4 ms·

Hasn’t tptacek said to avoid lastpass on here (in favor of 1Password) for the last ten years? I don’t know if he ever got into the details of why (maybe he cou

Hasn’t tptacek said to avoid lastpass on here (in favor of 1Password) for the last ten years? I don’t know if he ever got into the details of why (maybe he couldn’t for contract reasons or something), but his judgement on it looks accurate. I’d be curious what his thoughts are, or if the risks he was talking about back then we’re unrelated.

tptacek 4y ago
It's literally a bot autoresponse on our Slack, and I didn't put it there. Don't give me too much credit; it was a widely-held opinion.
- nequo 4y ago
  Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?
  - mdaniel 4y ago
    I'll copy my reply to a similar "but how do outsiders know they're not cheating us?" comment: They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pdf https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...
    - tptacek 4y ago
      It would be weird for a security assessment not to include source code access.
  - dfdz 4y ago
    One key feature of 1Password is the use of a secret key in addition to a master password. See page 10 [1] which explains how the secret key provides extra entropy (which makes it much harder to brute force a user who choses a weak password). Also see Story 1 on page 11 [1]. [1] https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...
- iamthemalto 4y ago
  Interesting, have your recommendations changed?
- warrentr 4y ago
  Curious what you think of dashlane. Personally I find 1pw UI patterns a bit annoying and dashlane somewhat better

tptacek 4y ago

It's literally a bot autoresponse on our Slack, and I didn't put it there. Don't give me too much credit; it was a widely-held opinion.

nequo 4y ago
Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?
- mdaniel 4y ago
  I'll copy my reply to a similar "but how do outsiders know they're not cheating us?" comment: They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pdf https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...
  - tptacek 4y ago
    It would be weird for a security assessment not to include source code access.
- dfdz 4y ago
  One key feature of 1Password is the use of a secret key in addition to a master password. See page 10 [1] which explains how the secret key provides extra entropy (which makes it much harder to brute force a user who choses a weak password). Also see Story 1 on page 11 [1]. [1] https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...
iamthemalto 4y ago
Interesting, have your recommendations changed?
warrentr 4y ago
Curious what you think of dashlane. Personally I find 1pw UI patterns a bit annoying and dashlane somewhat better