4 ms·

Why migrate? It seems like there isnt a problem with Lastpass itself. Apart from that: bitwarden.

tmikaeld 5y ago
There’s two options: 1. they found the breach and patched it, lies about it to save face. 2. there was no breach Even if it’s option two, would you want to gamble on it?
- jamespo 5y ago
  Because most users will have an inferior setup to Lastpass
  - willis936 5y ago
    Most of the effort is in moving off an insecure set of passwords. The details of the solution don't add much incremental effort. Why not do it the right way and avoid trusting a company with an awful track record? Everyone I know has a google account and a smartphone, and by extension access to google drive for cloud backup/sync of a keepass database. Lastpass cannot justify its existence.
- londons_explore 5y ago
  Option 3:. There was a breach, but lastpass didn't keep enough logs to know that anything went wrong.
- NikolaNovak 5y ago
  Me as a still somewhat techie individual? No, keepass works just fine. But you have to realistically consider what are actual alternatives. For everybody else in my family, it's not lastpass vs some cryptographycally excellent local solution. It's last pass or 1password as uphill battle vs same password of your cats name over all of your accounts. Shared by your family members. My sister in law doesn't even have to wonder what her mom's utility or bank password is - they all literally use their old dead cat's name. For everything. So moving them to Lastpass or 1password with differentiated passwords has been my life's mission for past several years. they are the norm. Average HN poster is empathically not :-/
ThePinion 5y ago
After looking for self hosted password managers off and on for over a year I finally started hosting my own BitWarden instance (have had it for half a year or so now) and I absolutely love it. I can't believe I went so long without a password manager but it seemed against the point to have the passwords given to and hosted by someone else. Highly recommended!
- Daedren 5y ago
  Just don't forget your backups when selfhosting, especially offsite. And don't forget to test them regularly.
  - dspillett 5y ago
    > especially offsite And offline¹ or immutable². Some automated ransomware actively goes after common backups³ before touching the base data, more targetted attacks will too. [1] If part of your threat model is security, not just accidental loss/damage, as it should be for everyone, this stops an attacker jumping from your base system to get at your backups. [2] Alternatively, this will stop them modifying your backups even if they get access. Cloud providers offer what is claimed to be immutable storage, though your level of trust in them, your sensitivity to cost, and the likelihood you might someday want to properly forget something, will factor in to whether this is suitable. [3] One reference amongst many: https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love https://www.advintel.io/post/backup-removal-solutions-from-c... > And don't forget to test them regularly. A vital step that too many people skip. Or for advanced failure patterns: setting up automated tests that don't fail safe (does no alert mean all is OK, or does it mean the alert system has failed too?) and/or not monitoring to make sure that they are working.

There’s two options: 1. they found the breach and patched it, lies about it to save face. 2. there was no breach Even if it’s option two, would you want to gamble on it?

jamespo 5y ago
Because most users will have an inferior setup to Lastpass
- willis936 5y ago
  Most of the effort is in moving off an insecure set of passwords. The details of the solution don't add much incremental effort. Why not do it the right way and avoid trusting a company with an awful track record? Everyone I know has a google account and a smartphone, and by extension access to google drive for cloud backup/sync of a keepass database. Lastpass cannot justify its existence.
londons_explore 5y ago
Option 3:. There was a breach, but lastpass didn't keep enough logs to know that anything went wrong.
NikolaNovak 5y ago
Me as a still somewhat techie individual? No, keepass works just fine. But you have to realistically consider what are actual alternatives. For everybody else in my family, it's not lastpass vs some cryptographycally excellent local solution. It's last pass or 1password as uphill battle vs same password of your cats name over all of your accounts. Shared by your family members. My sister in law doesn't even have to wonder what her mom's utility or bank password is - they all literally use their old dead cat's name. For everything. So moving them to Lastpass or 1password with differentiated passwords has been my life's mission for past several years. they are the norm. Average HN poster is empathically not :-/

ThePinion 5y ago

After looking for self hosted password managers off and on for over a year I finally started hosting my own BitWarden instance (have had it for half a year or so now) and I absolutely love it. I can't believe I went so long without a password manager but it seemed against the point to have the passwords given to and hosted by someone else. Highly recommended!

Daedren 5y ago
Just don't forget your backups when selfhosting, especially offsite. And don't forget to test them regularly.
- dspillett 5y ago
  > especially offsite And offline¹ or immutable². Some automated ransomware actively goes after common backups³ before touching the base data, more targetted attacks will too. [1] If part of your threat model is security, not just accidental loss/damage, as it should be for everyone, this stops an attacker jumping from your base system to get at your backups. [2] Alternatively, this will stop them modifying your backups even if they get access. Cloud providers offer what is claimed to be immutable storage, though your level of trust in them, your sensitivity to cost, and the likelihood you might someday want to properly forget something, will factor in to whether this is suitable. [3] One reference amongst many: https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love https://www.advintel.io/post/backup-removal-solutions-from-c... > And don't forget to test them regularly. A vital step that too many people skip. Or for advanced failure patterns: setting up automated tests that don't fail safe (does no alert mean all is OK, or does it mean the alert system has failed too?) and/or not monitoring to make sure that they are working.