I made a quick check for one competitor of lastpass (1password - https://reports.exodus-privacy.eu.org/en/reports/com.agilebits.onepassword/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.agilebi...) and they have 0 trackers. 1password is commercial and pretty big at this point, so your statement is not necessarily true in all industries/usages.
  - crazygringo 6y ago
    Of course facts aren't FUD. I'm responding to a lot of comments here which assume this is a bad thing, which I think is obviously why it's being upvoted as well. And I'm not sure you understand the term FUD. You're saying my comment spreads fear and uncertainty? It's literally the opposite, I'm saying this particular thing isn't something to worry about. Mobile apps aren't like webpages where most actions generate backend calls whose logs can be analyzed as an alternative. If 1password isn't using 3rd-party analytics, they probably rolled their own. No big difference. In any case, my point remains true -- client-side analytics is standard for essentially any commercial app, in order to improve the UX. There are exceptions of course, like for any rule, but it doesn't change the fact it's still standard.
manishsharan 6y ago
I actually liked LastPass and have been a long time paying customer. I just deleted my account. Trackers on a Password Manager -- what the fuck were they thinking ? I deleted my account to send a message to the Pointy headed bosses running LastPass that you can only squeeze a customer so much. Also -- aren't the people who use LastPass are by default privacy and security conscious and actually paying for added security and convenience? And the morons decided to violate our trust.
nonbirithm 6y ago
I'm not sure these trackers are the worst possible as they could be used for things like crash analytics. However, unrelated to this specific case, I believe that mobile apps could be the one place that adblocking cannot be guaranteed to work. When things get byte-compiled, you can no longer programmatically inspect the interface and remove malicious ads like with the browser's runtime. Imagine a future where a critical feature you have to use like banking is only available through a mobile app, and this is enforced through something like a certificate check. Then they run ads over it. DNS based blocking is not infallible either. Even today it does not work with the YouTube app, because their ads are served on the same domain as the content, so blocking one means blocking both. The only solution people have come up with is reverse engineering the official app's source code and releasing a modified version, a process that consumes far more time and effort than using something like uBlock. And this was only prioritized and accomplished because YouTube has become that important of a platform to enough people. If there's a future where our lives depend on compiled apps, will enough people go through the same effort to sanitize all of them?
rdudek 6y ago
For anyone moving away from LastPass, it's very easy to export all LastPass data into a CSV file and import it to other password managers. The hard part was deleting everything from LastPass as it only allows to select one item at a time.
segmondy 6y ago
Security != Privacy
jacobsenscott 6y ago
How many people are going to write all their passwords into a plain text csv file that will sit on their HD forever just to move to another password manager that might have even worse security because of this FUD. These are all standard analytics packages. I get it - if you want to minimize your contact with trackers you do you. But this is being marketed as some kind of scary security breach so people switch from one proprietary product to another.
penguin_booze 6y ago
I've already switched to BitWarden. One thing I really miss from their mobile app is the in-app browser that LastPass had. All my credential-requiring browsing can stay inside the app itself instead of my phone browser. Whereas now, I'd have to copy and paste them from BitWarden to my mobile browser.
- syntaxing 6y ago
  Same, I wish there was a BitWarden to Safari sync or something

310 points by aquir 6y ago

amelius 6y ago

Firefox Sync is quite good. And it's part of Firefox. Less convenient for passwords in native apps, but still usable.

aquir 6y ago

Germany based privacy research firm warns users, code signatures of 7 trackers found in the app

