14 ms·

I Lost All Faith in LastPass

303 points by cdme 4y ago

paultopia 4y ago
question for those who know: for those of us in apple ecosystem, is just relying on their keychain an acceptable alternative to a third-party password manager company?
- nebulous1 4y ago
  Also how, say, firefox's password manager compares. I've tried to look up technical comparisons before but found them unconvincing (making clearly outdated or incorrect claims). You can get the standalone managers compared to each other, but the non-standalones are missing.
  - rtev 4y ago
    I do know the answer to this - Firefox is not an acceptable alternative to a strong password manager. Local admin can dump any passwords from Firefox, and I think a user can even dump their own passwords from Firefox on windows and Linux.
    - nebulous1 4y ago
      They do have a "primary password" these days which I believe encrypts the locally stored passwords and the locally stored sync key.
    - smallerfish 4y ago
      I don't think that matters. Local admin can also install a rootkit or a keylogger. Physical/admin access is game over no matter what you use.
- judge2020 4y ago
  If your passcode(s) on your device are longer than 6 digits, sure. As it stands, you can recover your iCloud Keychain by either[0]: (A) signing into iCloud (Requires Apple ID Password) + approving the new device on an existing device that has Keychain access or (B) signing into iCloud (Requires Apple ID Password) + performing SMS 2FA + entering the device passcode of your primary device The threat model here is where a nation-state actor enlists the full cooperation of Apple and gets Apple to hand over your encrypted iCloud Keychain, then gets Apple to siphon your Apple ID password next time you sign in. They could then use those two pieces of information to brute force the passcode on your encrypted Keychain data. If you have an 8+ digit passcode, or an alphanumeric passcode, that makes it exponentially harder to brute force. With the long passcode, your only remaining threat would be Apple shipping malicious hidden code or an RCE in their product that allows them to force your device to approve new devices non-interactively, which would allow them to approve a malicious device the next time you approve your own new device for access to iCloud Keychain. Or perhaps it's more likely that, when you're setting up a new device, Apple sends over the name of your new device, but with the public key/CSR of their own device, since iOS doesn't show a key fingerprint during device approval or anything. 0: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych...
  - DavideNL 4y ago
    > As it stands, you can recover your iCloud Keychain by either... I remember, a long time ago when i created an AppleID, there was a yes/no choice whether or not to upload [something related to the password] to Apple, so it would become possible to recover the AppleID password if needed in the future. Is that still a thing, or has it been replaced by new features now?
- rtev 4y ago
  Good question. Can local admin dump apple keychain passwords? If so, hashed or plaintext?
- pvg 4y ago
  Relying on your browser/OS password manager is, for the vast majority of people, a better alternative. These days you get pretty decent integration even if you use Chrome on macOS and want your passwords to show up on your iPhone.
- zeroonetwothree 4y ago
  Seems unnecessarily risky. Do they have an export flow? What if you get a non Apple device?
Finnucane 4y ago
Well, that sounds bad. I mean, I'm not an infosec expert, but I can follow enough of that to see that it's not good. I use Lastpass at work, because we have a site license, but maybe I'll look into whether I can switch over to bitwarden. I don't expect perfect security, but I expect them to at least try.
- AceJohnny2 4y ago
  You have to understand that this isn't an isolated event. LastPass is uniquely bad at this, and it is, for many, the last straw.
wnevets 4y ago
Has LastPass always been this bad and nobody noticed or did the new owners change it?
- samwillis 4y ago
  I think the answers is yes, there has been grumbling about LastPass for years. Prior to them being owned by LogMeIn. They were hacked back in 2015 too: https://www.wired.com/2015/06/hack-brief-password-manager-lastpass-got-breached-hard/ https://www.wired.com/2015/06/hack-brief-password-manager-la... > On Monday password manager service LastPass admitted it had been the target of a hack that accessed its users' email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords. (That's from 2015 but could read like the other week!)
  - zeroonetwothree 4y ago
    I switched to Bitwarden right after that hack and it’s been great
- weakfortress 4y ago
  Yes. But prior to this breach it was easy to look the other way due to the extremely large amount of inertia associated with changing a manager and all your passwords. I know this was the case for me. In August we thought it was simply another "simple" breach. E.g. they got hold of some information that would be useful to spearphish or whatever but not the vaults themselves. No big deal, just be on the lookout for emails. Once it came to light they lost control of their vaults the calculus changed. In my memory this is the largest, most prolific breach in history. Every other breach of a major site pales in comparison. The only solution is to change password managers immediately (I went to 1password) and begin the process of changing everything and updating your security posture. Unfortunately, the hackers also have an insane amount of metadata on customers. So if you stored incriminating (either legally or socially) websites in there the hackers now have a lot of leverage to get you to bend the knee. In summary, lastpass has been on the down slope for a long time. But it was easy to just accept this and work around it. This breach changed everything. It revealed their incompetence in full and woke a lot of people, including myself, up to just how hard it is to trust a company. It's just not enough anymore to have a big company slapped onto your logo (LogMeIn) and hope they provide the correct mitigations through experience. From now on I, and many people I know, will be carefully evaluating their choices with password managers, etc from now on. I don't think their CEO can be trusted especially with all the weasel words used in the disclosure and the timing of the disclosure. They showed no respect for their customers in either the aspect of security or disclosure. If you know nothing else about this breach that should be enough to get you and everyone you know to run.
rvz 4y ago
I think I have lost count at how many security issues and breaches people have tolerated with LastPass to realise that enough is enough. By just searching "LastPass" it is almost always a security breach or hack. [0] [0] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=LastPass&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
nine_k 4y ago
