3 ms·

The MtGox breach inspired me to switch to LastPass. I used to do what you did, and MtGox was part of my "medium security" tier. Now, I've decided that there i

The MtGox breach inspired me to switch to LastPass. I used to do what you did, and MtGox was part of my "medium security" tier. Now, I've decided that there is no real effective solution other than randomly generated passwords unique to each site. I also turned on 2-factor auth for Gmail a couple months ago - their SMS system is really effective. I do have to credit Google for being extremely awesome when it comes to security... They noticed a few "your password has been changed" emails incoming to my inbox yesterday and immediately put a security flag on my account, requiring me to re-auth with 2-factor and change my password. Google is really proactive when it comes to security. The fact that they can recognize a high number of password change emails arriving as an indicator of possibly account hijacking is just amazing. I think LastPass is probably as good of a solution as any. They only store your encrypted password database in the cloud. With a strong enough master password and optional 2-factor authentication with Yubikey, it seems quite secure.

TheEskimo 15y ago
My reason for not using LastPass is because it is proprietary. In fact, there has been an XSS attack on them in the past which was somewhat successful. I use KeePassX because it allows me to avoid laying trust on any proprietary entity. At present if LastPass were to have another security flaw (and hey, security flaws on web-facing servers are all too common) you'd be out of luck. With KeePassX security is local. The worst case for me is someone stealing my database and trying to bruteforce the password (hah, like that'll happen). This requires them to have physical access to my computer. Anyone can take a guess at your password because it's a web based service.
- illumin8 15y ago
  KeePassX is still vulnerable to a keylogger on your local machine. LastPass with 2-factor auth should be more secure than KeePassX, however, your point about it being proprietary is well taken. I also think LastPass has a very good reputation for full disclosure - when the salted hashes of master passwords were compromised in 2010 it was very refreshing to see the CEO come forward and give immediate full disclosure to the public about the implications, and why you should change your master password. I also find it refreshing that if you have a strong master password, even someone compromising their entire database should not give you reason to worry - it would be similar to someone getting a copy of your KeePassX database - it's still encrypted with high-grade encryption.
Strom 15y ago
_The fact that they can recognize a high number of password change emails arriving as an indicator_ They do not. Mt. Gox contacted google and gave them all the gmail accounts that were leaked.

TheEskimo 15y ago

My reason for not using LastPass is because it is proprietary. In fact, there has been an XSS attack on them in the past which was somewhat successful. I use KeePassX because it allows me to avoid laying trust on any proprietary entity. At present if LastPass were to have another security flaw (and hey, security flaws on web-facing servers are all too common) you'd be out of luck. With KeePassX security is local. The worst case for me is someone stealing my database and trying to bruteforce the password (hah, like that'll happen). This requires them to have physical access to my computer. Anyone can take a guess at your password because it's a web based service.

illumin8 15y ago
KeePassX is still vulnerable to a keylogger on your local machine. LastPass with 2-factor auth should be more secure than KeePassX, however, your point about it being proprietary is well taken. I also think LastPass has a very good reputation for full disclosure - when the salted hashes of master passwords were compromised in 2010 it was very refreshing to see the CEO come forward and give immediate full disclosure to the public about the implications, and why you should change your master password. I also find it refreshing that if you have a strong master password, even someone compromising their entire database should not give you reason to worry - it would be similar to someone getting a copy of your KeePassX database - it's still encrypted with high-grade encryption.

Strom 15y ago

_The fact that they can recognize a high number of password change emails arriving as an indicator_ They do not. Mt. Gox contacted google and gave them all the gmail accounts that were leaked.