6 ms·

Lastpass locked us out of our shared password database and want $750

20 points by what-imright 4y ago

Lastpass has locked us from exporting our company’s shared password database unless we pay them for another 6 month subscription ($750). We can’t even discuss this with support because they refuse to email, chat or call with us (they have no listed number) until we pay. They’re holding our own passwords as a ransom against us. HN what should we do?

superchroma 4y ago
I would presume that you were seeking to export passwords at the end of an existing subscription, and, maybe, you waited a little too long? Anyway, clicking on About Us takes one to the website for GoTo, who have a phone number on the top right. Maybe you want to try calling that number (1 866 890 8931) and seeing if you can get some help by speaking to a person there?
dotcoma 4y ago
Great business model! ;(
db48x 4y ago
Small claims court. Why is this so hard?
- WheelsAtLarge 4y ago
  It's iffy and it would take a few months to resolve plus company time and resources. It sucks but it's way easier to pay the $750 and they know it.
  - Brian_K_White 4y ago
    They'd lose because they have no case. I do not recommend anyone ever use lastpass or 1password, so I am absolutely no fan or apologist, but this is not a case of them doing anything wrong. This story doesn't deserve any attention at all.
  - db48x 4y ago
    No, you pay the $750, export your data, then sue them to get your money back. In order to win you have to prove that you were damaged, and the easiest way to prove it is to present a receipt. Yes, filing the case costs a little money, and then you have to waste a day of your time at the courthouse, but afterwards you will have your money back, including court costs. Most importantly, however, is that the sting of it might actually get them to change their behavior. The ideal outcome would be that they don’t appear in court, you get a default judgement, they ignore your written request to pay it, and then you visit their office with a sheriff and a local reporter or two to either get them to write a check or to seize some furniture. How many times do you think the CEO would be willing to read those news stories (and risk losing his own office furniture, because obviously you would start there) before they decide to let people sign into their expired accounts to export their passwords? It’s not really about the money, it’s about forcing them to do the right thing.
    - what-imright 4y ago
      I think it shows that they’re aware their business model will fail soon to free and open source options, so they’re milking their remaining customers. Burning your users like this is a one way function
    - WheelsAtLarge 4y ago
      True, you have to show damages before you can sue. I see your point but it's still a pain to deal with. Hard to be a crusader.
awill88 4y ago
I want to side with both here, personally that sucks, professionally, what’s happening over there? Paying the bill shouldn’t be a second thought, understanding how it got to that point afterwards is what’s important. That company can’t be held liable for establishing a boundary that there is valuable material in storage they pay for that you happen to rent from them. This post oozes of superficiality and I absolutely loath[e] LastPass, but in this case, I’m on their side. But yeah, that sucks!
- what-imright 4y ago
  What’s outrageous is how they only hold 30 shared passwords but somehow billed us $1500 a year to use a browser plugin to serve 20 kilobytes of data to 12 people.
  - moritonal 4y ago
    You choose to use Laspass rather than any of the free solutions because of its ease. Your problem is you gave 30 critical pieces of information to a third-party without any backup solution.
    - what-imright 4y ago
      Yes, it is our fault for trusting them ultimately. Agreed
      - hampereddustbin 4y ago
        I'm not quite sure I understand, isn't there a written contract you sign that states exactly what you get for N amount of money? Paying extra because of insufficient planning sucks, but is the price of such luxury. Think of the bright side; it's a good thing this bit your company at this early stage and not with half a million dollar contracts.
        psychphysic 4y ago
        Cheap lesson as corporate lessons go.
scottydelta 4y ago
Being able to export data out from any service should be independent of the subscription status for any product IMO. It becomes even more crucial for services like password managers.
cbanek 4y ago
If you think you can win, yeah small claims court is where to go. You don't need a lawyer for it I don't think, and many places they won't allow the other side to have a lawyer either. I don't know how it would work with Lastpass though, since it's a company, and I don't know how that works in small claims court as most times those are just between people (like renters and landlords). Since it's <$5000 I think small claims court is the only place you can go? It takes more money to end up in a larger court, like if you had damages and asked for $1m. It seems pretty shitty, but if you missed your deadline and the contract says that you can't get to it, then you can't get to it. But fight it anyway. I wouldn't call it a ransom though, they're asking for payment, and they may be right or not, depending on the terms. Good luck.