The post looks a bit weird on first sight: "I always knew LastPass has a ton of flaws, but promoted it anyway". This may make sense though. LastPass seemed to be the only one with a good enough UX. And without a good enough UX, you can't make users actually use it. Using an imperfect but usable password manager is still much better than not using one with better security but poor UX. (Here comes the old adage: make the friction low for the customer, and any shortcomings elsewhere will matter little.)
- ascendantlogic 4y ago
  Security is not a binary thing. It's a spectrum and for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc. It's only after multiple episodes of what amounts to malicious incompetence that the cure becomes worse than the disease. I think we're collectively agreeing we've reached that point with LastPass.
  - LarryMullins 4y ago
    > for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc Indeed. Writing down passwords on a pad of paper next to your computer is a valid practice for most people if we're being realistic, particularly for personal computer use. Even leaving passwords in an unencrypted text file on your desktop is not nearly as bad today as it used to be 20 years ago. Pretty much anything is better than using the same 8 letter password on every single website. That's the status quo which needs to be toppled.
- jeffybefffy519 4y ago
  I think a lot of people promoted it because it has a free tier - getting people to switch to password manager and paying money is a hard sell.
- s17n 4y ago
  It seems like using lastpass was worse than not using a password manager, though (if you had an old vault that is going to get cracked).
majkinetor 4y ago
God damnit, but what doesn't. I am sure BitWarden has its own problems and it (seems?) not 100% FOSS but its core is. LP extension and web vault ARE pure garbage: 1. It can't even recognize sites correctly ?! WTF really. I usually get 10 or so (looks like random) hits for any site but not the one that I should. 2. It offers me to extend pro support 5 years after I stopped paying for it. What I need to do for it to stop ffs. 3. Its UI is simply outrageous, i.e. if you search something it shows empty folders among those that contain the item etc. I recommend NextCloud Passwords plugin: https://apps.nextcloud.com/apps/passwords https://apps.nextcloud.com/apps/passwords Its awesome, supports team work, and if you have NC its no brainer. Probably too much work to install NC if you don't use it but in small company settings its probalby good idea as you need online office anyway.
- jsmith99 4y ago
  Which bit of bitwarden is not FOSS?
  - majkinetor 4y ago
    It looks like premium features are not foss, like SSO for example (but I might be wrong): https://bitwarden.com/help/about-sso https://bitwarden.com/help/about-sso > Login with SSO is available for all customers with an Enterprise organization
    - jsmith99 4y ago
      Only saw the reply late. All enterprise features seem fully open source. Eg SSO is in the source at https://github.com/bitwarden/server/tree/master/bitwarden_license/src/Sso https://github.com/bitwarden/server/tree/master/bitwarden_li... Correction: that part of the source seems to be only 'source available' rather than FOSS.
- peterangular 4y ago
  I moved to Bitwarden from KeePass and haven't looked back. The UIX of Bitwarden can be a bit meh at times but it's also boring, predictable, and solid. I'm just saying this as someone who hates save buttons in the upper-right hand corner of things - just... small nitpicky stuff like that. Sometimes I have to look for a button or their use of iconography confuses me a bit. I would do my own hosting for a distributed password database but the older I get the less I trust myself to keep that stuff locked down and patched. Given the number of users I feel Bitwarden has more skin in the game to keep their solutions tight. If you're not looking to self-host I can't recommend Bitwarden enough!
FatActor 4y ago
How do we know 1Password doesn't have similar glaring oversights like LP? We can't audit their code unless it is open source? I'm not going to just believe them at face value because some random internet personality says so. Unless some respected authority can publish an audit of the security posture and source code, we're just taking them at their word. Granted, if I had to chose today, I would instantly pick 1Password based on what I can find on google, and LP has far, far more leaks than 1P. But let's not kid ourselves that 1P is somehow more trustworthy without audits. And I'll eat crow if 1P has proof that they are routinely audited by 3rd parties. EDIT: removed snark. EDIT#2: If Signal can publish open source, why cant 1Password? If security is done right, the source code should be visible to everyone without jeopardy, or at least that's what I've been led to believe. EDIT#3: Thanks for the link y'all, here it is at top level: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... ... mmmm crow EDIT#4: We trust browsers too much. 1P stores the secret key on every device so that you only have to enter your passphrase. I'd really like that code to be public because that's a great way to lose control of everyone's secret key. Extensions worry me because they are a critical component in any password manager's usability-vs-security. But perhaps that is a digression or worth an Ask HN.
- samwillis 4y ago
  There is a white paper on 1passwords design: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... They also regularly have audits and pen tests, with the reports pushed publicly: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ Finally, it's been built by people who are respected in the security industry.
  - FatActor 4y ago
    Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.
geocrasher 4y ago
After reading this, I acted on a decision I was on the fence about. I already have moved to Bitwarden and like it a lot better, but this post prompted me to go into LastPass and actively delete my account. The next thing to do will be to start changing passwords. As with most of us, that's a project of serious scope that I do not look forward to.
- barbazoo 4y ago
  I switched to 1Password a long time ago but never deleted my LP account unfortunately. Did so this week, AFTER the recent breach.
- joegahona 4y ago
  > As with most of us, that's a project of serious scope that I do not look forward to. I've spent the better part of the past three days doing just this. Get some good music and some good coffee, and it can actually be pretty cathartic. I enjoyed the hygiene exercise much more than I thought I would.
  - cmurf 4y ago
    Some accounts I'm just deep sixing by changing the password with the online service but then not recording it anywhere. Buhbyeeeee!
    - joegahona 4y ago
      Yes! I too have had many sites fall into that category. Also it's been a fascinating exercise in user-interface/-experience competitive research. Some websites just do not give a crap. Here's one gem: https://i.imgur.com/yBLmuHt.png https://i.imgur.com/yBLmuHt.png I can't help but feel pity for the local/city-level websites though. You can tell they've just Frankenstein-d stuff together on meager budgets and under crippling administrative loads.
- dqv 4y ago