anotherfish 6y ago
So that means the overall reputation is withering as well. Even more than before probably. Is Lastpass a widely trusted thing? other than the obvious refrain: "of course it is - its a password manager"? Is its security known for being well regarded?
- asaddhamani 6y ago
  Lastpass is the most widely used password manager. They've been the target of security breaches in the past and are currently receiving bad press because of a bait and switch they did with users on their free plan.
  - anotherfish 6y ago
    This is why I ask. A big target means lots of attention. A small target might have even worse security but no one is paying attention to the same extent.
  - aquir 6y ago
    Yes, I think people should know about this because LP is the most popular one. And it's collecting loads of data. Probably this is the reason why they never open sourced it
  - rsj_hn 6y ago
    I'm not sure I'd call reducing the functionality of the free tier as bait and switch. First, you aren't paying anything for that free tier, and bait and switched usually refers to a type of business fraud (which is illegal, btw) in which you are sold one good but then provided with a different good. If you didn't buy anything, and were not asked to buy anything, but were simply provided with less free stuff than last year, it's a bit of stretch, and even a bigger stretch to be so indignant that you are now getting less. Honestly, it sounds pretty damn entitled. What LastPass did was they removed functionality of a free plan -- functionality which they had for several years (I think over 5 years now) and then decided to remove it, most likely because they thought the marketing value of the free plan was no longer worth the potential sales cannibalization. (I'm not an employee and have no inside knowledge). This is a straightforward business decision that firms do all the time. You can always take your zero dollar business elsewhere. I wouldn't consider LastPass to be the most secure password manager, and I'm not sure I would recommend them as my favorite, but they are very easy to use, are the market leader, and it is important that they stay in business, as on balance these password managers do improve the overall security of the web.
- 0xkd 6y ago
  2 years old, perhaps relevant: https://twitter.com/taviso/status/1167400178912882688 https://twitter.com/taviso/status/1167400178912882688

ignoramous 6y ago

See also: https://beta.pithus.org/report/5d58f9bd3fb3dd1ce5ec75796b87e296b20ec98075607ed274016f11a30f30e4 https://beta.pithus.org/report/5d58f9bd3fb3dd1ce5ec75796b87e...

Jsharm 6y ago

Eurgh it was so much work to get my parents used to using lastpass. I even pay for premium for the whole family, can't face having to migrate them all.

sammorrowdrums 6y ago
Don't know if you prefer it but the 1Password family plan is decent, and basically the transition is mostly just a case of pasting the dump from LP into 1password. They also have native Linux app and their browser plugins are good. Of course they still have plenty of critics, but I just don't think my family would use Bitwarden yet.

kwanbix 6y ago

Move to Bitwarden. It has a great free version but if you want to support them, you can pay 10 USD per year. Less than 1 dollar a month. Really reasonable.

janandonly 6y ago
added bonus, Bitwarden has " only " two trackers in it https://community.bitwarden.com/t/remove-embedded-trackers-from-bitwarden/18925 https://community.bitwarden.com/t/remove-embedded-trackers-f...
- ro_bit 6y ago
  I feel like these trackers (Firebase Analytics and Visual Studio Crash Reporting) need to be looked at in context of the data they actually send and who they report to. According to the thread > In the Mobile apps, Firebase Cloud Messaging (often mistaken for a tracker) is used only for push notifications related to sync and performs absolutely no tracking functions. Microsoft Visual Studio App Center is used for crash reporting on a range of mobile devices. In the Web Vault, Stripe and PayPal scripts are used for payment processing only on payment pages. Compare this to LastPass where it was feeding data to Google Analytics and MixPanel, which do much more invasive levels of analysis in general.
  - thetanil 6y ago
    Firebase is Google. I don't know why they deserve different levels of trust. If Firebase has your permission to harvest your sync info, there is no reason to think this doesn't get copied right on over into googles 'track every click and movement' apparatus.
    - sofixa 6y ago
      Firebase is Google, yes, and the name of a suite of mobile-related products. They have ML Kit, Crash analytics, configuration management, auth etc. Also, Firebase Cloud Messaging is the only way to have push notifications on Android. Using either of their products ( outside of Firebase Analytics and maybe Firebase Auth) isn't tracking users and isn't harvesting user data. It's using tools to make apps, that's it.