xSxY3fj5gVCmvWE 4y ago
Pay, export, chargeback, and tell them that they can discuss this with your support department if they don't like it. (But don't give them the contact details, obviously.) I recommend Bitwarden by the way.
blacklight 4y ago
I hope that you manage to solve the situation soon. Once you do, please consider self-hosting Bitwarden. A password manager is a simple product that anybody can self-host: don't pay LastPass money to manage your passwords and them hold them in ransom.
senectus1 4y ago
pay them then get out of the product. you dont have any other answer that would be anywhere near as close to a win.
JacobSeated 4y ago
Migrate to Keepass and a private cloud share, like Nextcloud. Do not ever rely on proprietary solutions for key infrastructure.
- what-imright 4y ago
  I’ve actually setup KeePassXC with the database file on a Syncthing share and it works perfectly. In fact it’s simpler than Lastpass their GUI is a mess, and more secure, and auto backups and works with every browser and updates in realtime. But I need those passwords to free us from Lastpass.
kramerger 4y ago
Can't you switch to a different plan (i.e. a team of one user), export the data and get the hell out of there? Still a few dollars wasted, but $5-10 is much better than $750.
- what-imright 4y ago
  You can’t no. It’s a set up
lelanthran 4y ago
This doesn't sound like Ransom. It sounds like you misunderstood your contract; you only have access while you have a subscription. Was this fact not made clear when you took the subscription? Because if this wasn't a condition when you bought the subscription (it was only added on after you paid) then you have some legal remedies. If it was a condition when you subscribed, then you cannot really complain, can you? You saw the conditions, you agreed to them, and now you want to retroactively withdraw your agreement.
- what-imright 4y ago
  Really? Do you read the 40 page small print for any service you use? On every cloud service it says we can do whatever we want without liability, then establishes you can’t sue - arbitration only and then says take it or leave it
  - dismantlethesun 4y ago
    Isn’t it baked into the concept of a subscription service that you can only use it while you have an active subscription? I don’t think that’s fine print.
  - lelanthran 4y ago
    > Really? Do you read the 40 page small print for any service you use? On every cloud service it says we can do whatever we want without liability, then establishes you can’t sue - arbitration only and then says take it or leave it Yes, really! It's called contracts - don't sign it until you read it[1]. The whole point behind a subscription is that you only get to enjoy the product while you are subscribed. I very much doubt that the fine-print said anything along the lines of "some functionality is available after subscription ends". Now let's be fair, you work for a company. Presumably, your company makes money by selling its products. Do you really think it is reasonable that someone who purchased your product, and who agreed to the terms of purchase (price, warrantee, etc) should be able to later retroactively withdraw their agreement? Did you actually put something like that - "Customer is free to change their mind any time after purchase and we will agree to continue providing service and/or product" - into your purchase agreement? Do you allow your ex-customers to get more product for free because at some time in the past they were customers? In all other business dealings, do you expect to make the other party whole just because the other party felt that it was too onerous to read the contract you provided? If you feel that people should not be held to the contracts they signed, why bother making them sign? I feel for you, but this is all self-inflicted; agreeing to something and then complaining that the other party is adhering to the terms of the agreement is a a very unprofessional way to behave. [1] I don't think you were given a 40 page contract to peruse; this is the actual contract you agreed to : https://www.lastpass.com/legal-center/terms-of-service/business https://www.lastpass.com/legal-center/terms-of-service/busin.... It's 12 pages of large font. The section about Fees, billing, etc is on the SECOND page, with an extra large heading of "Orders, Fees and Payment".
gazoakley 4y ago
That's pretty awful on Lastpass's behalf. 1Password does this much better - your account is frozen in such that you can't add new passwords or make changes, but you can still read your data: https://support.1password.com/frozen-account/ https://support.1password.com/frozen-account/
deleted 4y ago
[deleted]
watha2020 4y ago
I'm a journalist and I would like to know more. Please email me at bray@globe.com. Thanks. Hiawatha Bray Boston Globe
reliantsceptre 4y ago
Wow, does this ever sound familiar! We just went through something very similar, and getting in touch with someone capable of providing assistance is nearly impossible. Took us three weeks of constant emailing and calling to finally get our situation squared away (and we were simply trying to renew!!)
arbitrix 4y ago
Passwords are data and data needs to be backed up. So here we have someone who doesn't keep backups, who didn't read the contract, and who didn't keep track of the subscription expiration date complaining about a completely self inflicted problem.