  So I've been doing this and I strongly recommend keeping LastPass (LP) until you've deleted all your credentials from there. My workflow is to launch the login from LP (using the app), use those credentials, and change the passwords using Bitwarden. Otherwise, you might accidentally set a new password that doesn't actually work and have to go through painful password reset processes.
danShumway 4y ago
I moved off of LastPass a while ago, but hadn't actually deleted my account because of laziness/inertia. This breach was finally the impetus to get me to full-on delete my vault and start the process of cleaning up my old accounts. Luckily I've been off of it long enough that I suspect most of my regularly used accounts are different anyways, but I'm still going through the process now of methodically rotating all of them (I may change some of the email addresses as well). ---- I think a lot of people even casually knew LastPass wasn't at the same quality level as other solutions, but inertia is powerful. Sometimes you need something glaring to be the final straw that breaks the camel's back. It's been long overdue; I moved off of Gmail as well a while ago but haven't gone through and systematically changed all of my account email addresses; there are still a few older services I have that send emails over. The new year is a good opportunity to clean that stuff up.
- ChrisClark 4y ago
  The scariest part was it was a backup of theirs that was stolen. So deleting all your info might not have even protected it. It could still be in an old backup and get stolen. :( I've deleted my stuff now anyway, it's all we can do. :(
  - kcartlidge 4y ago
    > The scariest part was it was a backup of theirs that was stolen. I knew it was a backup, but I don't recall seeing anywhere how old it was. Do we have any more information? My data was confirmed deleted by them mid last year when I moved to BitWarden, and I'm hoping the backup was older. If not then I'm in the unfortunate position of being at greater risk than those who signed up more recently. I need to change everything anyway just in case, but knowing more would help with peace of mind. I used them for so many years I probably only had the 5,000 (or maybe even the 500) iteration config they never once mentioned.
thefounder 4y ago
Just enable webauthn and forget the passwords non-sense
- gizmo 4y ago
  You cannot use webauthn for e2ee apps because you cannot have webauthn manage a public/private key pair.
- quenix 4y ago
  For the two websites that support it?
bob1029 4y ago
Use of 3rd party password trackers has been a periodic concern for our organization. We do B2B business with banks, so the temperature is increased somewhat. There are kinds of credentials we have access to that genuinely terrify me. I've been debating building an in-house solution for managing secrets, if for no other reason than to get all of this information off of 3rd party computers. No serious proposals have been put forth, but I don't think this stuff is exactly rocket science either. Our requirements are functionally-equivalent to a copy of passwords.xlsx on a network share.
- 1123581321 4y ago
  If I were a bank customer, I would not want to hear your second paragraph…
  - bob1029 4y ago
    The system is fairly broken from my perspective. Especially, as the size of the financial institution decreases. We work with smaller customers. At this small scale, everything is vendored out. Many times, 2+ different vendors will need to directly exchange something like a password for the bank's core system. Email is the preferred technique, typically with some theatrical secure email crap on top - involving yet another 3rd party in the secret exchange mess. As you get into the scale of an organization like Capital One or BofA, you start to see more of that Hollywood-style credential exchange & control with multiple consenting parties, Iron Mountain trash cans, biometric doors and one-time passwords. If you are concerned about the IT/security of your financial institution, you may prefer larger ones. These have more employees running just IT compliance than many of our clients have in total. If you are concerned about bad customer service or losing access to funds, you may prefer smaller ones. Being able to realistically talk to a board member of the bank about a dispute makes a lot of people feel better about where their money is.
- 29083011397778 4y ago
  Why not whichever Keepass client you prefer, and Syncthing (if it's even necessary for your use-case)? Open-Source, old enough to have a few revisions and be looked at pretty closely, completely off-line, and forgiving if updates are needed to passwords (with many clients having the option of merging changes with your open database). This way, you don't make the same mistake as Telegram as well; I.E., don't roll your own crypto if you can help it, especially if there are ready-made tools that already do what you want, doubly so when those tools are battle-tested and looked over by actual experts.
LarryMullins 4y ago
I think that keepass with periodic manual backups of the keystore is the right solution for most people (maybe not for orgs.) I've never trusted these "cloud" password companies to do their job right.
snehk 4y ago
I used to be a LastPass user and also used to use their GoTo services for work. Shortly before all of this was revealed, I noticed a problem with their API and sent their customer service team message about how their API is not working correctly and is simply responding with wrong data and they basically said "too bad" and said they weren't gonna fix it due to time constraints. I even tried their forums but they deleted the Thread, marking it as "Spam". I then stopped using my account on LastPass and literally a few weeks later they revealed the "security incident". Had to change all my passwords but I'll never get near this company ever again.
jrochkind1 4y ago
> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)
- grecy 4y ago
  > What are the security problems with garbage-collected languages? None that I'm aware of. I think this is a petty swipe at programmers who use garbage-collected languages, implying they're "less" than programmers who use "real" languages that don't have garbage collection.
  - deleted 4y ago
    [deleted]
- kstrauser 4y ago
  At the risk of conjuring a strawman, I've heard people worry about the loss of control, like maybe the process has some sensitive data in RAM that it will release and then the OS will alloc() it to another process. And that's true on one level, but nothing prevents a garbage collected language from overwriting all the data in a block of RAM as it free()s it. I think the risk of memory related bugs in a non-managed language is far, far greater than any GC-related hypothetical risks. And then you have languages like Rust which "feels" like it's a GC language because it manages all the alloc()s and free()s for you, but isn't GC at all because the language's semantics make those calls deterministic. I'd vastly rather see sensitive security software developed in a modern garbage collected language (or in Rust and similar languages) than in C or C++.