JamesonNetworks 6y ago

If you haven't heard of it, I highly recommend checking out SQRL (secure quick reliable logon). It solves the problems of Identity on the internet in a nice, convenient, and decentralized way. While it isn't going to be widely adopted for a while, we should be talking about it anytime we see trackers in password management apps or breaches of websites. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm Disclosure: Started looking at it this weekend after hearing about it for a couple of years and starting to help contribute to various SQRL libs

akvadrako 6y ago
Thanks for the pointer, but I'm initially very skeptical. Not to judge a book by it's cover but that website looks like it was made in 1990. They also don't do a very good job explaining what this is. I found this: https://sqrl.grc.com/pages/introductory_questions_and_answers/ https://sqrl.grc.com/pages/introductory_questions_and_answer... It says "Using a SQRL app, a master identity is created and shared among the devices. Websites which support SQRL logon trigger the app to securely identify the user." How does this happen? How can a website talk to an app? Also where is the source code?
- jeroenhd 6y ago
  The first document, SQRL explained, does a decent job describing how the system works. Having to download a PDF to read text on a website isn't the greatest of UX experiences. The talking to seems to happen through a custom sqrl: URI-scheme. That's something that's supported by most platforms I know of; Steam uses the same mechanism to start installing a game you purchased in the browser, if I remember correctly. Source code for several implementations is linked in the explainer document from the home page: https://www.grc.com/sqrl/SQRL_Explained.pdf https://www.grc.com/sqrl/SQRL_Explained.pdf I'm not sure if the Windows implementation is open source, but the algorithm itself is.
- wccrawford 6y ago
  To me, it's much more concerning that they do such a bad job of telling me what SQRL does than the fact that the page looks dated. At least it's clean-looking. But I clicked around for a while and only found some videos that might show me what SQRL does, but I didn't actually feel like watching a video, so I still don't know. Based on what I read, it sounds like snake oil so far. Too good to be true. I don't remember the phrase, but it suggested it would be my last password solution ever, which just sounds like snakeoil. Also, it seems like only the Windows implementation is mature. All other implementations are by third parties and are marked as not being complete.

hackerman_fi 6y ago

Still wondering how it became the general consensus that password managers are secure. I wouldn't store my passwords in any online system.

Closi 6y ago
Because you can architect them to be provably secure via E2E encryption. See how 1Password deals with this for reference.
- dingaling 6y ago
  You can architect it so, but the implementation is what counts. No program which knows your master password and which has network access can ever be considered secure.
  - neolog 6y ago
    There is no program that knows the master password. It's hashed.
  - gruez 6y ago
    Why do you use a web browser then? It doesn't know your master password, but you enter most/all of your passwords into it anyways. To make it worse, it runs third party code that also have access to your password (ie. addons with the "Access your data for all websites" permission, which is most of them).
karamanolev 6y ago
Isn't the general consensus that nothing is secure, you just have different levels of difficulty to break in? In that sense, they're just more secure than using a single simple password across multiple (potentially all) your logins. Or at least that's the goal...
sverhagen 6y ago
Come on, security isn't black or white, or absolute. I understand that my password manager may be flawed, but it sure was a huge upgrade from doing much simpler passwords, with my cats birthday in them, and +01, +02, +03 to make them "unique" between accounts. That sure made me feel vulnerable and unsecure. (And I do not really have a cat.)

popotamonga 6y ago

I go with Keepass + Onedrive for my personal stuff

pmontra 6y ago
Keepass and Syncthing. The laptop is where I update the database. Every other device is read only. Sometimes I also copy the db to my phone over gvfs (kdeconnect / gsconnect) from the command line so I don't have to start Syncthing.
- txtsd 6y ago
  I do this, but other devices are configured as sources too, so I can add entries from my smart phone or wherever. KeepassDX on Android sets a AndroidApp attribute when an entry is used to autofill, because sometimes there isn't a website to match, so the com.X.Y format of the Android app's name will be used from the attribute next time. As a bonus, KeepassX on desktop reloads the DB automatically once syncthing syncs the changes, so you don't have to reload the DB manually after adding/changing an entry from your other devices.
  - jobigoud 6y ago
    Risk of bidirectional synching, apart from conflicts when you edit from both sides, is that if something catastrophic happens, like you mistakenly delete half of your passwords, it gets synchronized to the other instances.
    - txtsd 6y ago
      Syncthing can store histories, so you can retrieve your database from before the conflicts, if it happens. Personally, it hasn't happened to me. I keep my eye on syncthing's notification anyway, so it's not a problem to me.
      - aerique 6y ago
        And to be absolutely sure I have a cronjob that backs up the DB at regular times :-)

S_A_P 6y ago

I rarely see mention of 1Password. Anyone have thoughts about its security and privacy?

