3 ms·

LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastpass-breach-by

LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastpass-breach-by-the-numbers-91-enterprises-exposed/ https://www.mcafee.com/blogs/enterprise/cloud-security/lastp... Unfortunately the only password solutions I would recommend at this point are 1Password for something turn key, and BitWarden if you want to self host.

gkoberger 5y ago
Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.
- vorpalhex 5y ago
  The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming. There could be some malware targeting a LastPass extension or app cache somewhere, but that is groundless theory on my part.
  - tgsovlerkhgsel 5y ago
    > Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. As you mention yourself at the end, there are other plausible explanations (e.g. malware on the machines).
    - vorpalhex 5y ago
      If there is a LastPass cache that is not encrypted, that is a breach since it is an application flaw. If it is something like a keylogger, not so much.
      - dqv 5y ago
        The LastPass extension can be told to remember your master password. They say it's not recommended. We might be seeing the result of people opting to store their master password and something that exploits this.
karmanyaahm 5y ago
Bitwarden also has an easy to use hosted service
3np 5y ago
password-store aka GNU Pass, couple with your file-sync software of choice (your choice if you want to self-host or cloud).

gkoberger 5y ago

Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.

vorpalhex 5y ago
The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming. There could be some malware targeting a LastPass extension or app cache somewhere, but that is groundless theory on my part.
- tgsovlerkhgsel 5y ago
  > Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. As you mention yourself at the end, there are other plausible explanations (e.g. malware on the machines).
  - vorpalhex 5y ago
    If there is a LastPass cache that is not encrypted, that is a breach since it is an application flaw. If it is something like a keylogger, not so much.
    - dqv 5y ago
      The LastPass extension can be told to remember your master password. They say it's not recommended. We might be seeing the result of people opting to store their master password and something that exploits this.

karmanyaahm 5y ago

Bitwarden also has an easy to use hosted service

3np 5y ago

password-store aka GNU Pass, couple with your file-sync software of choice (your choice if you want to self-host or cloud).