3 ms·

It would be interesting to hear people’s life philosophy in this area. For me, lastpass always seemed like a bad idea as passwords are very important to me and

It would be interesting to hear people’s life philosophy in this area. For me, lastpass always seemed like a bad idea as passwords are very important to me and giving someone else a copy of my passwords seems like a bad idea. Similarly, I don’t let any services know my bank passwords even if they super promise to protect them and not misuse them. Another similar seeming task that I can’t delegate is to read my bank statements and keep track of my assets and performance. This isn’t meant to shame people who are now at risk from lastpass’ failure, but to understand if HN readers have similar personal habits and rules.

drbawb 4y ago
It's a tradeoff based on convenience. I use Linux, Windows, Android, and iOS on a daily basis; using some combination of SyncThing, OneDrive, Google Workspaces, and iCloud. Getting an offline-first PW manager to work correctly and consistently across those devices, operating systems, and services is no easy feat. Doubly so if you actually want proper integration with the OS & browser keychain. At some point the closest you'll get is a self-hosted BitWarden instance, in which case you are basically running LastPass/1Password/et al. yourself anyways. Then you have to ask yourself (a) can you host it cheaper than a monthly subscription of a competing service, and (b) can you maintain that instance better _in your free time_ than some engineers that get paid to do it every day? The answer to (a) for me is definitely not, my colo bill is much larger than a 1pass subscription, and (b) is also probably a big fat no considering there were concerns in this article I hadn't even thought of. So ultimately I'm happy paying a nominal fee for someone to keep up w/ the ever changing landscape of OS/browser integrations & minefield of security pitfalls regarding credential storage. I wish there was some elegant way to magically kept all my devices in sync, that was portable & standardized, but the reality is modern vendors seem more interested in creating silos than standards. --- However there are things I don't put in my 1pass, despite it having great support for them, because I consider the alternatives more convenient or secure: (1) My PGP/SSH keys are on a YubiKey (2) My 2FA TOTP codes are on that YubiKey or some other authenticator (3) My 2FA backup codes are on an encrypted volume. That secret is not stored in 1pass. (4) My critical services (DNS, e-mail) require hardware backed 2FA. The theory being even if you steal my PW vault you can't own my DNS, without my DNS you can't own my MX, and without my MX you can't truly own my online identity.
TillE 4y ago
> and giving someone else a copy of my passwords Except you're not doing that. You're giving someone else an encrypted blob. The screwup here is that LastPass also stored a bunch of unencrypted metadata.
codexon 4y ago
I would never put financial passwords in a cloud based password manager. Even if they do everything perfectly encryption-wise, no one can guarantee an attacker wouldn't alter the client-side code to leak your master password. Having said that, it is still useful for less important logins like this website for example, where it isn't a big deal if someone manages to use the account. However it is a huge privacy issue if people know what accounts you have. For example, I have a hackforums account and pretended to be a normal user there while only using it to scout attack vectors to patch. But to some people, they might assume that I was partaking in actual hacking which is not the case.
- klabb3 4y ago
  > I would never put financial passwords in a cloud based password manager. At this point any financial institution has 2FA, I think. That still leaves say credit cards, but they are exposed enough that you’re not exactly making it worse even with a terrible custodian like LastPass.

drbawb 4y ago

It's a tradeoff based on convenience. I use Linux, Windows, Android, and iOS on a daily basis; using some combination of SyncThing, OneDrive, Google Workspaces, and iCloud. Getting an offline-first PW manager to work correctly and consistently across those devices, operating systems, and services is no easy feat. Doubly so if you actually want proper integration with the OS & browser keychain. At some point the closest you'll get is a self-hosted BitWarden instance, in which case you are basically running LastPass/1Password/et al. yourself anyways. Then you have to ask yourself (a) can you host it cheaper than a monthly subscription of a competing service, and (b) can you maintain that instance better _in your free time_ than some engineers that get paid to do it every day? The answer to (a) for me is definitely not, my colo bill is much larger than a 1pass subscription, and (b) is also probably a big fat no considering there were concerns in this article I hadn't even thought of. So ultimately I'm happy paying a nominal fee for someone to keep up w/ the ever changing landscape of OS/browser integrations & minefield of security pitfalls regarding credential storage. I wish there was some elegant way to magically kept all my devices in sync, that was portable & standardized, but the reality is modern vendors seem more interested in creating silos than standards. --- However there are things I don't put in my 1pass, despite it having great support for them, because I consider the alternatives more convenient or secure: (1) My PGP/SSH keys are on a YubiKey (2) My 2FA TOTP codes are on that YubiKey or some other authenticator (3) My 2FA backup codes are on an encrypted volume. That secret is not stored in 1pass. (4) My critical services (DNS, e-mail) require hardware backed 2FA. The theory being even if you steal my PW vault you can't own my DNS, without my DNS you can't own my MX, and without my MX you can't truly own my online identity.

TillE 4y ago

> and giving someone else a copy of my passwords Except you're not doing that. You're giving someone else an encrypted blob. The screwup here is that LastPass also stored a bunch of unencrypted metadata.

codexon 4y ago

I would never put financial passwords in a cloud based password manager. Even if they do everything perfectly encryption-wise, no one can guarantee an attacker wouldn't alter the client-side code to leak your master password. Having said that, it is still useful for less important logins like this website for example, where it isn't a big deal if someone manages to use the account. However it is a huge privacy issue if people know what accounts you have. For example, I have a hackforums account and pretended to be a normal user there while only using it to scout attack vectors to patch. But to some people, they might assume that I was partaking in actual hacking which is not the case.

klabb3 4y ago
> I would never put financial passwords in a cloud based password manager. At this point any financial institution has 2FA, I think. That still leaves say credit cards, but they are exposed enough that you’re not exactly making it worse even with a terrible custodian like LastPass.