aquir 6y ago
I see it recommended a lot but I am happy with Bitwarden so never had a look. Maybe I will before my next billing cycle starts...
gopkarthik 6y ago
According to the same researcher, 1Password has no trackers. 1Password does use UserID & DeviceID as identifiers though. FWIW they do conduct regular security audits and post it at https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ . The most recent one was done by Cure53 in 2020-Oct [1]. I've been a happy 1Password Family user for a few years now. Very easy to share common account login credentials, important documents etc with the family. [1] https://bucket.agilebits.com/security/Cure53-B5_1PW-06-report.v2.pdf https://bucket.agilebits.com/security/Cure53-B5_1PW-06-repor...
seanieb 6y ago
Rather than link to their whitepaper etc, I’ll just offer my endorsement as a security engineer of 1Password as being the most secure and best password manager. LastPass has been a clown show for years. Unbelievably sloppy work.
arepublicadoceu 6y ago
Probably because, for most of us, the reasoning goes like this: Security wise they're probably about the same, if you use the cloud vault. Ok, 1Password is slightly more polished than bitwarden but it's not 3.6x (36usd vs 10 usd) more polished than bitwarden.

woliveirajr 6y ago

Original blog: https://www.kuketz-blog.de/lastpass-android-drittanbieter-ueberwachen-jeden-schritt/ https://www.kuketz-blog.de/lastpass-android-drittanbieter-ue...

freeCandy 6y ago

I recently switched to pass, and found it much better than any available password management service. It makes use of tools that I use on a daily basis, which helps a lot with simplicity. And I don't have to trust a single provider with all my data. https://www.passwordstore.org https://www.passwordstore.org

k4runa 6y ago
I love the Git integration on this, it's saved me so many times when my computer failed.
rjmunro 6y ago
How well does the chrome browser plugin work? I like the idea that it's a standard way to store passwords that can be easily manipulated with whatever tools you like, including git.
- freeCandy 6y ago
  Can't comment on the chrome plugin, but the firefox extension(passff) feels pretty much like a drop-in replacement for it's default password backup feature. But I've mostly switched to using the dmenu script, since it's much more snappier and available everywhere.

HenryBemis 6y ago

LastPass on my phone also tried to talk to Facebook on every launch. I consider those parasites to be trackers. That said, I use NoRoot Firewall so these are not problems. I make a global Block rule and I get rid of them 'nice folks' for everything (stock, bloatware, apps) on the phone. Also, if you can edit/replace your HOSTS file I always suggest this: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/

thegeekbin 6y ago

I expect the iPhone edition has the same trackers in it. It's quite disgusting, frankly. I don't see a logical need for these trackers.

raws 6y ago

Oh they even have an exodus app to scan your phone!

hestefisk 6y ago

I was just about to pay for my LastPass subscription (after years on being on free tier), given the recent price changes. This made me change my mind - why a password manager, which I entrust with my personal passwords, notes and credit card info, needs to dial home to 7 different trackers is just beyond relief. I like LastPass because it works across my phone and multiple machines / browsers (I use Firefox). Can anyone please shed some light on good alternatives? I will happily pay for it.

buster 6y ago
KeepassXC plus some file sync tool works great for me across multiple devices (Android, Linux, Windows)
- hestefisk 6y ago
  iOS?
  - hanklazard 6y ago
    Last I checked, there were some third party iOS apps but the Bitwarden iOS app was far superior.
  - 40four 6y ago
    I have found KeePassium to be an excellent iOS KeePass client.
  - chewz 6y ago
    Strongbox is good on both iOS and macOS...
  - delogos 6y ago
    KyPass has been excellent for me for the last several years.
  - Fnoord 6y ago
    KeePass only officially works on Windows. All non-Windows versions are unofficial versions. See [1] for a list. [1] https://keepass.info/download.html https://keepass.info/download.html

stabbles 6y ago

password-store has 0: https://reports.exodus-privacy.eu.org/en/reports/dev.msfjarvis.aps/latest/ https://reports.exodus-privacy.eu.org/en/reports/dev.msfjarv... but it's commonly used with OpenKeyChain, which does have a tracker: https://reports.exodus-privacy.eu.org/en/reports/org.sufficientlysecure.keychain/latest/ https://reports.exodus-privacy.eu.org/en/reports/org.suffici...