  - IcePic 4y ago
    > At the risk of conjuring a strawman, I've heard people worry about the loss of control, like maybe the process has some sensitive data in RAM that it will release and then the OS will alloc() it to another process. I'm sure some people worry about this, but I think you will be hard pressed to find a modern OS that actually would give away your contents to another PID. Just because a program can malloc(8), fill eight bytes with known content, free() the pointer, malloc(8) again and see their old content doesn't mean the OS hands your data to anyone, just that the libc (or whatever runtime you use) is not actually getting a whole page for that single 8 byte malloc, and it didn't give it back to the OS at free() either, so you "owned" the page where those 8 bytes lives all the time during execution of this simple test. The limit for which your allocator starts _actually_ handing back data is probably never less than 4k and upwards to 256k depending on page size, malloc settings and OS/libc defaults. So while there are a lot of traps code can fall into as mentioned in other comments in this thread, I think everyone can stop worrying about "the next program to malloc() will get my old data" because that just doesn't happen.
samtho 4y ago
I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin in the Infosec world. As an aside, it’s interesting to see their fall from grace from their reception section on Wikipedia: https://en.m.wikipedia.org/wiki/LastPass#Reception https://en.m.wikipedia.org/wiki/LastPass#Reception I’m moving to bitwarden and not looking back. I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually.
- Fire-Dragon-DoL 4y ago
  I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked together PR from myself that will help you export the password history The import worked very well in 1password aside from attachments/history. What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag
  - metabagel 4y ago
    >> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.
    - samtho 4y ago
      I ran into this before, actually. As of about a year ago, Lastpass partially used cached data to generate some portion of exported data, but that cache is not diligently kept up to date.
pleb_nz 4y ago
Reading through these comments I am surprised at how many people were/are still using LsstPass. I used it until they had an incident 5 or 7 years ago. And there face need others since. How many chances did an organization get with highly sensitive information before people move on?
Barrin92 4y ago
I feel like a shill at this point but just use Bitwarden. open source, cloud sync by default, alternative self-hostable backend if you want to, no device limit, doesn't cost anything which is just about the only thing that concerns me because the free plan seems too good honestly.
- DerekBickerton 4y ago
  Bitwarden is great, and their commercial offering of $10.00 per year is so cheap as to be effectively free. My only issue is the fact their servers could be wiped and I no longer have access to my data, but that's where KeepassXC comes in. I keep one Bitwarden and one Keepass DB as a fallback, and keep them updated with the same login entries. I store my KeepassXC database in various cloud storage services, as-well as keeping various local copies.
  - DavideNL 4y ago
    > My only issue is the fact their servers could be wiped and I no longer have access to my data So is the Bitwarden database not also stored/always up to date local (like how IMAP works for e-mail, if the server goes offline you still have all your emails locally) ?
blobster 4y ago
This is why we need good OS-level password managers. Phones and now computers have dedicated security chips which are infinitely more secure than any cloud solution. Such an easy market to grab that it boggles me why Apple and Google aren't aggressively going for it.
- jefftk 4y ago
  Apple and Google both have solid options here, and I'm a happy user of Google's. But I also wouldn't want either of them to push their solutions aggressively, for competition reasons.
  - dns_snek 4y ago
    Do you consider your passwords to be "disposable" or easily replaceable? I could never trust Google with hundreds of passwords. The thought of their AI going haywire and essentially locking me out of the internet is terrifying.
    - jefftk 4y ago
      > The thought of their AI going haywire and essentially locking me out of the internet is terrifying. I think this is really unlikely; since https://news.ycombinator.com/item?id=34092956 https://news.ycombinator.com/item?id=34092956 I've been gathering lockout reports on HN and they're mostly things like adding a phone number to your account and then forgetting about that when switching numbers.
- easeout 4y ago
  iCloud Keychain syncing, strong password suggestions in Safari, and WebAuthn passkeys are all part of Apple's strategy. When they don't buy a third party and deeply integrate it, they tend to operate by insinuating themselves as the platform default. What would you have them add to that?
  - blobster 4y ago
    Their "password manager" on Mac is called Keychain Access. The UX is very bad, the interface is old and clunky and it doesn't sync with iOS (if for example you create a secure note there's no way to access it on iOS) - not to mention that most people don't even know it exists, it's kind of a hidden feature. Meanwhile, on iOS the password manager is hidden in the settings and again it has pretty bad UI/UX. I understand that they want to hide the complexity away from the end user and make these kinds of features "just work", but in practice they feel pretty half-baked.
Havoc 4y ago
Leaning strongly towards self-hosting. Name brand cloud managers just make too juicy a target for sophisticated attackers regardless of their competence/care of the pass manager co. I know it's got a bit of security via obscurity vibes, but I've concluded the combo of residential IP, wireguard, firewall and dedicated VM is probably more secure. That would require someone with decent skill targeting me specifically...in which case they're probably better off with a wrench attack anyway. The big unknown is uptime.
- PartiallyTyped 4y ago
  You can always self-host BitWarden! NB: Not affiliated with the company, just a very happy customer.
  - Havoc 4y ago
    Yeah, trying to decide between bitwarden, vaultwarden and a sync'd KeePassXC implementation. My LP password is thankfully on the stronger side of things so hoping I've got time to try them all
    - michaelcampbell 4y ago
      FWIW, I've used Keepass format for years. Different clients, different syncing mechanisms, but currently on KeepassXC + Syncthing.
  - kivle 4y ago
    I was self-hosting bitwarden-rs (alternative implementation in Rust) in a Docker container, and I had set up Watchtower to automatically update it nightly. I thought I would be relatively safe and keep up with updates. Well, it turns out the project in question had to change their name from bitwarden-rs to vaultwarden-rs since they violated the trademark. Updates stopped being pushed to the original docker image url, and several months passed until I suddenly noticed this. In the meantime I could easily have missed some important security upgrades. I understand it's only myself at fault here, but it made me migrate to a hosted account instead. As fun as it is to self host things, something this security critical is probably better left to dedicated people.
