16 ms·

What’s in a PR statement: LastPass breach explained

425 points by saikatsg 4y ago

deleted 4y ago
[deleted]
prettyStandard 4y ago
I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributors page. I am taking what was previously a blog post, and giving it some extra attention with the current going-ons. https://blog.kamens.us/head-to-head-comparison-of-password-managers-with-interactive-grid https://blog.kamens.us/head-to-head-comparison-of-password-m... Some of y'all have already found a few issues, I will work through them, and submit a "Show HN" once I get it to that point. So take everything here with a grain of salt. And if you do know better, please submit a PR here: https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
- neontomo 4y ago
  High value comment. Thanks, this is awesome.
- gleenn 4y ago
  I don't think 1Password has any free tier, at least pretty sure it doesn't have free syncing across devices anymore or even ever.
  - mdaniel 4y ago
    It depends on how one views "free tier," since if one doesn't pay when requested (whether from the end of a trial, just normal expiry, or if there's a separation event from the "free family for business") the vault remains yours and active, but goes read only. I don't know what would lead you to believe there's any syncing restriction from 1Password, but if that is your experience it's almost certainly a bug, since to the very best of my knowledge 1Password doesn't engage in hostage-taking like that
- ChrisMarshallNY 4y ago
  Cool stupfh. Minor bug: I unchecked “CLI,” and still got this row: > CLI export includes attachments
  - prettyStandard 4y ago
    Fixed: https://github.com/Soft-wa-re/password-manager-comparer/commit/ec3f5294e4b909589604be835db26a75244e8b97 https://github.com/Soft-wa-re/password-manager-comparer/comm...
- linuxlizard 4y ago
  Thank you for this work! Could you add Bruce Schneier's PWSafe? https://pwsafe.org/ https://pwsafe.org/
  - A4ET8a8uTh0 4y ago
    Simple. Portable. Works across platforms. Local. If that is a selling point for you, password safe just works. I apologize if it sounds like an ad, but I am a very happy user.
    - linuxlizard 4y ago
      Those are all good selling points for me. Thank you! I'm building the Linux version now.
  - prettyStandard 4y ago
    You can submit a PR here: https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
    - linuxlizard 4y ago
      Sorry. You did say that already. I will. Thank you!
- burkaman 4y ago
  Bitwarden has a useful status page that you can subscribe to with RSS: https://status.bitwarden.com/ https://status.bitwarden.com/ Would be happy to submit a PR, but I couldn't find a link to a repo and couldn't find the code on GitHub.
  - prettyStandard 4y ago
    https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
- RubberSoul 4y ago
  Great overview! I think 1Password's Linux support has been improving [0]. I use 1Password with an Ubuntu desktop and have been happy with it. [0]: https://support.1password.com/explore/linux/ https://support.1password.com/explore/linux/
  - softskunk 4y ago
    agreed. linux desktop is absolutely fine for me.
  - prettyStandard 4y ago
    You can submit a PR here. https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
    - rdhyee 4y ago
      Thanks for providing the detailed comparison among the many password managers. I think it's more accurate to describe 1Password's CLI as "yes" rather than "yes?poor" and submitted a PR for consideration: https://github.com/Soft-wa-re/password-manager-comparer/pull/2 https://github.com/Soft-wa-re/password-manager-comparer/pull...
  - m-p-3 4y ago
    one thing I wish Bitwarden did is conditional username for URI I have some internal tools at work where you need to specify the domain, and some where you don't. Having two separate entries for these scenario is annoying, as I gotta update the password on both when I change it.
  - Hackbraten 4y ago
    It’s hardly working at all under Wayland. Copying to clipboard has been broken for at least 18 months. AgileBits doesn’t seem to care. [0] There are also sync issues (items created in the desktop app won’t appear in the browser extension unless I restart my browser), which aren’t occurring under Windows nor macOS. „Poor“ Linux support absolutely does the situation justice. [0]: https://1password.community/discussion/comment/667970 https://1password.community/discussion/comment/667970
- grahamplace 4y ago
  I’d be curious to know which one you personally use given all the research into the topic?
- dariusm5 4y ago
  I don't see any mention of local vaults on the page. Is there any password manager out there besides keepass that isn't cloud based?
  - hjuutilainen 4y ago
    There’s also Enpass (https://www.enpass.io/ https://www.enpass.io/) which markets itself as an offline password manager.
    - eric-burel 4y ago
      I use and like it
      - rkagerer 4y ago
        Two questions: 1) How's it do at syncing / conflicts? 2) In the Android app, do you know if there's a way to use the fingerprint feature without storing your master password or an encrypted derivative of it to non-volatile memory? For those scratching their heads at #2, it's motivated by my lukewarm trust of vendor-implemented components of Android Keystore. Some competing apps address it by making you authenticate with the full password the first time after boot (or after the app is closed by the user / memory management system / configurable timeout) and just tie your fingerprint to an "unlock" pin of sorts that only works when the database is "hot".
        neodymiumphish 4y ago
        Which apps handle this better? I'm not supremely concerned about my password being pulled from memory, from an attack surface perspective, but I am curious which apps address this best and how.
        rkagerer 4y ago
        Not saying it's the best out there (and the UI is a little clunky as it often flashes a pin input screen that gets skipped over when using your fingerprint), but I like how Keypass2Android can be configured to do it. When you select "Enable Biometric Unlock for Quick Unlock" (and don't disable the PIN feature) you can use your fingerprint as long as the app is still in memory, without it storing your master password. I know the Android Lastpass client would often prompt for a Master Password if it hadn't been used in a while, then let Fingerprints unlock it. I assumed it did something similar but haven't deep-dived the implementation.
- paranoidxprod 4y ago
  Thanks for posting this. I was about to post an "Ask HN" to see what password managers people here are using, but this seems very helpful to compare the various services.
  - flipbrad 4y ago
    Keepass and syncthing.
    - paranoidxprod 4y ago
      After doing some more research, I've pretty much come to the conclusion I should be using KeePass (or KeePassXC) but I wasn't really sure how I should go about syncing. I will definitely look into Syncthing, thanks!
- dgrin91 4y ago
  This is a cool page. One thing that is important for me that is lacking here is emergency access (e.g. https://www.lastpass.com/features/emergency-access https://www.lastpass.com/features/emergency-access). It would be great to see side-by-side comparisons of that.
- poopypoopington 4y ago
  you should add apple keychain
  - prettyStandard 4y ago
    https://github.com/Soft-wa-re/password-manager-comparer/issues/5 https://github.com/Soft-wa-re/password-manager-comparer/issu...
- mrstone 4y ago
  Seems like a great product, but something about the URL is reminiscent of those scammy websites that try to trick you into downloading scamware.
  - DrewADesign 4y ago
    I'm admittedly a hammer seeing everything as a nail, but as a designer, I see so many opportunities in FOSS lost to basic, unnecessary branding and usability oversights. Developers shouldn't expect themselves to be able to do good design work any more than designers should expect themselves to be able to make scalable, reliable, maintainable, production-ready code. It's a specialty for a reason! Incorporating designers into FOSS projects from the beginning seems like a no-brainer, but design is nearly universally considered a superficial matter to be considered once the real work of back-end development is done (which is generally never.) It's one of the reason that open source alternatives will remain the alternatives rather than the standards. Good design takes a lot of up-front work, and once you get ignored or bikeshedded into oblivion with one design proposal, the liklihood of doing it again is pretty much zero. Definitely my white whale, but it kills me to see so many great projects that could have so much more impact if they enfranchised specialists to design the look and feel.
    - waboremo 4y ago
      One of the great difficulty of tackling that problem is often FOSS projects are averse to design decisions like that made by someone relatively fresh to the project - even if the problem is incredibly obvious to the designers and not the core development team. You would have to spend a lot of time gaining trust to then be able to present an idea like switching domains. The duality of putting off design decisions until later, and also feeling like your current design is extremely personal (I've seen some projects where the maintainer immediately disregards a lot of proposals design wise because it's "good enough", as if that person just called their baby ugly), can make trying to make any progress on FOSS project feel horrible. It's a very interesting problem space I feel. There's so much room for improvement.
      - 4y ago
- jxm262 4y ago
  This is absolutely great. Thanks for sharing!
- gregmac 4y ago
  I see a few things that might be worth adding, as some were explicitly why I switched from LastPass a few years ago: * Security model. What is stored server-side unencrypted? In what circumstances is the server-side encrypted data available on the server in plaintext? * Defaults: "parent-safe"? What trade-offs are made with the defaults picked? * Ability to edit (Android) app associations. Bitwarden has this, and it solved a huge problem I had with duplicates on LastPass. There's URI entries like androidapp://com.example.app that are easy to manually merge and keep together with corresponding web sites. * Domain matching. Bitwarden can do: base, host, exact, starts with, or regex. Lastpass had an "equivalent domains" managed from obscure settings, which never really worked the way I wanted. I used to have a billion entries for things in .mydomain.com, but bitwarden fixes this and by setting that flag properly I get only relevant things for each internal app. At the same time, for .myapp.com and .myapp.local I can get the default dev login, so when I deploy a new instance/tenant for dev, it "just works". Username generation. Can it do plus-addresses? Catch-all domains?
- rkagerer 4y ago
  This is helpful. Would love to see KeePass and its variants on here.
- password1 4y ago
  Please change your domain, looks like a phishing website. I would never clic on that anywhere else on the internet.
  - HollywoodZero 4y ago
    +1. The URL is a huge red flag since it's exactly how scammers create fake links online.
  - Sephr 4y ago