20 points by what-imright 4y ago

superchroma 4y ago

I would presume that you were seeking to export passwords at the end of an existing subscription, and, maybe, you waited a little too long? Anyway, clicking on About Us takes one to the website for GoTo, who have a phone number on the top right. Maybe you want to try calling that number (1 866 890 8931) and seeing if you can get some help by speaking to a person there?

dotcoma 4y ago

Great business model! ;(

db48x 4y ago

Small claims court. Why is this so hard?

WheelsAtLarge 4y ago
It's iffy and it would take a few months to resolve plus company time and resources. It sucks but it's way easier to pay the $750 and they know it.
- Brian_K_White 4y ago
  They'd lose because they have no case. I do not recommend anyone ever use lastpass or 1password, so I am absolutely no fan or apologist, but this is not a case of them doing anything wrong. This story doesn't deserve any attention at all.
- db48x 4y ago
  No, you pay the $750, export your data, then sue them to get your money back. In order to win you have to prove that you were damaged, and the easiest way to prove it is to present a receipt. Yes, filing the case costs a little money, and then you have to waste a day of your time at the courthouse, but afterwards you will have your money back, including court costs. Most importantly, however, is that the sting of it might actually get them to change their behavior. The ideal outcome would be that they don’t appear in court, you get a default judgement, they ignore your written request to pay it, and then you visit their office with a sheriff and a local reporter or two to either get them to write a check or to seize some furniture. How many times do you think the CEO would be willing to read those news stories (and risk losing his own office furniture, because obviously you would start there) before they decide to let people sign into their expired accounts to export their passwords? It’s not really about the money, it’s about forcing them to do the right thing.
  - what-imright 4y ago
    I think it shows that they’re aware their business model will fail soon to free and open source options, so they’re milking their remaining customers. Burning your users like this is a one way function
  - WheelsAtLarge 4y ago
    True, you have to show damages before you can sue. I see your point but it's still a pain to deal with. Hard to be a crusader.

awill88 4y ago

I want to side with both here, personally that sucks, professionally, what’s happening over there? Paying the bill shouldn’t be a second thought, understanding how it got to that point afterwards is what’s important. That company can’t be held liable for establishing a boundary that there is valuable material in storage they pay for that you happen to rent from them. This post oozes of superficiality and I absolutely loath[e] LastPass, but in this case, I’m on their side. But yeah, that sucks!

what-imright 4y ago
What’s outrageous is how they only hold 30 shared passwords but somehow billed us $1500 a year to use a browser plugin to serve 20 kilobytes of data to 12 people.
- moritonal 4y ago
  You choose to use Laspass rather than any of the free solutions because of its ease. Your problem is you gave 30 critical pieces of information to a third-party without any backup solution.
  - what-imright 4y ago
    Yes, it is our fault for trusting them ultimately. Agreed
    - hampereddustbin 4y ago
      I'm not quite sure I understand, isn't there a written contract you sign that states exactly what you get for N amount of money? Paying extra because of insufficient planning sucks, but is the price of such luxury. Think of the bright side; it's a good thing this bit your company at this early stage and not with half a million dollar contracts.
      - psychphysic 4y ago
        Cheap lesson as corporate lessons go.

scottydelta 4y ago

Being able to export data out from any service should be independent of the subscription status for any product IMO. It becomes even more crucial for services like password managers.

cbanek 4y ago

If you think you can win, yeah small claims court is where to go. You don't need a lawyer for it I don't think, and many places they won't allow the other side to have a lawyer either. I don't know how it would work with Lastpass though, since it's a company, and I don't know how that works in small claims court as most times those are just between people (like renters and landlords). Since it's <$5000 I think small claims court is the only place you can go? It takes more money to end up in a larger court, like if you had damages and asked for $1m. It seems pretty shitty, but if you missed your deadline and the contract says that you can't get to it, then you can't get to it. But fight it anyway. I wouldn't call it a ransom though, they're asking for payment, and they may be right or not, depending on the terms. Good luck.

xSxY3fj5gVCmvWE 4y ago

Pay, export, chargeback, and tell them that they can discuss this with your support department if they don't like it. (But don't give them the contact details, obviously.) I recommend Bitwarden by the way.

blacklight 4y ago

I hope that you manage to solve the situation soon. Once you do, please consider self-hosting Bitwarden. A password manager is a simple product that anybody can self-host: don't pay LastPass money to manage your passwords and them hold them in ransom.

senectus1 4y ago

pay them then get out of the product. you dont have any other answer that would be anywhere near as close to a win.