darig 4y ago
[dead]
photonbeam 4y ago
Trusting a 3rd party password manager seems troublesome
- oluwie 4y ago
  By your standards, trusting any 3rd party solution seems troublesome. The entire web is built on 3rd party solutions. Should we all write our encryption libraries b/c we shouldn't trust any 3rd party solution?
- DerekBickerton 4y ago
  For me, one cloud solution, and a local KeepassXC database as a fallback. Works like magic. If the cloud solution (Bitwarden) fails, then I fallback to Keepass.
swarfield 4y ago
Can't believe that they were using Electronic Coloring Book mode!
sys_64738 4y ago
All online cloud password managers have vulnerabilities of some form or another. As computer people why would you think otherwise? I don't understand any of the assumptions that your data would be safe in the cloud. I had this same point to a past employer that LastPass (or other password in the cloud manager) will always be vulnerable. But it falls on deaf ears. I would never, ever trust my passwords to an online storage provider.
- DavideNL 4y ago
  All-or-nothing thinking aka "Splitting": https://en.wikipedia.org/wiki/Splitting_(psychology) https://en.wikipedia.org/wiki/Splitting_(psychology)
miguelazo 4y ago
Great technical reasoning, but no mention of the business practices. This is a consistent result we see when companies are acquired by private equity. Like Thoma Bravo did with SolarWinds, and is doing with Proofpoint. Vulture capitalists destroy the companies they target to extract short term value. This is why I warned people against using LastPass for several years. Sad to see I was already vindicated.
psnehanshu 4y ago
I used Google Passwords for a long time before deciding to move to something not OS dependent. My first pick was LastPass. I used it for maybe one month, but found their browser extension and Android app pretty bad. So I decided to move to BitWarden. I am very glad that I did this, otherwise I would have been changing all my passwords like a maniac.
- tasuki 4y ago
  > I used it for maybe one month You gave them your passwords. What makes you think your passwords are safe?
  - psnehanshu 4y ago
    I deleted my LastPass account as soon as I imported all my passwords into BitWarden, and the passwords for the most critical sites have been reset since then. Moreover I use auto-generated passwords, so no password is used on two sites, plus they are super hard to brute-force.
cwoolfe 4y ago
LastPass user experience has grown terrible over the years. The iOS app regularly freezes for over ten seconds with no response. Trying to login to LastPass on a second device, with 2FA enabled, regularly takes me over five minutes. Why? Login to app. Lastpass tries to auth using watch app. That's broken, so ask for a SMS. Enter SMS. That doesn't work. it wants master password again. Ok we're in! but now whatever flow to login to an app is broken. Open app, try and use the helpful keyboard shortcut that's broken. ok go back to last pass. copy the password. Oops it wants to enter master password again. Ok. Good thing I picked a long master password. Ok now back in. need to search the site I wanted. got it. copy password, switch apps, paste. DONE! Also, security vulnerabilities?! Definitely going to switch to Bitwarden.
Veen 4y ago
He's probably right, but the post gives vibes of "I used to pimp (as he puts it) for LastPass and now I'm pimping for my friends over at 1Password."
luckydata 4y ago
I just canceled my yearly family subscription and moved to Bitwarden which to be fair is less polished in some aspects and more in others. Support refunded me my yearly fee 3 months into the year which was nice, but my feedback for them was that the only way I would ever consider them again would be if they fired EVERYONE in management, got acquired by a company whose reputation I trust and completely rebuilt their product. Which is to say I will never be a customer again or recommend them to anyone ever again.
Nimitz14 4y ago
Hopefully this will stop the replies to comments complaining about stupid password rules: "Just use a password manager". Why would you ever trust someone else with something like this?
- dns_snek 4y ago
  The advice should read "Just use a popular password manager that doesn't have a well-document history of being terrible, from a company that releases their regular security audit reports". The most basic form of "Do your own research" should reveal a long list of security incidents: https://en.wikipedia.org/wiki/LastPass#Security_incidents https://en.wikipedia.org/wiki/LastPass#Security_incidents
olkingcole 4y ago
Thoughts on Bitwarden vs 1Password? I have seen them both suggested by users on this site.
- mattwad 4y ago
  Not sure about 1Password, but I am using Bitwarden free and there's no authenticator app. I just use Authy on Android, though, it works great
  - simsla 4y ago
    I used Duo to set up a similar push notification 2fa system for bitwarden as lastpass had.
  - ScoutOrgo 4y ago
    Does bitwarden work well with autofill? Lastpass was awful with that and very finicky.
    - yolovoe 4y ago
      For the sites I normally visit, it works well. GitHub and some famous banks/credit card providers. Mfa code doesn't autofill, but it's just a click to copy.
      - lavezzi 4y ago
        Pretty sure you can set it to auto-copy the TOTP, so you technically don’t need to click anything
    - lavezzi 4y ago
      They haven’t had the feature for a huge amount of time but it works alright, with some minor mistakes here and there. As with most managers, it struggles when there are more than two fields to populate
  - josteink 4y ago
    > but I am using Bitwarden free and there's no authenticator app There is if you pay $10 annually for Bitwarden Pro. I use it, and it was the game changer I needed in terms of user-experience, to bother actually start using 2FA/MFA for all sites where it was an option (compared to before where I would only do it if required). I definitely recommend giving it a try.
acatton 4y ago
When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password manager is the one absolute thing I want to be auditable. 1Password with its follower "who know people who designed it" reminds me of "trust me bro", "funds are SAFU" in cryptocurrency projects. Leaving LastPass in order to sign up for 1Password feels like out of the pan into the fire. I've always use and will always recommend FOSS for password manager. I install Bitwarden on my technology-illeterate friends and family and I use KeepassxXC personally. I've looked briefly how vaults are encrypted in both software. The security is sound. Bitwarden was audited by Cure53[1] which is one of my favourite security auditing firm. (I highly recommend to read their audit of dovecot[2]) Anyway, you know what they say "fool me once…". I'll be eating popcorn when some claim will turn out to be false for 1Password… [1] https://cure53.de/pentest-report_bitwarden.pdf https://cure53.de/pentest-report_bitwarden.pdf [2] https://cure53.de/pentest-report_dovecot.pdf https://cure53.de/pentest-report_dovecot.pdf