    Clicking on a 'phishing' link can't hurt, and it's not like this person's website is ever going to be presented to you in a sensitive context (e.g. "download/install software from this site"). You should trust that your browser is secure enough to render random webpages. Excuse the self-promotion, but I take it that you're also too wary to click on this link to read my blog: https://dangerous.link/virus.exe https://dangerous.link/virus.exe
    - nkrisc 4y ago
      Any URL on the web could host a browser exploit that requires no interaction beyond visiting, but if I had to guess which one were most likely to, I'd put phishing links up there. > You should trust that your browser is secure enough to render random webpages. I honestly don't. Is dangerous.link/virus.exe any more dangerous than nytimes.com? Probably not. However if some 0-day, no interaction browser exploit does exist, it's easier to put the exploit on the some lookalike phishing domain rather than additionally exploit some mainstream site. Of course I can't possibly know what URLs are "safe" to click on and which ones aren't, but I'm going to guess that URLs that look like they're intended for a phishing campaign are less likely to be safe than any other. If your blog is go0gle-com.net, and someone emails or messages it to me, I'm not clicking on it and deleting the message. Most often what happens is I click some sketchy looking link on my phone and it attempts to hijack the browser with popups and history modifications and whatever other shit they do to let me know my Android iPhone is infected and must be cleaned immediately.
      - 4y ago
- traceroute66 4y ago
  What's with "MacOS" vs "macOS" in the toggle features ?!?
  - prettyStandard 4y ago
    Just a typo, my original work on this was to merge two forks of this, and that slipped through. I have pushed a fix now.
- cshokie 4y ago
  I don’t see an issues tab so I can’t open a bug report. There are two redundant checkboxes for MacOS (differing by capitalization).
- notlukesky 4y ago
  Never seen a url like that for such a project. FYI
- FatActor 4y ago
  Sweet. I've been looking for this. I decided to ditch my home-grown solution and switch to a real manager this week. One note: 1Password uses WebAuth for Yubikey and LastPass uses text input. This makes LastPass work across *remote terminals* where you don't have access to the physical machine. Now, there might be a vulnerability lurking in there, but I often find myself working on a remote windows machine and need to log into something. Maybe this should be a footnote in your Yubikey row? Or its own row, if it isn't already in there and I missed.
- KomoD 4y ago
  Broken as hell for me. "no?yes" "unknown?yes" "1 undefined" "2 undefined" "3 undefined"
- notlukesky 4y ago
  I would second the change in the url. Good job though.
- fluidcruft 4y ago
  One of the major features I'm looking for is the ability to easily list passwords by age. The use case is "I want an easy access "todo list" of all passwords to update that are older than (x months|specific date)" I would use this after notification of a breach or on my own schedule. Having to manually inspect each item is not acceptable. Bonus points if I can specify a "policy" for items (using tags and groups is acceptable if they can be incorporated into the search without too much effort). Super bonus points if the tool generates notifications and todo list automatically. Why these features are not standard boggles the mind. LastPass used to have this feature but removed it for who-know-why reasons.
  - KennyBlanken 4y ago
    KeepassXC does this, probably other keepass clients too. There are columns for creation, modification, expiration, and last-access, all of which can be sorted on. Each entry can have an expiration date/age.
- wlll 4y ago
  For some reason "MacOS" appears twice for me in the "options" section. I'd love for some more options. - Doesn't require a subscription - Doesn't require a web login - Allows local vaults
  - dijit 4y ago
    gnu-pass and bitwarden tick those boxes at least- any other requirements that maybe you simply assume should be available (like browser extensions)
    - wlll 4y ago
      Thanks, I'll remember those when my current 1Password 7 setup becomes unviable.
- deleted 4y ago
  [deleted]
- swyx 4y ago
  maybe one thing to add is "number of HN results above 50 points in the past 3 years" as a proxy for potential security issues
40four 4y ago
I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ functionality, and redistribute the I updated DBs back out to each device. It might take 10 minutes. But I can rest assured that I’m the only one who has a copy of my DB/ key files, and a breach of _blank_pw_manager_ service can’t compromise my secrets. Highly recommend KeyPass. It’s free and open source, with high quality community ports available on every platform. https://keepass.info/index.html https://keepass.info/index.html
- m101 4y ago
  Why not use OneDrive to keep your files synced? That's what I do with keepass
- dgrin91 4y ago
  Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPass deal with the same type of situation?
  - tyfon 4y ago
    My wife and I have the password to our vaults in each others vaults, however I am not sure what would happen if both of us die. Edit: as a site note, have used keepass + file on my (vpn reachable) synology for like 10 years, never had any issues. I use it in linux, android, ios and windows.
  - rietta 4y ago
    Have to plan ahead and have the keypass password in an envelope in the safe deposit box.
galoisscobi 4y ago
As an aside, I’m curious if Bitwarden is considered a relatively safe password manager?
- mtlmtlmtlmtl 4y ago
  It's considered the best cloud based one. Allows self hosting, is open source and audited, and is end-to-end encrypted.
  - tryfinally 4y ago
    I had a little trouble using Bitwarden a while ago (user error) and the (free tier) customer support was very responsive and helpful as well.
johndhi 4y ago
The know it all tone of this article is kind of annoying. Security professionals seem to have a common trait of thinking they know better. Some good points in there, but limited pragmatism.
- i_am_toaster 4y ago
  I disagree, this article did not come off this way to me, as all the comments were brief and backed up with supporting materials. In addition, the usage of words that would convey feelings the author had about the company were nonexistent — they described the actions taken (or not taken) by the company and left the reader to come to their own conclusions.
  - ncphil 4y ago
    Agreed. The tone was objective and factual. It's too bad the owners of LastPass failed to heed the criticisms that preceded this incident. FYI for anyone carping about LP's legal liability here: read the disclaimers (and indemnification agreement) in their TOS (personal or business). It's a real howl, and pretty much software industry standard.
- rag-hav 4y ago
  Given author's apparent history with LastPass, the tone comes across more as "told you so" to me.
- palant 4y ago
  Disclaimer: I am the author of this article. What kind of pragmatism would you prefer? LastPass messed up way more than they are willing to admit. And it’s not like nobody warned them before, quite a few of the issues which turn out to be very problematic now aren’t news – I brought them up years ago as did others. LastPass should be warning users now and suggesting mitigation steps, instead they claim that nobody has a reason to worry.
  - dahart 4y ago
    This is a compelling article, I feel more motivated now to reconsider my options. FWIW, my $0.02 feedback on pragmatism: as a user, it would be nice to have more what-to-do-about-it for non-security-experts. Also I didn’t love the parts of the article where you speculated about LastPass’ motivations and process (even if they turn out to be true!) The opening paragraph is making assumptions about the timing, which could backfire pretty badly if you’re wrong. You also speculated about the web site storing master passwords, justified by saying “they absolutely could, and you wouldn’t even notice.” They could do a lot of things, including selling passwords to the highest bidder. From my non-expert point of view, it’d be more helpful & pragmatic to stick to known facts and not whip additional fear into what is most definitely a bad situation.
mdale 4y ago
Shows the need for true multi factor. We should not have a bunch of virtual MFAs and passwords in one service even if said service make it convenient. Password managers should be held to a high standard but we should also never depend just on a password for protection of anything of value.
- user3939382 4y ago
  Maybe before I die multiple YubiKey support can be considered a standard. Even AWS doesn’t support it which is just unfathomable. They support one, so you can’t have a backup, so they may as well not have the feature.
  - anderiv 4y ago
    This is no longer the case as of late November 2022. You can now assign multiple keys to both IAM users and root users. https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul...
Night_Thastus 4y ago
I'm really curious what people in the know have to say about PM's in general and what the good options are. I personally really love having an in-browser password manager. It's an incredible convenience and it lets every service have a unique and nearly impossible to crack password. I have far too many services to remember them all, and using the same password for everything would be terrible. But of course I see the risk of having "one password to rule them all" and putting so much faith in one service. If it fails, losing everything is possible. I don't mind paying of course if there's a reason to, though for now the free version of Bitwarden has been fine for years.
- palant 4y ago
  Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all covered. Except for #5 where they opted for convenience: https://palant.info/2018/08/29/password-managers-please-make-sure-autofill-is-secure/ https://palant.info/2018/08/29/password-managers-please-make... This doesn’t mean that they are perfect. While Firefox allows you to choose a master password for your local password storage, even after improvements this is a very weak protection: https://palant.info/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother/ https://palant.info/2018/03/10/master-password-in-firefox-or.... From what I remember, Chrome doesn’t offer any local protection whatsoever – if somebody manages to copy this data off your computer it’s gone. More critical aspect is the sync functionality: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/ https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy.... Following my report, Chrome Sync has been improved and now offers reasonable protection at least for passwords – assuming that you set a passphrase which isn’t the default. In principle, Firefox Sync is better because it always encrypts all data, not merely passwords. But its bruteforce protection is very weak, the bug report I link to is still unresolved. So you would need a really strong password to protect the data (ideally randomly generated).
- edflsafoiewq 4y ago