Valodim 6y ago
The piwik in OpenKeychain is gone in the 5.6 release. And it was always opt-in, of course. In defense of trackers: knowing what features your users use and don't use is a huge deal to decide where to spend time on and where not. This doesn't cease to be true when software is open source. Giving users a simple way to give feedback of how they use the app is totally fair. Similar to how distros collect stats about installed packages, you wouldn't stop using Debian because it had an opt-in mechanism to send such stats upstream. That said, multiple trackers is ridiculous, and by multiple third parties no less. I can understand that the abuse of tracking due to blind optimization for profit leads users to adopt a "trackers are generally bad" stance, since more nuanced views quickly get complicated.

jafingi 6y ago

1Password for Android have 0 trackers. And 1/3 of the permissions needed.

jakub_g 6y ago

In other news, my banking app used to have 17 trackers (!) but they reduced to 6 some time ago (I pinged them about that, not sure if this was related but it's good to put some pressure on the businesses to let them know users care). https://reports.exodus-privacy.eu.org/en/reports/search/com.boursorama.android.clients/ https://reports.exodus-privacy.eu.org/en/reports/search/com.... BTW CrashLytics/Firebase Analytics are a de facto standard in every Android app if you want to roll out the new versions responsibly so I'm less worried about it than some random unknown company (though this cements the Google monopoly, so yeah it sucks).

SamuelAdams 6y ago

Does this still apply to the enterprise edition?

jeffrallen 6y ago

I chose LastPass, then it got sold to the current owners, so i switched to 1Password the next day, and I'm glad I did.

jerry1979 6y ago

I use Firefox as my password manager. Does Lastpass or Bitwarden have benefits that I am missing out on?

TeeWEE 6y ago

I moved to bitwarden. Their app / product is top notch. Actually easier to use than LastPass.

fx32s 6y ago

Reading the comments it almost seems that folks assume passwords are shared plain text with these trackers. I don't have any issue with Lastpass having anonymized logs of how often people visit which part of the app if it leads to improvements in usability.

danpalmer 6y ago
From a security standpoint this is kinda the point – we don't know what it's sharing and it has the ability to, so we have to assume it. Obviously it's unlikely, but through accident, ignorance, or malice, it's possible. I think for a security product the onus is on the author to show that this can't happen (not just that it doesn't), which means either not having trackers (easy) or somehow showing that trackers are isolated from the sensitive data (hard). This isn't uncommon. Apple have published a bunch about how they do iOS security, and it's quite clear that there's strong sandboxing between untrusted code and sensitive data, in some cases even enforced at the hardware level.
Fnoord 6y ago
> I don't have any issue with Lastpass having anonymized logs of how often people visit which part of the app if it leads to improvements in usability. I do. Some don't. Some do. So give the user the choice instead. I also wonder if this is even GDPR compliant...

imagine99 6y ago

We just moved a whole org over to Bitwarden anyway because of the way they threatened to hold free accounts hostage ("Pay us or you will not be able to access your password from mobile (or desktop) anymore"). We had previously actually planned to switch to a paid plan with them by July anyway (to nobody's surprise, management can be extremely slow to approve these things) - but their deadline was March and they way they forced our hand got management to act surprisingly quickly in transitioning us to Bitwarden. I wonder which, excuse me, brain-dead executive honestly thought waving a pistol in users' faces like an amateur highwayman to force them to pay was by any stretch of the imagination an acceptable way to improve user confidence, especially in such a sensitive area where they store (access to) your most personal and private secrets. The same holds true for these trackers. I mean, I see all these weird decisions and just ask myself, who are these people in positions of significant power of larger companies who make such obvious, crazy bad management decisions? Whenever I meet them, they all seem so normal and well-dressed ;-) Boggles my mind every time. I must say, for years now I've had the impression all the amazing products that LogMeIn (who own LastPass) touches, get toxic for the end-user quickly. Hamachi was so great in the olden days. GoToMeeting couldn't be rescued even by Covid. They had, at one point, one of the greatest remote desktop solutions around (which you could even completely self-host) but they were basically killed by TeamViewer because of their boneheaded licensing decisions. Of course, TeamViewer has been going down the same drain and has significantly killed mass appeal since their IPO, which leads me to believe that this is just the "circle of liiiive"...