- idiot900 4y ago
  On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.
  - zeroonetwothree 4y ago
    Indeed I think BitWarden has the better UX
  - alyandon 4y ago
    My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.
  - 4y ago
wirrbel 4y ago
Wondering how Enpass Performs
- richardpetersen 4y ago
  Same
- pentest_bob 4y ago
  Closed source requires a lot of trust in this case.
  - dpedu 4y ago
    While source code access is certainly a concern for some, it is worth pointing out that Enpass supports database sync methods such as Dropbox, Google Drive, and a proprietary "wifi" sync. This means that you can have sync like Lastpass or 1Password but retain complete control over your own data. I can't speak to Enpass's security, but I have been a user for several years. It feels less polished than 1Password but is freer and more open.
    - wirrbel 4y ago
      That is what I am using. I guess the Enpass attack would require either an attack on the client on my phone / pc or on the storage provider (if they are able to crack my passphrase). I had assumed lastpass and 1pssword were using the same approach
TillE 4y ago
> In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern This is the key point. Properly implemented, you should feel very relaxed if your encrypted data is leaked. I'm using BitWarden, but 1Password's "secret key" concept is smart, it means your data is still very secure even if your password sucks.
- deleted 4y ago
  [deleted]
mkl95 4y ago
TIL LastPass have been SOC2 and SOC3 certified for a few years. Huge facepalm
- dsjoerg 4y ago
  I'm not following, what's bad about that? Is that bad for Lastpass, or for SOC2/SOC3?
  - mkl95 4y ago
    From my point of view, both.
pjungwir 4y ago
I use a mix of pass(1) and LastPass, but this incident has convinced me to put everything on pass. But I don't really use it the "recommended" way, where you put the password on the first line. It's not a great fit for a consultant when half my customers want to give me my own Gmail/Atlassian/etc account. So I tend to keep big files of free-form text instead. But if I'm going to use it with a browser, the manual copy-paste will get annoying, and I want to switch to the normal pattern. Does anyone have any suggestions? I guess with decent auto-complete I can do something like `google/foo` and `google/bar`. If you have tips let me know!
- malteof 4y ago
  I’ve been using Keepass for a while, it’s great.
- SailingCactus33 4y ago
  I consider the flexibility of pass(1) to be one of the best features. In my case, I use a hierarchy to manage secrets across different orgs and classifications. The structure I use is:[ORGANIZATION]/[CLASSIFICATION]/[SITE|APP]/[USER] e.g.: Personal/Confidential/google.com/pjungwir@gmail.com Client1/Secret/google.com/pjungwir@example.com The folder structure allows for different keys to be used in .gpg-id files, so secret access can be limited on different devices based on which keys are available. For example, only a subset of keys are available on my android phone via the Password Store app from F-Droid, with all devices using a shared password-store synced using git(1). Completion with bash works well (on Fedora) and following the convention of having the password on the first line allows for the android app to work and you don't need to worry about someone looking over your shoulder by using 'pass -c ...'.
  - pjungwir 4y ago
    This sounds like a very nice system, and I'll give it a try. I'm already using git to keep things synced between my desktop and my laptop. I've never even attempted syncing to my phone, but if I do that giving access to only a subset of the keys sounds great.
darkstar999 4y ago
Are they still hiding the Delete Account button?
m000 4y ago
I jumped the LastPass ship a couple of years back. There had been some security incidents at that time, but they could still be downplayed. What drove me away was the lingering impression that they were more focused in figuring out how to monetize their product, rather than improving it: E.g. one year feature X required a $1/m plan, next year it was free, and the third year it required the $5/m plan. At the same time, their apps/extensions seemed sluggish and stagnant. That didn't exactly inspire trust in a product that is essentially the gateway to most of my online activities.
Octokiddie 4y ago
> ... Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. ... Seems bad. I took the author's advice and did the google search "jeremi gosney" + "lastpass". This 2015 article turned up: > A longtime LastPass user himself, Gosney says he doesn’t plan to change a thing following the breach – not even his master password. “I am confident in the strength of my master password. As a password cracker, I know it’s impossible to crack,” he says. https://www.secureidnews.com/news-item/consultant-dont-sweat-the-lastpass-breach/ https://www.secureidnews.com/news-item/consultant-dont-sweat... When the same author now recommends Bitwardenen and 1Password, it's hard to view it as anything other than more of the same. The author might want to tone down the unqualified language around computer security to avoid history repeating itself.
- deleted 4y ago
  [deleted]
JohnTHaller 4y ago
I have multiple folks I know using KeePass with the kdbx synced on Google Drive or similar. The authentication is a combination of a 1KB key file (manually copied onto each device via sneakernet) and a long password.
- wazoox 4y ago
  Exactly. I've used Keepass then KeepassX then KeepassXC, synchronized across devices with Dropbox then now Nextcloud. No problem, the whole database is safely encrypted, and nobody can access it but me anyway.
belter 4y ago
Users still using LastPass remind me of this closing scene: https://youtu.be/wtmnf7QlX_4 https://youtu.be/wtmnf7QlX_4
entropicgravity 4y ago
If you're a small operation it's not stupid to keep your passwords in a google spreadsheet. Google accounts are seeing attempted cracks 24/7 for the last fifteen years (or more) by nation states and it's been a long time since any of their accounts have been hacked. Remember when someone spliced their optical fiber under the Atlantic Ocean? That's what Google is up against. If you follow this. Keep your passwords in triplicate because if you fat finger the mouse over a cell it can evaporate (experience speaking here). Three copies means very little chance of losing a password. And keep a backup of course. Share the spreadsheet among your team. It's very easy to add and delete users. Yes I know this seems cheezy but sometimes the simplest way is the best. Good for up to about ten team members in my experience.
- ahofmann 4y ago
  I think that is dangerous advice. It's easier to use Bitwarden, or KeePassXC in Google Drive, than a spreadsheet where you have to follow such rules. And the former ist much more secure against a lot of mistakes and attacks.