  I have a small script that does hash(key + masterPasswd). key is usually just the site's domain name. I have the script and a few of the important passwords (eg my email) written down on paper in case my drive dies. It works fine for me.
betaby 4y ago
For non-tech-savvy people - https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Lettering/dp/1708201114/ref=sr_1_10?keywords=password+book&qid=1672155431&sprefix=passw%2Caps%2C160&sr=8-10 https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Le... For tech-savvy people - https://www.passwordstore.org/ https://www.passwordstore.org/ The rest doesn't work unfortunately, proven over and over.
- neonsunset 4y ago
  Self-hosted instance of Bitwarden works pretty well, and you can make it accessible behind a VPN to your local network only (plus there are multiple implementations of its back-end). Less-automated solutions make impractical concessions in usability. Reference impl. in C#: https://github.com/bitwarden/server https://github.com/bitwarden/server Self-host friendly impl. in Rust: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden p.s.: reference implementation is by far one of the better examples of how to do microservice-based C# solution of high code quality right.
  - bertman 4y ago
    I always found running 12 containers for hosting a password repository a bit overkill. https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
    - neonsunset 4y ago
      Have you checked the second link? (emphasis on "self-hosted friendly impl."). The first one is obviously not designed to serve as a primary self-hosted option but rather to scale for large number of users.
      - bertman 4y ago
        Oh, I'm sure Vaultwarden is much more resource-friendly, but even then: a user's password list is arguably the most important thing on the device. And I'm not sure you need a "web interface" to something that in the end is nothing more than an encrypted text file, which is why I always recommend pass[0] or using the browser's built-in pw manager for people that don't know ssh and git. [0] passwordstore.org
bikeformind 4y ago
Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality. not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastPass should shut down the businesses, refund customers, and help them migrate to a new service? You are just not the organization for this job.
- leni536 4y ago
  They could might as well dissolve the whole company. Most, if not all of their products are very security sensitive.
  - otachack 4y ago
    Aa long as they have paying customers that are ignorant, willing or not, to the issues I suspect they'll keep chugging along.
- mtlmtlmtlmtl 4y ago
  More interesting to me is that this shouldn't be an issue, they should just lose out to the competition organically. And yet here we are.
  - mhneu 4y ago
    Duopoly. Plus cost of switching away once you sign up. Network effects and monopolistic (anti-competitive) features allow bad companies to survive today. Monopolistic practices are probably a worse problem today than in the 1920s. In the 1920s governments used regulation to break up huge firms and defeat advantages due to cost of capital (hard to start a new railroad in the 20s because the cost of trains and tracks was just so high.) Today, cost of capital is relatively less important, and things like switching cost and bundling and people valuing their time and convenience are bigger factors. We need anti-trust/government regulation to address those. (For example, in the case of password managers, imagine if there were laws requiring publicized security audits and seamless migration to a new service of customer's choice. A competitor to Lastpass might have arrived by now.
tex0 4y ago
Why did people think that using a cloud based password manager (or for that matter: a closed source one) was ever a good idea?
- _Algernon_ 4y ago
  This contributes nothing to the discussion, except giving you a reason to feel better than others for arbitrary reasons.
  - InCityDreams 4y ago
    The gpost contributed to the discussion i am having with my kids, namely: avoid cloud-based pw storage. They're beginning to understand why, finally. We also discussed 'feeling better than others for arbitrary reasons '.
- dml2135 4y ago
  Because there needs to be a baseline level of convenience in order to get less-technical people to even consider using a password manager at all. If the alternative is using the same handful of weak passwords for every site, the risk of your password manager suffering a security breach doesn't look so bad in comparison.
  - wlll 4y ago
    There is a pretty large gap between "cloud based password storage" and "using the same password for each site". 1Password for /years/ worked with a local vault (and no remote sign-in requirement), and had relatively simple syncing to iOS via wifi (no idea on other OSes, that's what I use). I've shared my password vault between these two places with no issues and it didn't need a cloud account and I wasn't re-using passwords.
    - Espressosaurus 4y ago
      That's literally the option though if you've managed to convince someone to use a password manager. I convinced a family member and their response to the breach was "okay, who should I use instead? Or do I go back to using one password for everything?"
mrstone 4y ago
Incredibly pathetic. I am so disappointed in LastPass. I was willing to forgive their subpar UX because hey, at least my passwords were safe. I've moved over to Bitwarden and am happy for now, but man what a shitshow.
- dml2135 4y ago
  Same, I held onto Lastpass much longer than I would have put up with any less-essential SaaS product. Finally moved to Bitwarden and couldn't be happier. Still trying to decide if I want to self-host it or not, but more breaches of cloud-based password managers like this one may push me in that direction.
  - ok_dad 4y ago
    At least Bitwarden encrypts the whole vault as a blob. I don't bother self-hosting because I figure I know less about hosting a Bitwarden vault than they do so it's not much more secure. If I had a local server on my LAN I might consider it, because then at least I have a few firewalls between me and the internet. I've been a happy paying Bitwarden user for several years now, since just before the first "minor" Lastpass breach.
    - hcurtiss 4y ago
      Yeah, I’m definitely not trained in security like the password manager engineers are. But I keep wondering if being distributed offsets that risk. That is, I can spin up Bitwarden in my Unraid machine in like five minutes and behind a reverse proxy, nobody even knows it’s there to attack. Maybe I have some security vulnerability, but it seems significantly less likely to be tested than a centralized commercial service. Curious if others have thoughts. I’d happily pay Bitwarden for whatever.
      - ok_dad 4y ago
        I'm one of those software devs who don't do my own stuff, I happily pay services for good products, but I know it would be "better" security (probably) to have my own server in-home and all that. I don't just choose anything, but I don't want to deal with servers or technology debugging outside of my day job. I used to run my own servers and just got tired of having to maintain them; and even "fully automated" systems need maintenance.
revskill 4y ago
I'm not sure about the insight. But i hate the UI, UX of Lastpass. Why it's so hard to change for simplicty and ease of use ? Is it dark pattern, is it technically impossible due to technical architectural complexity, or tech debt,.. ? At least the UI tells me something about the internal.
- alar44 4y ago
  No idea what you're talking about. I manage LastPass for 200 not very tech savvy users and no one has any problems using it.
  - user3939382 4y ago
    The login text input button overlay is often obscured by other elements with click triggers, in some cases making it unusable. Many sites don’t populate with the input button so you have to get the password using context menus. I’ve trained 3-4 non-technical users on LastPass and none of them found it intuitive or easy. I’ve managed it in a corporate environment for dozens of users who were younger and more tech savvy, for them it was mostly okay.
    - alar44 4y ago
      Fixed easily enough: enable auto-fill and disable password saving in browser.
prepend 4y ago
It would be interesting to hear people’s life philosophy in this area. For me, lastpass always seemed like a bad idea as passwords are very important to me and giving someone else a copy of my passwords seems like a bad idea. Similarly, I don’t let any services know my bank passwords even if they super promise to protect them and not misuse them. Another similar seeming task that I can’t delegate is to read my bank statements and keep track of my assets and performance. This isn’t meant to shame people who are now at risk from lastpass’ failure, but to understand if HN readers have similar personal habits and rules.
- drbawb 4y ago
  It's a tradeoff based on convenience. I use Linux, Windows, Android, and iOS on a daily basis; using some combination of SyncThing, OneDrive, Google Workspaces, and iCloud. Getting an offline-first PW manager to work correctly and consistently across those devices, operating systems, and services is no easy feat. Doubly so if you actually want proper integration with the OS & browser keychain. At some point the closest you'll get is a self-hosted BitWarden instance, in which case you are basically running LastPass/1Password/et al. yourself anyways. Then you have to ask yourself (a) can you host it cheaper than a monthly subscription of a competing service, and (b) can you maintain that instance better _in your free time_ than some engineers that get paid to do it every day? The answer to (a) for me is definitely not, my colo bill is much larger than a 1pass subscription, and (b) is also probably a big fat no considering there were concerns in this article I hadn't even thought of. So ultimately I'm happy paying a nominal fee for someone to keep up w/ the ever changing landscape of OS/browser integrations & minefield of security pitfalls regarding credential storage. I wish there was some elegant way to magically kept all my devices in sync, that was portable & standardized, but the reality is modern vendors seem more interested in creating silos than standards. --- However there are things I don't put in my 1pass, despite it having great support for them, because I consider the alternatives more convenient or secure: (1) My PGP/SSH keys are on a YubiKey (2) My 2FA TOTP codes are on that YubiKey or some other authenticator (3) My 2FA backup codes are on an encrypted volume. That secret is not stored in 1pass. (4) My critical services (DNS, e-mail) require hardware backed 2FA. The theory being even if you steal my PW vault you can't own my DNS, without my DNS you can't own my MX, and without my MX you can't truly own my online identity.
alexpetralia 4y ago
This vaguely reminds me of Rackspace's catastrophic failure a few weeks ago. Both companies were owned by private equity firms.
- gausswho 4y ago
  I would love to have a service that cataloged all private equity takeovers so that I could migrate away from them. Every time they milk the brand and slowly atrophy.
  - alostpuppy 4y ago