danpalmer 6y ago
LogMeIn was bought a few years ago by a private equity company. The standard PE playbook is to buy things that are popular and stable but maybe not growing like this and then milk them for all they can, particularly in things that are hard to move away from (see Travis CI).
- troymc 6y ago
  I knew that LogMeIn had acquired LastPass, but I didn't know that private equity had gobbled up LogMeIn (which used to be publicly traded on the stock market). Apparently the private equity deal was only finalized in August of last year, see: [1] https://www.nasdaq.com/press-release/francisco-partners-and-evergreen-coast-capital-complete-acquisition-of-logmein-2020 https://www.nasdaq.com/press-release/francisco-partners-and-...

jgoyvaerts 6y ago

No serious user should still be using LastPass in 2021. On a previous project the company I joined used LastPass as their password solution, we had 2 root admins, me and a senior colleague. One day my senior colleague tries to log in to check/change a password and is unable to log in to his account. Account recovery/password lost doesn't work either. I log in to verify if his account is blocked or disabled in anyway, and I can't even find his account. The account was completely GONE. I checked the audit logs of the account (which should include user creation, deletion, logins, etc) and there is no mention of the account ever being deleted, it's like it never existed. We contacted their support but never got a serious reply to this behavior, so we moved over to 1Password the next day and never looked back. Stay away from LastPass, they just lose data out of nowhere and their support sucks.

gamesbrainiac 6y ago

This sucks. I decided to buy LastPass premium after having used it for many years. This makes me sad, because I cannot ask for a refund, and I am stuck with it for a year.

juancampa 6y ago

These specific trackers are not normally used for advertising or selling your data to third parties afaik. These trackers are used for fixing bugs and understanding how your users use the app so it can be improved.

imwillofficial 6y ago

RememBear is the unsung hero, awesome interface, apps for different platforms, and a bear who loves you. (Runner up is bitwarden, great price, great tech, great project, poor UI)

janoc 6y ago

I just don't get why people think that uploading all their passwords that are protecting some potentially extremely sensitive data to some random internet company is a good idea. And then wonder when they are being extorted ("you better subscribe and pay or else!"), datamined (article) or have their data stolen (LastPass was hacked before). People, stop giving these businesses the loaded guns to hold at your head! There are plenty of offline password managers that will do you equal or better service than this.

capableweb 6y ago
> There are plenty of offline password managers that will do you equal or better service than this That's cool, I didn't know that and I'm eager to hear of replacements. I regularly use 5+ devices, currently all via 1password and have about 3 family members including myself using 1password (so in total maybe 10 devices or something like that). None of us want to host a server by ourselves (as both time and security is of a concern there). What do you suggest we use in my household? Would have to work on Windows, Linux, macOS, Android, iPhone, web and unix terminals. It should be able to store passwords, photos, credit cards and also have browser extensions for Safari, Firefox and Chrome for making it easy to fill out. + if it has a password generator as well, but not required. Many thanks!
- janoc 6y ago
  I am using KeepassXC and keeping the encrypted password file in a Google Drive, shared across my devices. That would likely cover most of your use cases too (the file is locally cached so even if there is no network connection I am not screwed). For cases where you really can't use an offline password manager (e.g. because you are using some sort of gadget that doesn't allow you to connect to Google Drive or whatever), sync the relevant (not all!) passwords using your browser account. Why is the above better than your 1password, LastPass or something else? Well, I don't need to take the company at their word that they are properly encrypting the file and properly protecting it - I know it is because it has been encrypted locally by Keepass (easy to check, the source code is all available too). Google only ever gets to see a binary encrypted blob. And if I need to move to another service (e.g. I have been using Dropbox before), I simply move the file, that's all. No mess, no fuss. My data (especially passwords!) aren't held hostage anywhere.

