3 ms·

related: Ask HN: How did my LastPass master password get leaked? https://news.ycombinator.com/item?id=29705957 https://news.ycombinator.com/item?id=29705957

Barrin92 5y ago
all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here) https://news.ycombinator.com/item?id=27407603 https://news.ycombinator.com/item?id=27407603
- gruez 5y ago
  Seems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?
  - tim333 5y ago
    Some guy did an long analysis and figured for most purposes you are as well to use the built in ones in Chrome or Firefox. Personally I kind of like Bitwarden.
  - denton-scratch 5y ago
    I'm not inclined to run anything that's remotely related to password security in a browser extension (I do use the Firefox built-in password manager to simplify logging in to sites like this one, where I have no money at stake and nothing much to lose but my pride). For high-value logins, I use Passwordsafe. It's annoying; the scroll behaviour is annoying, and it's Windows-only, which is sad. But it's resolutely local and un-networked, and I'm confident that my secrets are well-protected by my (complex, long, memorized) master password.
    - mbordenet 5y ago
      Assuming you're talking about pwsafe 3, it's not Windows-only. I am actively using a Java implementation on MacOS and rely on my Android app for frequent use. Password file is synced across devices via a cloud drive provider. Works great, and I'm in control. (I also rotate my password file + master password every few months.)
  - boring_twenties 5y ago
    Why not the one built in to the browser?
- CyberRage 5y ago
  It doesn't compromise the master-password and is not wide-reaching as it requires the victim to be lured to a specific website. Doesn't match what people claim here

Barrin92 5y ago

all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here) https://news.ycombinator.com/item?id=27407603 https://news.ycombinator.com/item?id=27407603

gruez 5y ago
Seems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?
- tim333 5y ago
  Some guy did an long analysis and figured for most purposes you are as well to use the built in ones in Chrome or Firefox. Personally I kind of like Bitwarden.
- denton-scratch 5y ago
  I'm not inclined to run anything that's remotely related to password security in a browser extension (I do use the Firefox built-in password manager to simplify logging in to sites like this one, where I have no money at stake and nothing much to lose but my pride). For high-value logins, I use Passwordsafe. It's annoying; the scroll behaviour is annoying, and it's Windows-only, which is sad. But it's resolutely local and un-networked, and I'm confident that my secrets are well-protected by my (complex, long, memorized) master password.
  - mbordenet 5y ago
    Assuming you're talking about pwsafe 3, it's not Windows-only. I am actively using a Java implementation on MacOS and rely on my Android app for frequent use. Password file is synced across devices via a cloud drive provider. Works great, and I'm in control. (I also rotate my password file + master password every few months.)
- boring_twenties 5y ago
  Why not the one built in to the browser?
CyberRage 5y ago
It doesn't compromise the master-password and is not wide-reaching as it requires the victim to be lured to a specific website. Doesn't match what people claim here