    This would be very useful!
weakfortress 4y ago
I spent the holidays moving to a different provider (1password). 1password's security posture is superior in almost every way and it allows me to avoid having to worry about syncing keepass, etc to my phone and 10 different computers. I still have hundreds of passwords to change at this point. I can't imagine LastPass is long for this world after this one. Most other breaches were minor compared to this mess.
mrwww 4y ago
And of course they have a new version where they are constantly asking you to store credit cards and addresses, unless you dig deep into the settings to disable those constant prompts.
nogridbag 4y ago
Assuming I'm a LastPass user and I have a sufficiently long master password with hardware based 2FA do I have anything to worry about? The one weak link is mobile authentication which bypasses 2FA. I honestly forget how that's configured.
- foreverCarlos 4y ago
  A long password doesn't mean much by itself. If it has been previously leaked in a different breach, reused, is relatively easily brute-forced - then yes, you need to worry about that. The bigger problem is: even if you are safe right now, your vault is out there. If at any point your master password surfaces somewhere - all your accounts are instantly compromised. So the only sensible solution IMO is to start rotating all passwords and usernames today.
  - rrauenza 4y ago
    To expand a little on your point - I don’t think 2FA is relevant once someone has your vault blob. 2FA only prevents them from acquiring the blob.
- Taywee 4y ago
  Maybe. Check your account's iterations like this: https://support.lastpass.com/help/how-do-i-change-my-password-iterations-for-lastpass https://support.lastpass.com/help/how-do-i-change-my-passwor... If it's 5000, you've got 20 times as much to worry about than if it's 100100. 2FA won't help. That controls access, but not decryption, and they've already got the encrypted data, so they're past needing to get access. To be safe, start resetting your most high-value passwords immediately. Bank, email accounts, etc. Ideally, reset everything.
- alex- 4y ago
  I initially assumed I would be safe because of 2FA. Sadly it looks like this is not the case, the second factor is used to access the encrypted data, not decrypt the data. As the attacker already has the encrypted data, they have bypassed the stage where 2FA is providing protection. This appears to also be the case for 1password and bitwarden, so not specifically a lastpass failure.
pmlnr 4y ago
Keepassxc + syncthing.
sufficient 4y ago
I think we can do better in protecting vaults against offline brute force attacks. As written in the this post, 1Password uses a randomly generated "secret key" together with the user-chosen master password. This "secret key" is not stored on 1Password's servers, instead it should be printed on a piece of paper and stored safely. While this is a good starting point, it significantly reduces usability, since you need this piece of paper when re-installing 1Password. At heylogin, we are rethinking this cryptographic design. In our case, a random secret is generated inside the smartphone's security chip. From this secret, all keys for encryption are derived. The smartphone app and the browser extension is end-to-end encrypted and authenticated using an out-of-band QR code. This results in the following UX: To log into a website in the browser, the user needs to confirm on the phone. The app now provides the extension with temporary access to the passwords etc (a little bit more complicated to explain here). Thus, if the same breach would happen to us, the vaults would still be secure, since the e2ee does not depend on a user chosen master password. It's not easy to get a foot in this market, but I am confident, we can do it.
- mdaniel 4y ago
  > since the e2ee does not depend on a user chosen master password. What's the story with "my phone went in the lake" using that setup?
  - isthisthingon99 4y ago
    Since i use Google Authenticator for numerous services this is going to happen to me one day. So what I did was set it up on more than one phone.
    - mdaniel 4y ago
      I would legit pay money for Google to pull that piece of junk from the Play Store, because it's damn malpractice at this point, given there are so many other options that don't straight-up swallow the TOTP keys
      - 4y ago
SCLeo 4y ago
>> The cloud storage service accessed by the threat actor is physically separate from our production environment. > Is that supposed to be reassuring, considering that the cloud storage in question apparently had a copy of all the LastPass data? Or is this maybe an attempt to shift the blame: “It wasn’t our servers that the data has been lifted from”? Wow, seriously, they are really good at this. If not for this explanation, I would totally thought only testing environment got accessed.
AlbertCory 4y ago
A (perhaps) unconventional approach to password management, which I recommend to anyone. If you enjoy complexity, this is too simple for you. No one can steal something that's not written down Just like the Navajo code talkers in WW II had a system that was memorized, so even if the Japanese captured another Navajo and tortured him (which they did), he couldn't reveal the code. Have some hints to yourself, and store the hints. Even if the file is stolen, the hints won't help the thief. Never, never store a "master key" of what all the hints mean. If you forget one, just click the "forgot my password" link. I'm not going to even hint at the hints :) I use.
- deleted 4y ago
  [deleted]
- maphew 4y ago
  This used to be my main approach, but now I only use it for some key sites and rely on a password manager for the other 90%. Why the change? Watching the mental deterioration of aging on friends and family, and noting the beginnings of such things in myself. My mind is so much slower than it used to be, including recall. It's not only aging. A friend had a concussion from a lousy picture frame falling off the wall. It wasn't even that big or heavy. 3 years later still slowly rebuilding mental and language function.
- maphew 4y ago
  I forgot the other part of my reasoning: my hints only work for me. If I am incapacitated in a way that affects my password recall the hints won't mean shit to my family.
  - AlbertCory 4y ago
    You've hit on it: The big advantage is, the hints are only meaningful to you. The big disadvantage is, the hints are only meaningful to you.
- Vinnl 4y ago
  Oh, perfect. A three-letter word, "earth revolves around the ...". I didn't write it down, so no one can steal it. Simple indeed, thanks!
ericmcer 4y ago
Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on paper). I had to amend it to account for some services that require you to reset your password to a new one and for sites with annoyingly specific password formats (i.e. 3 special chars).
- deleted 4y ago
  [deleted]
- darrenf 4y ago
  Not necessarily a huge flaw and indeed it’s a method I used for a long time too - but what it doesn’t really help with is when there’s a breach and one of your passwords is in a leak. What do you do: make (and remember) an exception and the second choice function? Or change all your passwords so an amended function still holds true for all sites? With a password manager you just change the breached one and that’s it.
- robust-cactus 4y ago
  This is pretty cool, and could even make a great "no storage" type product here. Hmm 1 problem could be forced password changes? I've noticed some sites at times require password changes.
  - drexlspivey 4y ago
    It’s not, you can guess all his passwords if you know a couple of existing passwords (maybe even 1)
- deepserket 4y ago
  > function that takes the product name as input and spits out a password Can someone infer the function starting from the password and the service name? If yes, then there is a low (close to zero, unless you are specifically targeted) possibility to gain a clear password from a shitty website and calculate your other passwords.
xfz 4y ago
Thankfully their UX is awful, which prompted me to switch to 1Password. It feels like they're milking a cash cow rather than trying to improve the product.
nfca 4y ago
In the case of something as critical as a password-manager, quality of customer service, I believe, is a critical factor. When there is a problem, how helpful is the customer service? If not then a person stands to be locked out of critical aspects of their digital life
- fudgefactorfive 4y ago
  While having a Customer Service Rep tell you you're shit out of luck if you can't remember your master password may suck, it's pretty much the only way to actually be some semblance of safe. The Mud-puddle test is to demonstrate that only you can access your services. If you can call and go "hey can I get back into my vault" so can anyone that convincingly can make the same call on your behalf.
bberrry 4y ago
My LastPass account literally had ONE iteration of pbkdf2 (https://i.imgur.com/34aIOzO.png https://i.imgur.com/34aIOzO.png) and it seems I'm not the only one: https://snabelen.no/@vegardlarsen/109575002998425618 https://snabelen.no/@vegardlarsen/109575002998425618 Absolutely amateurish. I hope no one trusts LastPass ever again.. I know I won't. My account was registered 2010 if anyone is interested.
- palant 4y ago
  Thank you for this confirmation. I already suspected that LastPass failed upgrading people’s security settings for each change of defaults they made. But so far I’ve only seen one person who found an account with one iteration (that was their very first default). Now you gave me two more.
firstSpeaker 4y ago
"We learn here that LastPass was storing your IP addresses. And since they don’t state how many they were storing, we have to assume: all of them. And if you are an active LastPass user, that data should be good enough to create a complete movement profile. Which is now in the hands of an unknown threat actor." Scary for activists anywhere.
sydbarrett74 4y ago
A lot of people argue that a cloud provider has more expertise in a given domain than a customer for whom IT isn't a core competency. I reject this argument. What we have here is the classic principal-agent problem in economics. Your data is (or should be) sacred to you. LastPass's regard for your data is only proportional to the profit they think they can extract from you. Beyond that, they only answer to Citrix's shareholders. (Citrix, or Shitrix as I call them, is ultimately the parent company.) I swim against the prevailing current in believing that the cloud should only serve as a backup, never as the primary solution.
- jsutton 4y ago
  Cirtrix hasn't ever been the parent company to LastPass. LogMeIn bought Citrix's GoTo product division, and also bought LastPass, so that's the extent of their relationship. LogMeIn and subsequently LastPass is has been owned by the private equity firm Francisco Partners since 2020. Ire can be focused on Francisco Partners as they completely gutted LastPass and other LogMeIn products shortly after acquisition.
mcoliver 4y ago
Question that may have been answered but I'm coming up short with searches. What about LastPass Authenticator TOTP seeds. Were those compromised as well?