303 points by cdme 4y ago

question for those who know: for those of us in apple ecosystem, is just relying on their keychain an acceptable alternative to a third-party password manager company?

nebulous1 4y ago
Also how, say, firefox's password manager compares. I've tried to look up technical comparisons before but found them unconvincing (making clearly outdated or incorrect claims). You can get the standalone managers compared to each other, but the non-standalones are missing.
- rtev 4y ago
  I do know the answer to this - Firefox is not an acceptable alternative to a strong password manager. Local admin can dump any passwords from Firefox, and I think a user can even dump their own passwords from Firefox on windows and Linux.
  - nebulous1 4y ago
    They do have a "primary password" these days which I believe encrypts the locally stored passwords and the locally stored sync key.
  - smallerfish 4y ago
    I don't think that matters. Local admin can also install a rootkit or a keylogger. Physical/admin access is game over no matter what you use.
judge2020 4y ago
If your passcode(s) on your device are longer than 6 digits, sure. As it stands, you can recover your iCloud Keychain by either[0]: (A) signing into iCloud (Requires Apple ID Password) + approving the new device on an existing device that has Keychain access or (B) signing into iCloud (Requires Apple ID Password) + performing SMS 2FA + entering the device passcode of your primary device The threat model here is where a nation-state actor enlists the full cooperation of Apple and gets Apple to hand over your encrypted iCloud Keychain, then gets Apple to siphon your Apple ID password next time you sign in. They could then use those two pieces of information to brute force the passcode on your encrypted Keychain data. If you have an 8+ digit passcode, or an alphanumeric passcode, that makes it exponentially harder to brute force. With the long passcode, your only remaining threat would be Apple shipping malicious hidden code or an RCE in their product that allows them to force your device to approve new devices non-interactively, which would allow them to approve a malicious device the next time you approve your own new device for access to iCloud Keychain. Or perhaps it's more likely that, when you're setting up a new device, Apple sends over the name of your new device, but with the public key/CSR of their own device, since iOS doesn't show a key fingerprint during device approval or anything. 0: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych...
- DavideNL 4y ago
  > As it stands, you can recover your iCloud Keychain by either... I remember, a long time ago when i created an AppleID, there was a yes/no choice whether or not to upload [something related to the password] to Apple, so it would become possible to recover the AppleID password if needed in the future. Is that still a thing, or has it been replaced by new features now?
rtev 4y ago
Good question. Can local admin dump apple keychain passwords? If so, hashed or plaintext?
pvg 4y ago
Relying on your browser/OS password manager is, for the vast majority of people, a better alternative. These days you get pretty decent integration even if you use Chrome on macOS and want your passwords to show up on your iPhone.
zeroonetwothree 4y ago
Seems unnecessarily risky. Do they have an export flow? What if you get a non Apple device?

