3 ms·

> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't pro

> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.

deleted 4y ago
[deleted]
snailmailman 4y ago
How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.
- celestialcheese 4y ago
  It's easy if you don't share passwords with others. I have my whole family and business using it, and there's lots of shared folders. Convincing my wife and colleagues to all switch simultaneously isn't feasible unless this data fiasco gets worse.
  - neurostimulant 4y ago
    It'll only going to get worse. Better move now before it's too late.
- ragingroosevelt 4y ago
  I tried migrating from LP to BW and got import errors. Bitwarden's error message was very vague (along the lines of "sorry, something went wrong") and I haven't been able to track down what entries were causing the issue. I've tried 3 or 4 times including trying to reproduce with subsets of the full collection but it's too much of a pain with hundreds of accounts and I so far haven't been motivated enough to manually transfer them or to write a selenium script to do it automatically.
- archi42 4y ago
  Moving to vaultwarden (the open bitwarden server implementation) was also really easy. Just installed the package in Arch, setup the vhost in nginx, put the vhost into my local DNS and slightly adjusted the vaultwarden config file. Now I use bitwarden clients everywhere and point them to my server. Since I don't feel 100% comfortable having my self hosted things on a public IP, I put it only on my LAN. For remote access (e.g. phone) I use wireguard.
- greenicon 4y ago
  Just check your data after re-importing the passwords. LastPass sometimes has issues with the export (see elsewhere in this thread) and does not export attachments at all. You have to move attachments manually.
- eviks 4y ago
  You can't export all the passwords, some extra fields are not exported by LastPass, so there is your PITA when some site asks a security question you had an answer to in that unexported field
musk_micropenis 4y ago
> If it wasn't such a PITA to move off LastPass, It's really not. As the quality of their software declined severely starting around 4-5 years ago, I put off moving because I assumed it would be a huge hassle. It turned out to be surprisingly easy. I have since deleted my LastPass account and wouldn't trust that company to mop my floors.
- davnn 4y ago
  I don‘t think the quality of the product was any better previously; they were the first to offer cloud hosted password management as far as I remember and that, plus being cheaper than 1Password last time I compared, are their only benefits in my opinion.
skittleson 4y ago
I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.
- rkagerer 4y ago
  How smooth is the hotkey autofill experience? Does it identify websites and fill out login forms properly? (I prefer not to rely on sites' "remember me" boxes or ephemeral cookies). Any compatible Android app?
  - rd07 4y ago
    In Android, I use Keepass2Android Password Safe app by Philip Crocol. As far as my experience goes, it is quite smooth and for the most part it is able to fill out the login form properly.
  - theaudacityofyw 4y ago
    I can't speak for any browser integration but I use the app's autofill and it works great. Several, I personally like KeePassDX but Keepass2android is also there, possibly others I don't know about.
  - brokenmachine 4y ago
    I'm using keepass2android offline on Android, with the password file synced using syncthing. Works great. It also has autofill that comes up in any supported app when it recognizes a password field that it can autofill. Quite seamless. It also took a little mucking around to install it's custom keyboard and I had to run some adb command to give it permission to auto-switch keyboards, but now it's setup it's pretty good. You can open an entry in keepass2android, then it will auto-activate the keyboard and you get buttons so you can auto-type any field from that entry into anything. On Windows I'm using KeepassXC and the KeepassXC browser extension. It hasn't been perfect, I had to manually enable simple http auth for that to work, and sometimes it seems to miss login fields. Also I had to manually add the URL for some existing sites (I was using KeePassDroid only on Android before so the URL entries weren't filled). There's no way I could find to go to a site, then I would like to just click a button and choose an existing entry to fill into it. But once I've manually added the URL entries, it's pretty seamless and auto-recognizes that there are entries that it can fill. Overall I'm very happy with the whole setup.

deleted 4y ago

[deleted]

snailmailman 4y ago

How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.

celestialcheese 4y ago
It's easy if you don't share passwords with others. I have my whole family and business using it, and there's lots of shared folders. Convincing my wife and colleagues to all switch simultaneously isn't feasible unless this data fiasco gets worse.
- neurostimulant 4y ago
  It'll only going to get worse. Better move now before it's too late.
ragingroosevelt 4y ago
I tried migrating from LP to BW and got import errors. Bitwarden's error message was very vague (along the lines of "sorry, something went wrong") and I haven't been able to track down what entries were causing the issue. I've tried 3 or 4 times including trying to reproduce with subsets of the full collection but it's too much of a pain with hundreds of accounts and I so far haven't been motivated enough to manually transfer them or to write a selenium script to do it automatically.
archi42 4y ago
Moving to vaultwarden (the open bitwarden server implementation) was also really easy. Just installed the package in Arch, setup the vhost in nginx, put the vhost into my local DNS and slightly adjusted the vaultwarden config file. Now I use bitwarden clients everywhere and point them to my server. Since I don't feel 100% comfortable having my self hosted things on a public IP, I put it only on my LAN. For remote access (e.g. phone) I use wireguard.
greenicon 4y ago
Just check your data after re-importing the passwords. LastPass sometimes has issues with the export (see elsewhere in this thread) and does not export attachments at all. You have to move attachments manually.
eviks 4y ago
You can't export all the passwords, some extra fields are not exported by LastPass, so there is your PITA when some site asks a security question you had an answer to in that unexported field

musk_micropenis 4y ago

> If it wasn't such a PITA to move off LastPass, It's really not. As the quality of their software declined severely starting around 4-5 years ago, I put off moving because I assumed it would be a huge hassle. It turned out to be surprisingly easy. I have since deleted my LastPass account and wouldn't trust that company to mop my floors.

davnn 4y ago
I don‘t think the quality of the product was any better previously; they were the first to offer cloud hosted password management as far as I remember and that, plus being cheaper than 1Password last time I compared, are their only benefits in my opinion.

skittleson 4y ago

I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.

rkagerer 4y ago
How smooth is the hotkey autofill experience? Does it identify websites and fill out login forms properly? (I prefer not to rely on sites' "remember me" boxes or ephemeral cookies). Any compatible Android app?
- rd07 4y ago
  In Android, I use Keepass2Android Password Safe app by Philip Crocol. As far as my experience goes, it is quite smooth and for the most part it is able to fill out the login form properly.
- theaudacityofyw 4y ago
  I can't speak for any browser integration but I use the app's autofill and it works great. Several, I personally like KeePassDX but Keepass2android is also there, possibly others I don't know about.
- brokenmachine 4y ago
  I'm using keepass2android offline on Android, with the password file synced using syncthing. Works great. It also has autofill that comes up in any supported app when it recognizes a password field that it can autofill. Quite seamless. It also took a little mucking around to install it's custom keyboard and I had to run some adb command to give it permission to auto-switch keyboards, but now it's setup it's pretty good. You can open an entry in keepass2android, then it will auto-activate the keyboard and you get buttons so you can auto-type any field from that entry into anything. On Windows I'm using KeepassXC and the KeepassXC browser extension. It hasn't been perfect, I had to manually enable simple http auth for that to work, and sometimes it seems to miss login fields. Also I had to manually add the URL for some existing sites (I was using KeePassDroid only on Android before so the URL entries weren't filled). There's no way I could find to go to a site, then I would like to just click a button and choose an existing entry to fill into it. But once I've manually added the URL entries, it's pretty seamless and auto-recognizes that there are entries that it can fill. Overall I'm very happy with the whole setup.