425 points by saikatsg 4y ago

deleted 4y ago

[deleted]

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributors page. I am taking what was previously a blog post, and giving it some extra attention with the current going-ons. https://blog.kamens.us/head-to-head-comparison-of-password-managers-with-interactive-grid https://blog.kamens.us/head-to-head-comparison-of-password-m... Some of y'all have already found a few issues, I will work through them, and submit a "Show HN" once I get it to that point. So take everything here with a grain of salt. And if you do know better, please submit a PR here: https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer

neontomo 4y ago
High value comment. Thanks, this is awesome.
gleenn 4y ago
I don't think 1Password has any free tier, at least pretty sure it doesn't have free syncing across devices anymore or even ever.
- mdaniel 4y ago
  It depends on how one views "free tier," since if one doesn't pay when requested (whether from the end of a trial, just normal expiry, or if there's a separation event from the "free family for business") the vault remains yours and active, but goes read only. I don't know what would lead you to believe there's any syncing restriction from 1Password, but if that is your experience it's almost certainly a bug, since to the very best of my knowledge 1Password doesn't engage in hostage-taking like that
ChrisMarshallNY 4y ago
Cool stupfh. Minor bug: I unchecked “CLI,” and still got this row: > CLI export includes attachments
- prettyStandard 4y ago
  Fixed: https://github.com/Soft-wa-re/password-manager-comparer/commit/ec3f5294e4b909589604be835db26a75244e8b97 https://github.com/Soft-wa-re/password-manager-comparer/comm...
linuxlizard 4y ago
Thank you for this work! Could you add Bruce Schneier's PWSafe? https://pwsafe.org/ https://pwsafe.org/
- A4ET8a8uTh0 4y ago
  Simple. Portable. Works across platforms. Local. If that is a selling point for you, password safe just works. I apologize if it sounds like an ad, but I am a very happy user.
  - linuxlizard 4y ago
    Those are all good selling points for me. Thank you! I'm building the Linux version now.
- prettyStandard 4y ago
  You can submit a PR here: https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
  - linuxlizard 4y ago
    Sorry. You did say that already. I will. Thank you!
burkaman 4y ago
Bitwarden has a useful status page that you can subscribe to with RSS: https://status.bitwarden.com/ https://status.bitwarden.com/ Would be happy to submit a PR, but I couldn't find a link to a repo and couldn't find the code on GitHub.
- prettyStandard 4y ago
  https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
RubberSoul 4y ago
Great overview! I think 1Password's Linux support has been improving [0]. I use 1Password with an Ubuntu desktop and have been happy with it. [0]: https://support.1password.com/explore/linux/ https://support.1password.com/explore/linux/
- softskunk 4y ago
  agreed. linux desktop is absolutely fine for me.
- prettyStandard 4y ago
  You can submit a PR here. https://github.com/Soft-wa-re/password-manager-comparer https://github.com/Soft-wa-re/password-manager-comparer
  - rdhyee 4y ago
    Thanks for providing the detailed comparison among the many password managers. I think it's more accurate to describe 1Password's CLI as "yes" rather than "yes?poor" and submitted a PR for consideration: https://github.com/Soft-wa-re/password-manager-comparer/pull/2 https://github.com/Soft-wa-re/password-manager-comparer/pull...
- m-p-3 4y ago
  one thing I wish Bitwarden did is conditional username for URI I have some internal tools at work where you need to specify the domain, and some where you don't. Having two separate entries for these scenario is annoying, as I gotta update the password on both when I change it.
- Hackbraten 4y ago
  It’s hardly working at all under Wayland. Copying to clipboard has been broken for at least 18 months. AgileBits doesn’t seem to care. [0] There are also sync issues (items created in the desktop app won’t appear in the browser extension unless I restart my browser), which aren’t occurring under Windows nor macOS. „Poor“ Linux support absolutely does the situation justice. [0]: https://1password.community/discussion/comment/667970 https://1password.community/discussion/comment/667970
grahamplace 4y ago
I’d be curious to know which one you personally use given all the research into the topic?
dariusm5 4y ago
I don't see any mention of local vaults on the page. Is there any password manager out there besides keepass that isn't cloud based?
- hjuutilainen 4y ago
  There’s also Enpass (https://www.enpass.io/ https://www.enpass.io/) which markets itself as an offline password manager.
  - eric-burel 4y ago
    I use and like it
    - rkagerer 4y ago
      Two questions: 1) How's it do at syncing / conflicts? 2) In the Android app, do you know if there's a way to use the fingerprint feature without storing your master password or an encrypted derivative of it to non-volatile memory? For those scratching their heads at #2, it's motivated by my lukewarm trust of vendor-implemented components of Android Keystore. Some competing apps address it by making you authenticate with the full password the first time after boot (or after the app is closed by the user / memory management system / configurable timeout) and just tie your fingerprint to an "unlock" pin of sorts that only works when the database is "hot".
      - neodymiumphish 4y ago
        Which apps handle this better? I'm not supremely concerned about my password being pulled from memory, from an attack surface perspective, but I am curious which apps address this best and how.
        rkagerer 4y ago
        Not saying it's the best out there (and the UI is a little clunky as it often flashes a pin input screen that gets skipped over when using your fingerprint), but I like how Keypass2Android can be configured to do it. When you select "Enable Biometric Unlock for Quick Unlock" (and don't disable the PIN feature) you can use your fingerprint as long as the app is still in memory, without it storing your master password. I know the Android Lastpass client would often prompt for a Master Password if it hadn't been used in a while, then let Fingerprints unlock it. I assumed it did something similar but haven't deep-dived the implementation.
paranoidxprod 4y ago
Thanks for posting this. I was about to post an "Ask HN" to see what password managers people here are using, but this seems very helpful to compare the various services.
- flipbrad 4y ago
  Keepass and syncthing.
  - paranoidxprod 4y ago
    After doing some more research, I've pretty much come to the conclusion I should be using KeePass (or KeePassXC) but I wasn't really sure how I should go about syncing. I will definitely look into Syncthing, thanks!
dgrin91 4y ago
This is a cool page. One thing that is important for me that is lacking here is emergency access (e.g. https://www.lastpass.com/features/emergency-access https://www.lastpass.com/features/emergency-access). It would be great to see side-by-side comparisons of that.
poopypoopington 4y ago
you should add apple keychain
- prettyStandard 4y ago
  https://github.com/Soft-wa-re/password-manager-comparer/issues/5 https://github.com/Soft-wa-re/password-manager-comparer/issu...
mrstone 4y ago
Seems like a great product, but something about the URL is reminiscent of those scammy websites that try to trick you into downloading scamware.
- DrewADesign 4y ago
  I'm admittedly a hammer seeing everything as a nail, but as a designer, I see so many opportunities in FOSS lost to basic, unnecessary branding and usability oversights. Developers shouldn't expect themselves to be able to do good design work any more than designers should expect themselves to be able to make scalable, reliable, maintainable, production-ready code. It's a specialty for a reason! Incorporating designers into FOSS projects from the beginning seems like a no-brainer, but design is nearly universally considered a superficial matter to be considered once the real work of back-end development is done (which is generally never.) It's one of the reason that open source alternatives will remain the alternatives rather than the standards. Good design takes a lot of up-front work, and once you get ignored or bikeshedded into oblivion with one design proposal, the liklihood of doing it again is pretty much zero. Definitely my white whale, but it kills me to see so many great projects that could have so much more impact if they enfranchised specialists to design the look and feel.
  - waboremo 4y ago
    One of the great difficulty of tackling that problem is often FOSS projects are averse to design decisions like that made by someone relatively fresh to the project - even if the problem is incredibly obvious to the designers and not the core development team. You would have to spend a lot of time gaining trust to then be able to present an idea like switching domains. The duality of putting off design decisions until later, and also feeling like your current design is extremely personal (I've seen some projects where the maintainer immediately disregards a lot of proposals design wise because it's "good enough", as if that person just called their baby ugly), can make trying to make any progress on FOSS project feel horrible. It's a very interesting problem space I feel. There's so much room for improvement.
    - 4y ago
jxm262 4y ago
This is absolutely great. Thanks for sharing!
gregmac 4y ago
I see a few things that might be worth adding, as some were explicitly why I switched from LastPass a few years ago: * Security model. What is stored server-side unencrypted? In what circumstances is the server-side encrypted data available on the server in plaintext? * Defaults: "parent-safe"? What trade-offs are made with the defaults picked? * Ability to edit (Android) app associations. Bitwarden has this, and it solved a huge problem I had with duplicates on LastPass. There's URI entries like androidapp://com.example.app that are easy to manually merge and keep together with corresponding web sites. * Domain matching. Bitwarden can do: base, host, exact, starts with, or regex. Lastpass had an "equivalent domains" managed from obscure settings, which never really worked the way I wanted. I used to have a billion entries for things in .mydomain.com, but bitwarden fixes this and by setting that flag properly I get only relevant things for each internal app. At the same time, for .myapp.com and .myapp.local I can get the default dev login, so when I deploy a new instance/tenant for dev, it "just works". Username generation. Can it do plus-addresses? Catch-all domains?
rkagerer 4y ago
This is helpful. Would love to see KeePass and its variants on here.
password1 4y ago
Please change your domain, looks like a phishing website. I would never clic on that anywhere else on the internet.
- HollywoodZero 4y ago
  +1. The URL is a huge red flag since it's exactly how scammers create fake links online.
- Sephr 4y ago
  Clicking on a 'phishing' link can't hurt, and it's not like this person's website is ever going to be presented to you in a sensitive context (e.g. "download/install software from this site"). You should trust that your browser is secure enough to render random webpages. Excuse the self-promotion, but I take it that you're also too wary to click on this link to read my blog: https://dangerous.link/virus.exe https://dangerous.link/virus.exe
  - nkrisc 4y ago
    Any URL on the web could host a browser exploit that requires no interaction beyond visiting, but if I had to guess which one were most likely to, I'd put phishing links up there. > You should trust that your browser is secure enough to render random webpages. I honestly don't. Is dangerous.link/virus.exe any more dangerous than nytimes.com? Probably not. However if some 0-day, no interaction browser exploit does exist, it's easier to put the exploit on the some lookalike phishing domain rather than additionally exploit some mainstream site. Of course I can't possibly know what URLs are "safe" to click on and which ones aren't, but I'm going to guess that URLs that look like they're intended for a phishing campaign are less likely to be safe than any other. If your blog is go0gle-com.net, and someone emails or messages it to me, I'm not clicking on it and deleting the message. Most often what happens is I click some sketchy looking link on my phone and it attempts to hijack the browser with popups and history modifications and whatever other shit they do to let me know my Android iPhone is infected and must be cleaned immediately.
    - 4y ago
traceroute66 4y ago
What's with "MacOS" vs "macOS" in the toggle features ?!?
- prettyStandard 4y ago
  Just a typo, my original work on this was to merge two forks of this, and that slipped through. I have pushed a fix now.
cshokie 4y ago
I don’t see an issues tab so I can’t open a bug report. There are two redundant checkboxes for MacOS (differing by capitalization).
notlukesky 4y ago
Never seen a url like that for such a project. FYI
FatActor 4y ago
Sweet. I've been looking for this. I decided to ditch my home-grown solution and switch to a real manager this week. One note: 1Password uses WebAuth for Yubikey and LastPass uses text input. This makes LastPass work across *remote terminals* where you don't have access to the physical machine. Now, there might be a vulnerability lurking in there, but I often find myself working on a remote windows machine and need to log into something. Maybe this should be a footnote in your Yubikey row? Or its own row, if it isn't already in there and I missed.
KomoD 4y ago
Broken as hell for me. "no?yes" "unknown?yes" "1 undefined" "2 undefined" "3 undefined"
notlukesky 4y ago
I would second the change in the url. Good job though.
fluidcruft 4y ago
One of the major features I'm looking for is the ability to easily list passwords by age. The use case is "I want an easy access "todo list" of all passwords to update that are older than (x months|specific date)" I would use this after notification of a breach or on my own schedule. Having to manually inspect each item is not acceptable. Bonus points if I can specify a "policy" for items (using tags and groups is acceptable if they can be incorporated into the search without too much effort). Super bonus points if the tool generates notifications and todo list automatically. Why these features are not standard boggles the mind. LastPass used to have this feature but removed it for who-know-why reasons.
- KennyBlanken 4y ago
  KeepassXC does this, probably other keepass clients too. There are columns for creation, modification, expiration, and last-access, all of which can be sorted on. Each entry can have an expiration date/age.
wlll 4y ago
For some reason "MacOS" appears twice for me in the "options" section. I'd love for some more options. - Doesn't require a subscription - Doesn't require a web login - Allows local vaults
- dijit 4y ago
  gnu-pass and bitwarden tick those boxes at least- any other requirements that maybe you simply assume should be available (like browser extensions)
  - wlll 4y ago
    Thanks, I'll remember those when my current 1Password 7 setup becomes unviable.
deleted 4y ago
[deleted]
swyx 4y ago
maybe one thing to add is "number of HN results above 50 points in the past 3 years" as a proxy for potential security issues