crazygringo 6y ago

Why is this an issue? These aren't advertising trackers. They're not selling your data. They're name-brand, industry-standard product analytics, for measuring the usage of app features etc. They're for improving UX and the product generally. I mean, one of them is solely for crash reporting. This is zero privacy or security risk here. This is standard for essentially any commercial app. There is absolutely nothing unique or different or exceptional about LastPass here. And there is nothing about being a password manager that somehow makes this inappropriate. It's not like it's uploading your passwords to its analytics or anything. Seriously, this is just spreading FUD. I get that a lot of people hate LastPass for a lot of reasons, but this isn't a good reason.

capableweb 6y ago
First, who said it's an issue that you have to care about? People feel different things are issues. Not sure how facts are FUD. The submission here is saying "got 7 trackers in it" which are facts. What those trackers are tracking is irrelevant. They are tracking you and your usage, and get more information that way compared to if they only used backend tracking. "This is standard for essentially any commercial app" sounds more like FUD that this submission, as that statement is obviously easy to check if it's true or not. In this case, I don't think it's true, as many apps don't do client-side tracking. I made a quick check for one competitor of lastpass (1password - https://reports.exodus-privacy.eu.org/en/reports/com.agilebits.onepassword/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.agilebi...) and they have 0 trackers. 1password is commercial and pretty big at this point, so your statement is not necessarily true in all industries/usages.
- crazygringo 6y ago
  Of course facts aren't FUD. I'm responding to a lot of comments here which assume this is a bad thing, which I think is obviously why it's being upvoted as well. And I'm not sure you understand the term FUD. You're saying my comment spreads fear and uncertainty? It's literally the opposite, I'm saying this particular thing isn't something to worry about. Mobile apps aren't like webpages where most actions generate backend calls whose logs can be analyzed as an alternative. If 1password isn't using 3rd-party analytics, they probably rolled their own. No big difference. In any case, my point remains true -- client-side analytics is standard for essentially any commercial app, in order to improve the UX. There are exceptions of course, like for any rule, but it doesn't change the fact it's still standard.

manishsharan 6y ago

I actually liked LastPass and have been a long time paying customer. I just deleted my account. Trackers on a Password Manager -- what the fuck were they thinking ? I deleted my account to send a message to the Pointy headed bosses running LastPass that you can only squeeze a customer so much. Also -- aren't the people who use LastPass are by default privacy and security conscious and actually paying for added security and convenience? And the morons decided to violate our trust.

nonbirithm 6y ago

I'm not sure these trackers are the worst possible as they could be used for things like crash analytics. However, unrelated to this specific case, I believe that mobile apps could be the one place that adblocking cannot be guaranteed to work. When things get byte-compiled, you can no longer programmatically inspect the interface and remove malicious ads like with the browser's runtime. Imagine a future where a critical feature you have to use like banking is only available through a mobile app, and this is enforced through something like a certificate check. Then they run ads over it. DNS based blocking is not infallible either. Even today it does not work with the YouTube app, because their ads are served on the same domain as the content, so blocking one means blocking both. The only solution people have come up with is reverse engineering the official app's source code and releasing a modified version, a process that consumes far more time and effort than using something like uBlock. And this was only prioritized and accomplished because YouTube has become that important of a platform to enough people. If there's a future where our lives depend on compiled apps, will enough people go through the same effort to sanitize all of them?

rdudek 6y ago

For anyone moving away from LastPass, it's very easy to export all LastPass data into a CSV file and import it to other password managers. The hard part was deleting everything from LastPass as it only allows to select one item at a time.

segmondy 6y ago

Security != Privacy

jacobsenscott 6y ago

How many people are going to write all their passwords into a plain text csv file that will sit on their HD forever just to move to another password manager that might have even worse security because of this FUD. These are all standard analytics packages. I get it - if you want to minimize your contact with trackers you do you. But this is being marketed as some kind of scary security breach so people switch from one proprietary product to another.

penguin_booze 6y ago

I've already switched to BitWarden. One thing I really miss from their mobile app is the in-app browser that LastPass had. All my credential-requiring browsing can stay inside the app itself instead of my phone browser. Whereas now, I'd have to copy and paste them from BitWarden to my mobile browser.

syntaxing 6y ago
Same, I wish there was a BitWarden to Safari sync or something