3 ms·

I use LastPass. I love that it has a mobile app for me to copy/paste on my phone and my wife's phone. It has a really good browser extension. I do pay the small

I use LastPass. I love that it has a mobile app for me to copy/paste on my phone and my wife's phone. It has a really good browser extension. I do pay the small fee for multiple devices.

computershit 5y ago
A few HN posts from the last week regarding LastPass: Ask HN: How did my LastPass master password get leaked?: https://news.ycombinator.com/item?id=29716715 https://news.ycombinator.com/item?id=29716715 LastPass users warned their master passwords are compromised: https://news.ycombinator.com/item?id=29716715 https://news.ycombinator.com/item?id=29716715
- basseq 5y ago
  Note that master passwords were not compromised, the the warnings were triggered in error[1]. That's not to say that other concerns around security aren't valid. [1] https://www.theverge.com/2021/12/28/22857485/lastpass-compromised-breach-scare https://www.theverge.com/2021/12/28/22857485/lastpass-compro...
  - computershit 5y ago
    The warnings might have been triggered in error, but the evidence is certainly there for masters to have been compromised. Until recently their publicly available support forum running phpBB was using the master password for customer logins.[1] [1] https://news.ycombinator.com/item?id=29706579 https://news.ycombinator.com/item?id=29706579
    - basseq 5y ago
      I'm trying to differentiate between "there has been evidence of a breach" and "there are less-desirable security practices". As I understand it, the phpBB / master password practices—which are indeed, not good, but also not fully understood exactly how they did it—are also not evidence that the masters have been compromised. Again, that it could be an attack vector is interesting and relevant, but different from "has been breached" per OP.
basseq 5y ago
Another vote for LastPass, though I haven't cross-shopped in a while. It generally "works", including on iOS. (You can enable auto-fill directly in Mobile Safari in Setting > Passwords > AutoFill, so I rarely have to open the app anymore.) Chrome extension experience on desktop is similarly "fine". The LastPass app itself is just "ok" from a UI perspective, but again, I use that part rarely.

I use LastPass. I love that it has a mobile app for me to copy/paste on my phone and my wife's phone. It has a really good browser extension. I do pay the small fee for multiple devices.

computershit 5y ago

A few HN posts from the last week regarding LastPass: Ask HN: How did my LastPass master password get leaked?: https://news.ycombinator.com/item?id=29716715 https://news.ycombinator.com/item?id=29716715 LastPass users warned their master passwords are compromised: https://news.ycombinator.com/item?id=29716715 https://news.ycombinator.com/item?id=29716715

basseq 5y ago
Note that master passwords were not compromised, the the warnings were triggered in error[1]. That's not to say that other concerns around security aren't valid. [1] https://www.theverge.com/2021/12/28/22857485/lastpass-compromised-breach-scare https://www.theverge.com/2021/12/28/22857485/lastpass-compro...
- computershit 5y ago
  The warnings might have been triggered in error, but the evidence is certainly there for masters to have been compromised. Until recently their publicly available support forum running phpBB was using the master password for customer logins.[1] [1] https://news.ycombinator.com/item?id=29706579 https://news.ycombinator.com/item?id=29706579
  - basseq 5y ago
    I'm trying to differentiate between "there has been evidence of a breach" and "there are less-desirable security practices". As I understand it, the phpBB / master password practices—which are indeed, not good, but also not fully understood exactly how they did it—are also not evidence that the masters have been compromised. Again, that it could be an attack vector is interesting and relevant, but different from "has been breached" per OP.

basseq 5y ago

Another vote for LastPass, though I haven't cross-shopped in a while. It generally "works", including on iOS. (You can enable auto-fill directly in Mobile Safari in Setting > Passwords > AutoFill, so I rarely have to open the app anymore.) Chrome extension experience on desktop is similarly "fine". The LastPass app itself is just "ok" from a UI perspective, but again, I use that part rarely.