40four 4y ago

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ functionality, and redistribute the I updated DBs back out to each device. It might take 10 minutes. But I can rest assured that I’m the only one who has a copy of my DB/ key files, and a breach of _blank_pw_manager_ service can’t compromise my secrets. Highly recommend KeyPass. It’s free and open source, with high quality community ports available on every platform. https://keepass.info/index.html https://keepass.info/index.html

m101 4y ago
Why not use OneDrive to keep your files synced? That's what I do with keepass
dgrin91 4y ago
Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPass deal with the same type of situation?
- tyfon 4y ago
  My wife and I have the password to our vaults in each others vaults, however I am not sure what would happen if both of us die. Edit: as a site note, have used keepass + file on my (vpn reachable) synology for like 10 years, never had any issues. I use it in linux, android, ios and windows.
- rietta 4y ago
  Have to plan ahead and have the keypass password in an envelope in the safe deposit box.

galoisscobi 4y ago

As an aside, I’m curious if Bitwarden is considered a relatively safe password manager?

mtlmtlmtlmtl 4y ago
It's considered the best cloud based one. Allows self hosting, is open source and audited, and is end-to-end encrypted.
- tryfinally 4y ago
  I had a little trouble using Bitwarden a while ago (user error) and the (free tier) customer support was very responsive and helpful as well.

johndhi 4y ago

The know it all tone of this article is kind of annoying. Security professionals seem to have a common trait of thinking they know better. Some good points in there, but limited pragmatism.

i_am_toaster 4y ago
I disagree, this article did not come off this way to me, as all the comments were brief and backed up with supporting materials. In addition, the usage of words that would convey feelings the author had about the company were nonexistent — they described the actions taken (or not taken) by the company and left the reader to come to their own conclusions.
- ncphil 4y ago
  Agreed. The tone was objective and factual. It's too bad the owners of LastPass failed to heed the criticisms that preceded this incident. FYI for anyone carping about LP's legal liability here: read the disclaimers (and indemnification agreement) in their TOS (personal or business). It's a real howl, and pretty much software industry standard.
rag-hav 4y ago
Given author's apparent history with LastPass, the tone comes across more as "told you so" to me.
palant 4y ago
Disclaimer: I am the author of this article. What kind of pragmatism would you prefer? LastPass messed up way more than they are willing to admit. And it’s not like nobody warned them before, quite a few of the issues which turn out to be very problematic now aren’t news – I brought them up years ago as did others. LastPass should be warning users now and suggesting mitigation steps, instead they claim that nobody has a reason to worry.
- dahart 4y ago
  This is a compelling article, I feel more motivated now to reconsider my options. FWIW, my $0.02 feedback on pragmatism: as a user, it would be nice to have more what-to-do-about-it for non-security-experts. Also I didn’t love the parts of the article where you speculated about LastPass’ motivations and process (even if they turn out to be true!) The opening paragraph is making assumptions about the timing, which could backfire pretty badly if you’re wrong. You also speculated about the web site storing master passwords, justified by saying “they absolutely could, and you wouldn’t even notice.” They could do a lot of things, including selling passwords to the highest bidder. From my non-expert point of view, it’d be more helpful & pragmatic to stick to known facts and not whip additional fear into what is most definitely a bad situation.

mdale 4y ago

Shows the need for true multi factor. We should not have a bunch of virtual MFAs and passwords in one service even if said service make it convenient. Password managers should be held to a high standard but we should also never depend just on a password for protection of anything of value.

user3939382 4y ago
Maybe before I die multiple YubiKey support can be considered a standard. Even AWS doesn’t support it which is just unfathomable. They support one, so you can’t have a backup, so they may as well not have the feature.
- anderiv 4y ago
  This is no longer the case as of late November 2022. You can now assign multiple keys to both IAM users and root users. https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul...

