5 ms·

An interesting read, but I wish it had come from literally any other source. This feels very much like kicking a competitor when they are down, and pretty tacky

An interesting read, but I wish it had come from literally any other source. This feels very much like kicking a competitor when they are down, and pretty tacky.

kmbfjr 4y ago
It may be kicking LastPass, but it may also be trying to head off customer defections away from ALL cloud password managers. What happened at LastPass is likely to shake customer confidence of all vendors.
- deleted 4y ago
  [deleted]
- cmer 4y ago
  I agree. I think it was totally justified and well timed. I'm glad they came out explaining why they're different and better, and why they can be trusted. What's pretty tacky is how LastPass is lying, or at least misleading when pretending that LP master passwords cannot be cracked.
- aussiesnack 4y ago
  Yes, seems fair enough to me. Most people (quite reasonably) just aren't going to get the nuances differentiating cloud-based pw managers. One blog post isn't going to change that in itself, but it's fair for Agilebits to get the word out where they can. It's natural they don't want to suffer reputational damage consequent on a competitor's breach.
Obscurity4340 4y ago
Lastpass needs to be kicked until its dead. You don't get do-overs with mistakes of this magnitude. Their customers (if they are responsible) basically need to go through everything and setup a new password + maybe add 2FA (+ re-input all of this in a new platform). That could be for hundreds of accounts. Giant pain in the ass and they still have to worry about their vaults being out in the ether or sold on the Dark Web and hacked in some distributed way.
- runamok 4y ago
  There are definitely ways to export passwords from what I have read though I don't think there are convenient ways to import. I use LastPass families with my wife so my rough plan is to: 1. Evaluate 1password, bitwarden, etc. for feature parity 2. Rotate highest value passwords like email, financial, critical things without MFA, etc. 3. Prune and unused junk 4. Export from LP and import into it's replacement 5. Cancel LP I guess maybe 2 will come after 4 since I'd like to avoid adding any new PWs into LP. I am not even that angry they got hacked but mostly angry about how they handled the encryption cycles of legacy users (5000 vs the current 100100) and that hackers were in their systems for many months and could exfiltrate customer vaults without them noticing.
deleted 4y ago
[deleted]

An interesting read, but I wish it had come from literally any other source. This feels very much like kicking a competitor when they are down, and pretty tacky.

kmbfjr 4y ago

It may be kicking LastPass, but it may also be trying to head off customer defections away from ALL cloud password managers. What happened at LastPass is likely to shake customer confidence of all vendors.

deleted 4y ago
[deleted]
cmer 4y ago
I agree. I think it was totally justified and well timed. I'm glad they came out explaining why they're different and better, and why they can be trusted. What's pretty tacky is how LastPass is lying, or at least misleading when pretending that LP master passwords cannot be cracked.
aussiesnack 4y ago
Yes, seems fair enough to me. Most people (quite reasonably) just aren't going to get the nuances differentiating cloud-based pw managers. One blog post isn't going to change that in itself, but it's fair for Agilebits to get the word out where they can. It's natural they don't want to suffer reputational damage consequent on a competitor's breach.

Obscurity4340 4y ago

Lastpass needs to be kicked until its dead. You don't get do-overs with mistakes of this magnitude. Their customers (if they are responsible) basically need to go through everything and setup a new password + maybe add 2FA (+ re-input all of this in a new platform). That could be for hundreds of accounts. Giant pain in the ass and they still have to worry about their vaults being out in the ether or sold on the Dark Web and hacked in some distributed way.

runamok 4y ago
There are definitely ways to export passwords from what I have read though I don't think there are convenient ways to import. I use LastPass families with my wife so my rough plan is to: 1. Evaluate 1password, bitwarden, etc. for feature parity 2. Rotate highest value passwords like email, financial, critical things without MFA, etc. 3. Prune and unused junk 4. Export from LP and import into it's replacement 5. Cancel LP I guess maybe 2 will come after 4 since I'd like to avoid adding any new PWs into LP. I am not even that angry they got hacked but mostly angry about how they handled the encryption cycles of legacy users (5000 vs the current 100100) and that hackers were in their systems for many months and could exfiltrate customer vaults without them noticing.

deleted 4y ago

[deleted]