JacobSeated 4y ago

Migrate to Keepass and a private cloud share, like Nextcloud. Do not ever rely on proprietary solutions for key infrastructure.

what-imright 4y ago
I’ve actually setup KeePassXC with the database file on a Syncthing share and it works perfectly. In fact it’s simpler than Lastpass their GUI is a mess, and more secure, and auto backups and works with every browser and updates in realtime. But I need those passwords to free us from Lastpass.

kramerger 4y ago

Can't you switch to a different plan (i.e. a team of one user), export the data and get the hell out of there? Still a few dollars wasted, but $5-10 is much better than $750.

what-imright 4y ago
You can’t no. It’s a set up

lelanthran 4y ago

This doesn't sound like Ransom. It sounds like you misunderstood your contract; you only have access while you have a subscription. Was this fact not made clear when you took the subscription? Because if this wasn't a condition when you bought the subscription (it was only added on after you paid) then you have some legal remedies. If it was a condition when you subscribed, then you cannot really complain, can you? You saw the conditions, you agreed to them, and now you want to retroactively withdraw your agreement.

what-imright 4y ago
Really? Do you read the 40 page small print for any service you use? On every cloud service it says we can do whatever we want without liability, then establishes you can’t sue - arbitration only and then says take it or leave it
- dismantlethesun 4y ago
  Isn’t it baked into the concept of a subscription service that you can only use it while you have an active subscription? I don’t think that’s fine print.
- lelanthran 4y ago
  > Really? Do you read the 40 page small print for any service you use? On every cloud service it says we can do whatever we want without liability, then establishes you can’t sue - arbitration only and then says take it or leave it Yes, really! It's called contracts - don't sign it until you read it[1]. The whole point behind a subscription is that you only get to enjoy the product while you are subscribed. I very much doubt that the fine-print said anything along the lines of "some functionality is available after subscription ends". Now let's be fair, you work for a company. Presumably, your company makes money by selling its products. Do you really think it is reasonable that someone who purchased your product, and who agreed to the terms of purchase (price, warrantee, etc) should be able to later retroactively withdraw their agreement? Did you actually put something like that - "Customer is free to change their mind any time after purchase and we will agree to continue providing service and/or product" - into your purchase agreement? Do you allow your ex-customers to get more product for free because at some time in the past they were customers? In all other business dealings, do you expect to make the other party whole just because the other party felt that it was too onerous to read the contract you provided? If you feel that people should not be held to the contracts they signed, why bother making them sign? I feel for you, but this is all self-inflicted; agreeing to something and then complaining that the other party is adhering to the terms of the agreement is a a very unprofessional way to behave. [1] I don't think you were given a 40 page contract to peruse; this is the actual contract you agreed to : https://www.lastpass.com/legal-center/terms-of-service/business https://www.lastpass.com/legal-center/terms-of-service/busin.... It's 12 pages of large font. The section about Fees, billing, etc is on the SECOND page, with an extra large heading of "Orders, Fees and Payment".

gazoakley 4y ago

That's pretty awful on Lastpass's behalf. 1Password does this much better - your account is frozen in such that you can't add new passwords or make changes, but you can still read your data: https://support.1password.com/frozen-account/ https://support.1password.com/frozen-account/

deleted 4y ago

[deleted]

watha2020 4y ago

I'm a journalist and I would like to know more. Please email me at bray@globe.com. Thanks. Hiawatha Bray Boston Globe

reliantsceptre 4y ago

Wow, does this ever sound familiar! We just went through something very similar, and getting in touch with someone capable of providing assistance is nearly impossible. Took us three weeks of constant emailing and calling to finally get our situation squared away (and we were simply trying to renew!!)

arbitrix 4y ago

Passwords are data and data needs to be backed up. So here we have someone who doesn't keep backups, who didn't read the contract, and who didn't keep track of the subscription expiration date complaining about a completely self inflicted problem.