Night_Thastus 4y ago

I'm really curious what people in the know have to say about PM's in general and what the good options are. I personally really love having an in-browser password manager. It's an incredible convenience and it lets every service have a unique and nearly impossible to crack password. I have far too many services to remember them all, and using the same password for everything would be terrible. But of course I see the risk of having "one password to rule them all" and putting so much faith in one service. If it fails, losing everything is possible. I don't mind paying of course if there's a reason to, though for now the free version of Bitwarden has been fine for years.

palant 4y ago
Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all covered. Except for #5 where they opted for convenience: https://palant.info/2018/08/29/password-managers-please-make-sure-autofill-is-secure/ https://palant.info/2018/08/29/password-managers-please-make... This doesn’t mean that they are perfect. While Firefox allows you to choose a master password for your local password storage, even after improvements this is a very weak protection: https://palant.info/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother/ https://palant.info/2018/03/10/master-password-in-firefox-or.... From what I remember, Chrome doesn’t offer any local protection whatsoever – if somebody manages to copy this data off your computer it’s gone. More critical aspect is the sync functionality: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/ https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy.... Following my report, Chrome Sync has been improved and now offers reasonable protection at least for passwords – assuming that you set a passphrase which isn’t the default. In principle, Firefox Sync is better because it always encrypts all data, not merely passwords. But its bruteforce protection is very weak, the bug report I link to is still unresolved. So you would need a really strong password to protect the data (ideally randomly generated).
edflsafoiewq 4y ago
I have a small script that does hash(key + masterPasswd). key is usually just the site's domain name. I have the script and a few of the important passwords (eg my email) written down on paper in case my drive dies. It works fine for me.

betaby 4y ago

For non-tech-savvy people - https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Lettering/dp/1708201114/ref=sr_1_10?keywords=password+book&qid=1672155431&sprefix=passw%2Caps%2C160&sr=8-10 https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Le... For tech-savvy people - https://www.passwordstore.org/ https://www.passwordstore.org/ The rest doesn't work unfortunately, proven over and over.

neonsunset 4y ago
Self-hosted instance of Bitwarden works pretty well, and you can make it accessible behind a VPN to your local network only (plus there are multiple implementations of its back-end). Less-automated solutions make impractical concessions in usability. Reference impl. in C#: https://github.com/bitwarden/server https://github.com/bitwarden/server Self-host friendly impl. in Rust: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden p.s.: reference implementation is by far one of the better examples of how to do microservice-based C# solution of high code quality right.
- bertman 4y ago
  I always found running 12 containers for hosting a password repository a bit overkill. https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
  - neonsunset 4y ago
    Have you checked the second link? (emphasis on "self-hosted friendly impl."). The first one is obviously not designed to serve as a primary self-hosted option but rather to scale for large number of users.
    - bertman 4y ago
      Oh, I'm sure Vaultwarden is much more resource-friendly, but even then: a user's password list is arguably the most important thing on the device. And I'm not sure you need a "web interface" to something that in the end is nothing more than an encrypted text file, which is why I always recommend pass[0] or using the browser's built-in pw manager for people that don't know ssh and git. [0] passwordstore.org

bikeformind 4y ago

Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality. not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastPass should shut down the businesses, refund customers, and help them migrate to a new service? You are just not the organization for this job.

leni536 4y ago
They could might as well dissolve the whole company. Most, if not all of their products are very security sensitive.
- otachack 4y ago
  Aa long as they have paying customers that are ignorant, willing or not, to the issues I suspect they'll keep chugging along.
mtlmtlmtlmtl 4y ago
More interesting to me is that this shouldn't be an issue, they should just lose out to the competition organically. And yet here we are.
- mhneu 4y ago
  Duopoly. Plus cost of switching away once you sign up. Network effects and monopolistic (anti-competitive) features allow bad companies to survive today. Monopolistic practices are probably a worse problem today than in the 1920s. In the 1920s governments used regulation to break up huge firms and defeat advantages due to cost of capital (hard to start a new railroad in the 20s because the cost of trains and tracks was just so high.) Today, cost of capital is relatively less important, and things like switching cost and bundling and people valuing their time and convenience are bigger factors. We need anti-trust/government regulation to address those. (For example, in the case of password managers, imagine if there were laws requiring publicized security audits and seamless migration to a new service of customer's choice. A competitor to Lastpass might have arrived by now.

tex0 4y ago

Why did people think that using a cloud based password manager (or for that matter: a closed source one) was ever a good idea?

_Algernon_ 4y ago
This contributes nothing to the discussion, except giving you a reason to feel better than others for arbitrary reasons.
- InCityDreams 4y ago
  The gpost contributed to the discussion i am having with my kids, namely: avoid cloud-based pw storage. They're beginning to understand why, finally. We also discussed 'feeling better than others for arbitrary reasons '.
dml2135 4y ago
Because there needs to be a baseline level of convenience in order to get less-technical people to even consider using a password manager at all. If the alternative is using the same handful of weak passwords for every site, the risk of your password manager suffering a security breach doesn't look so bad in comparison.
- wlll 4y ago
  There is a pretty large gap between "cloud based password storage" and "using the same password for each site". 1Password for /years/ worked with a local vault (and no remote sign-in requirement), and had relatively simple syncing to iOS via wifi (no idea on other OSes, that's what I use). I've shared my password vault between these two places with no issues and it didn't need a cloud account and I wasn't re-using passwords.
  - Espressosaurus 4y ago
    That's literally the option though if you've managed to convince someone to use a password manager. I convinced a family member and their response to the breach was "okay, who should I use instead? Or do I go back to using one password for everything?"

mrstone 4y ago

Incredibly pathetic. I am so disappointed in LastPass. I was willing to forgive their subpar UX because hey, at least my passwords were safe. I've moved over to Bitwarden and am happy for now, but man what a shitshow.

dml2135 4y ago
Same, I held onto Lastpass much longer than I would have put up with any less-essential SaaS product. Finally moved to Bitwarden and couldn't be happier. Still trying to decide if I want to self-host it or not, but more breaches of cloud-based password managers like this one may push me in that direction.
- ok_dad 4y ago
  At least Bitwarden encrypts the whole vault as a blob. I don't bother self-hosting because I figure I know less about hosting a Bitwarden vault than they do so it's not much more secure. If I had a local server on my LAN I might consider it, because then at least I have a few firewalls between me and the internet. I've been a happy paying Bitwarden user for several years now, since just before the first "minor" Lastpass breach.
  - hcurtiss 4y ago
    Yeah, I’m definitely not trained in security like the password manager engineers are. But I keep wondering if being distributed offsets that risk. That is, I can spin up Bitwarden in my Unraid machine in like five minutes and behind a reverse proxy, nobody even knows it’s there to attack. Maybe I have some security vulnerability, but it seems significantly less likely to be tested than a centralized commercial service. Curious if others have thoughts. I’d happily pay Bitwarden for whatever.
    - ok_dad 4y ago
      I'm one of those software devs who don't do my own stuff, I happily pay services for good products, but I know it would be "better" security (probably) to have my own server in-home and all that. I don't just choose anything, but I don't want to deal with servers or technology debugging outside of my day job. I used to run my own servers and just got tired of having to maintain them; and even "fully automated" systems need maintenance.

revskill 4y ago

I'm not sure about the insight. But i hate the UI, UX of Lastpass. Why it's so hard to change for simplicty and ease of use ? Is it dark pattern, is it technically impossible due to technical architectural complexity, or tech debt,.. ? At least the UI tells me something about the internal.

alar44 4y ago
No idea what you're talking about. I manage LastPass for 200 not very tech savvy users and no one has any problems using it.
- user3939382 4y ago
  The login text input button overlay is often obscured by other elements with click triggers, in some cases making it unusable. Many sites don’t populate with the input button so you have to get the password using context menus. I’ve trained 3-4 non-technical users on LastPass and none of them found it intuitive or easy. I’ve managed it in a corporate environment for dozens of users who were younger and more tech savvy, for them it was mostly okay.
  - alar44 4y ago
    Fixed easily enough: enable auto-fill and disable password saving in browser.

prepend 4y ago

It would be interesting to hear people’s life philosophy in this area. For me, lastpass always seemed like a bad idea as passwords are very important to me and giving someone else a copy of my passwords seems like a bad idea. Similarly, I don’t let any services know my bank passwords even if they super promise to protect them and not misuse them. Another similar seeming task that I can’t delegate is to read my bank statements and keep track of my assets and performance. This isn’t meant to shame people who are now at risk from lastpass’ failure, but to understand if HN readers have similar personal habits and rules.

drbawb 4y ago
It's a tradeoff based on convenience. I use Linux, Windows, Android, and iOS on a daily basis; using some combination of SyncThing, OneDrive, Google Workspaces, and iCloud. Getting an offline-first PW manager to work correctly and consistently across those devices, operating systems, and services is no easy feat. Doubly so if you actually want proper integration with the OS & browser keychain. At some point the closest you'll get is a self-hosted BitWarden instance, in which case you are basically running LastPass/1Password/et al. yourself anyways. Then you have to ask yourself (a) can you host it cheaper than a monthly subscription of a competing service, and (b) can you maintain that instance better _in your free time_ than some engineers that get paid to do it every day? The answer to (a) for me is definitely not, my colo bill is much larger than a 1pass subscription, and (b) is also probably a big fat no considering there were concerns in this article I hadn't even thought of. So ultimately I'm happy paying a nominal fee for someone to keep up w/ the ever changing landscape of OS/browser integrations & minefield of security pitfalls regarding credential storage. I wish there was some elegant way to magically kept all my devices in sync, that was portable & standardized, but the reality is modern vendors seem more interested in creating silos than standards. --- However there are things I don't put in my 1pass, despite it having great support for them, because I consider the alternatives more convenient or secure: (1) My PGP/SSH keys are on a YubiKey (2) My 2FA TOTP codes are on that YubiKey or some other authenticator (3) My 2FA backup codes are on an encrypted volume. That secret is not stored in 1pass. (4) My critical services (DNS, e-mail) require hardware backed 2FA. The theory being even if you steal my PW vault you can't own my DNS, without my DNS you can't own my MX, and without my MX you can't truly own my online identity.

alexpetralia 4y ago

This vaguely reminds me of Rackspace's catastrophic failure a few weeks ago. Both companies were owned by private equity firms.

gausswho 4y ago
I would love to have a service that cataloged all private equity takeovers so that I could migrate away from them. Every time they milk the brand and slowly atrophy.
- alostpuppy 4y ago
  This would be very useful!

weakfortress 4y ago

I spent the holidays moving to a different provider (1password). 1password's security posture is superior in almost every way and it allows me to avoid having to worry about syncing keepass, etc to my phone and 10 different computers. I still have hundreds of passwords to change at this point. I can't imagine LastPass is long for this world after this one. Most other breaches were minor compared to this mess.

mrwww 4y ago

And of course they have a new version where they are constantly asking you to store credit cards and addresses, unless you dig deep into the settings to disable those constant prompts.

nogridbag 4y ago

Assuming I'm a LastPass user and I have a sufficiently long master password with hardware based 2FA do I have anything to worry about? The one weak link is mobile authentication which bypasses 2FA. I honestly forget how that's configured.

foreverCarlos 4y ago
A long password doesn't mean much by itself. If it has been previously leaked in a different breach, reused, is relatively easily brute-forced - then yes, you need to worry about that. The bigger problem is: even if you are safe right now, your vault is out there. If at any point your master password surfaces somewhere - all your accounts are instantly compromised. So the only sensible solution IMO is to start rotating all passwords and usernames today.
- rrauenza 4y ago
  To expand a little on your point - I don’t think 2FA is relevant once someone has your vault blob. 2FA only prevents them from acquiring the blob.
Taywee 4y ago
Maybe. Check your account's iterations like this: https://support.lastpass.com/help/how-do-i-change-my-password-iterations-for-lastpass https://support.lastpass.com/help/how-do-i-change-my-passwor... If it's 5000, you've got 20 times as much to worry about than if it's 100100. 2FA won't help. That controls access, but not decryption, and they've already got the encrypted data, so they're past needing to get access. To be safe, start resetting your most high-value passwords immediately. Bank, email accounts, etc. Ideally, reset everything.
alex- 4y ago
I initially assumed I would be safe because of 2FA. Sadly it looks like this is not the case, the second factor is used to access the encrypted data, not decrypt the data. As the attacker already has the encrypted data, they have bypassed the stage where 2FA is providing protection. This appears to also be the case for 1password and bitwarden, so not specifically a lastpass failure.

pmlnr 4y ago

Keepassxc + syncthing.

sufficient 4y ago

I think we can do better in protecting vaults against offline brute force attacks. As written in the this post, 1Password uses a randomly generated "secret key" together with the user-chosen master password. This "secret key" is not stored on 1Password's servers, instead it should be printed on a piece of paper and stored safely. While this is a good starting point, it significantly reduces usability, since you need this piece of paper when re-installing 1Password. At heylogin, we are rethinking this cryptographic design. In our case, a random secret is generated inside the smartphone's security chip. From this secret, all keys for encryption are derived. The smartphone app and the browser extension is end-to-end encrypted and authenticated using an out-of-band QR code. This results in the following UX: To log into a website in the browser, the user needs to confirm on the phone. The app now provides the extension with temporary access to the passwords etc (a little bit more complicated to explain here). Thus, if the same breach would happen to us, the vaults would still be secure, since the e2ee does not depend on a user chosen master password. It's not easy to get a foot in this market, but I am confident, we can do it.

mdaniel 4y ago
> since the e2ee does not depend on a user chosen master password. What's the story with "my phone went in the lake" using that setup?
- isthisthingon99 4y ago
  Since i use Google Authenticator for numerous services this is going to happen to me one day. So what I did was set it up on more than one phone.
  - mdaniel 4y ago
    I would legit pay money for Google to pull that piece of junk from the Play Store, because it's damn malpractice at this point, given there are so many other options that don't straight-up swallow the TOTP keys
    - 4y ago

SCLeo 4y ago

>> The cloud storage service accessed by the threat actor is physically separate from our production environment. > Is that supposed to be reassuring, considering that the cloud storage in question apparently had a copy of all the LastPass data? Or is this maybe an attempt to shift the blame: “It wasn’t our servers that the data has been lifted from”? Wow, seriously, they are really good at this. If not for this explanation, I would totally thought only testing environment got accessed.

AlbertCory 4y ago

A (perhaps) unconventional approach to password management, which I recommend to anyone. If you enjoy complexity, this is too simple for you. No one can steal something that's not written down Just like the Navajo code talkers in WW II had a system that was memorized, so even if the Japanese captured another Navajo and tortured him (which they did), he couldn't reveal the code. Have some hints to yourself, and store the hints. Even if the file is stolen, the hints won't help the thief. Never, never store a "master key" of what all the hints mean. If you forget one, just click the "forgot my password" link. I'm not going to even hint at the hints :) I use.

deleted 4y ago
[deleted]
maphew 4y ago
This used to be my main approach, but now I only use it for some key sites and rely on a password manager for the other 90%. Why the change? Watching the mental deterioration of aging on friends and family, and noting the beginnings of such things in myself. My mind is so much slower than it used to be, including recall. It's not only aging. A friend had a concussion from a lousy picture frame falling off the wall. It wasn't even that big or heavy. 3 years later still slowly rebuilding mental and language function.
maphew 4y ago
I forgot the other part of my reasoning: my hints only work for me. If I am incapacitated in a way that affects my password recall the hints won't mean shit to my family.
- AlbertCory 4y ago
  You've hit on it: The big advantage is, the hints are only meaningful to you. The big disadvantage is, the hints are only meaningful to you.
Vinnl 4y ago
Oh, perfect. A three-letter word, "earth revolves around the ...". I didn't write it down, so no one can steal it. Simple indeed, thanks!

ericmcer 4y ago

Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on paper). I had to amend it to account for some services that require you to reset your password to a new one and for sites with annoyingly specific password formats (i.e. 3 special chars).

deleted 4y ago
[deleted]
darrenf 4y ago
Not necessarily a huge flaw and indeed it’s a method I used for a long time too - but what it doesn’t really help with is when there’s a breach and one of your passwords is in a leak. What do you do: make (and remember) an exception and the second choice function? Or change all your passwords so an amended function still holds true for all sites? With a password manager you just change the breached one and that’s it.
robust-cactus 4y ago
This is pretty cool, and could even make a great "no storage" type product here. Hmm 1 problem could be forced password changes? I've noticed some sites at times require password changes.
- drexlspivey 4y ago
  It’s not, you can guess all his passwords if you know a couple of existing passwords (maybe even 1)
deepserket 4y ago
> function that takes the product name as input and spits out a password Can someone infer the function starting from the password and the service name? If yes, then there is a low (close to zero, unless you are specifically targeted) possibility to gain a clear password from a shitty website and calculate your other passwords.

xfz 4y ago

Thankfully their UX is awful, which prompted me to switch to 1Password. It feels like they're milking a cash cow rather than trying to improve the product.

nfca 4y ago

In the case of something as critical as a password-manager, quality of customer service, I believe, is a critical factor. When there is a problem, how helpful is the customer service? If not then a person stands to be locked out of critical aspects of their digital life

fudgefactorfive 4y ago
While having a Customer Service Rep tell you you're shit out of luck if you can't remember your master password may suck, it's pretty much the only way to actually be some semblance of safe. The Mud-puddle test is to demonstrate that only you can access your services. If you can call and go "hey can I get back into my vault" so can anyone that convincingly can make the same call on your behalf.

bberrry 4y ago

My LastPass account literally had ONE iteration of pbkdf2 (https://i.imgur.com/34aIOzO.png https://i.imgur.com/34aIOzO.png) and it seems I'm not the only one: https://snabelen.no/@vegardlarsen/109575002998425618 https://snabelen.no/@vegardlarsen/109575002998425618 Absolutely amateurish. I hope no one trusts LastPass ever again.. I know I won't. My account was registered 2010 if anyone is interested.

palant 4y ago
Thank you for this confirmation. I already suspected that LastPass failed upgrading people’s security settings for each change of defaults they made. But so far I’ve only seen one person who found an account with one iteration (that was their very first default). Now you gave me two more.

firstSpeaker 4y ago

"We learn here that LastPass was storing your IP addresses. And since they don’t state how many they were storing, we have to assume: all of them. And if you are an active LastPass user, that data should be good enough to create a complete movement profile. Which is now in the hands of an unknown threat actor." Scary for activists anywhere.

sydbarrett74 4y ago

A lot of people argue that a cloud provider has more expertise in a given domain than a customer for whom IT isn't a core competency. I reject this argument. What we have here is the classic principal-agent problem in economics. Your data is (or should be) sacred to you. LastPass's regard for your data is only proportional to the profit they think they can extract from you. Beyond that, they only answer to Citrix's shareholders. (Citrix, or Shitrix as I call them, is ultimately the parent company.) I swim against the prevailing current in believing that the cloud should only serve as a backup, never as the primary solution.

jsutton 4y ago
Cirtrix hasn't ever been the parent company to LastPass. LogMeIn bought Citrix's GoTo product division, and also bought LastPass, so that's the extent of their relationship. LogMeIn and subsequently LastPass is has been owned by the private equity firm Francisco Partners since 2020. Ire can be focused on Francisco Partners as they completely gutted LastPass and other LogMeIn products shortly after acquisition.

mcoliver 4y ago

Question that may have been answered but I'm coming up short with searches. What about LastPass Authenticator TOTP seeds. Were those compromised as well?