Finnucane 4y ago

Well, that sounds bad. I mean, I'm not an infosec expert, but I can follow enough of that to see that it's not good. I use Lastpass at work, because we have a site license, but maybe I'll look into whether I can switch over to bitwarden. I don't expect perfect security, but I expect them to at least try.

AceJohnny2 4y ago
You have to understand that this isn't an isolated event. LastPass is uniquely bad at this, and it is, for many, the last straw.

wnevets 4y ago

Has LastPass always been this bad and nobody noticed or did the new owners change it?

samwillis 4y ago
I think the answers is yes, there has been grumbling about LastPass for years. Prior to them being owned by LogMeIn. They were hacked back in 2015 too: https://www.wired.com/2015/06/hack-brief-password-manager-lastpass-got-breached-hard/ https://www.wired.com/2015/06/hack-brief-password-manager-la... > On Monday password manager service LastPass admitted it had been the target of a hack that accessed its users' email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords. (That's from 2015 but could read like the other week!)
- zeroonetwothree 4y ago
  I switched to Bitwarden right after that hack and it’s been great
weakfortress 4y ago
Yes. But prior to this breach it was easy to look the other way due to the extremely large amount of inertia associated with changing a manager and all your passwords. I know this was the case for me. In August we thought it was simply another "simple" breach. E.g. they got hold of some information that would be useful to spearphish or whatever but not the vaults themselves. No big deal, just be on the lookout for emails. Once it came to light they lost control of their vaults the calculus changed. In my memory this is the largest, most prolific breach in history. Every other breach of a major site pales in comparison. The only solution is to change password managers immediately (I went to 1password) and begin the process of changing everything and updating your security posture. Unfortunately, the hackers also have an insane amount of metadata on customers. So if you stored incriminating (either legally or socially) websites in there the hackers now have a lot of leverage to get you to bend the knee. In summary, lastpass has been on the down slope for a long time. But it was easy to just accept this and work around it. This breach changed everything. It revealed their incompetence in full and woke a lot of people, including myself, up to just how hard it is to trust a company. It's just not enough anymore to have a big company slapped onto your logo (LogMeIn) and hope they provide the correct mitigations through experience. From now on I, and many people I know, will be carefully evaluating their choices with password managers, etc from now on. I don't think their CEO can be trusted especially with all the weasel words used in the disclosure and the timing of the disclosure. They showed no respect for their customers in either the aspect of security or disclosure. If you know nothing else about this breach that should be enough to get you and everyone you know to run.

rvz 4y ago

I think I have lost count at how many security issues and breaches people have tolerated with LastPass to realise that enough is enough. By just searching "LastPass" it is almost always a security breach or hack. [0] [0] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=LastPass&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

nine_k 4y ago

The post looks a bit weird on first sight: "I always knew LastPass has a ton of flaws, but promoted it anyway". This may make sense though. LastPass seemed to be the only one with a good enough UX. And without a good enough UX, you can't make users actually use it. Using an imperfect but usable password manager is still much better than not using one with better security but poor UX. (Here comes the old adage: make the friction low for the customer, and any shortcomings elsewhere will matter little.)

ascendantlogic 4y ago
Security is not a binary thing. It's a spectrum and for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc. It's only after multiple episodes of what amounts to malicious incompetence that the cure becomes worse than the disease. I think we're collectively agreeing we've reached that point with LastPass.
- LarryMullins 4y ago
  > for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc Indeed. Writing down passwords on a pad of paper next to your computer is a valid practice for most people if we're being realistic, particularly for personal computer use. Even leaving passwords in an unencrypted text file on your desktop is not nearly as bad today as it used to be 20 years ago. Pretty much anything is better than using the same 8 letter password on every single website. That's the status quo which needs to be toppled.
jeffybefffy519 4y ago
I think a lot of people promoted it because it has a free tier - getting people to switch to password manager and paying money is a hard sell.
s17n 4y ago
It seems like using lastpass was worse than not using a password manager, though (if you had an old vault that is going to get cracked).

majkinetor 4y ago

God damnit, but what doesn't. I am sure BitWarden has its own problems and it (seems?) not 100% FOSS but its core is. LP extension and web vault ARE pure garbage: 1. It can't even recognize sites correctly ?! WTF really. I usually get 10 or so (looks like random) hits for any site but not the one that I should. 2. It offers me to extend pro support 5 years after I stopped paying for it. What I need to do for it to stop ffs. 3. Its UI is simply outrageous, i.e. if you search something it shows empty folders among those that contain the item etc. I recommend NextCloud Passwords plugin: https://apps.nextcloud.com/apps/passwords https://apps.nextcloud.com/apps/passwords Its awesome, supports team work, and if you have NC its no brainer. Probably too much work to install NC if you don't use it but in small company settings its probalby good idea as you need online office anyway.

jsmith99 4y ago
Which bit of bitwarden is not FOSS?
- majkinetor 4y ago
  It looks like premium features are not foss, like SSO for example (but I might be wrong): https://bitwarden.com/help/about-sso https://bitwarden.com/help/about-sso > Login with SSO is available for all customers with an Enterprise organization
  - jsmith99 4y ago
    Only saw the reply late. All enterprise features seem fully open source. Eg SSO is in the source at https://github.com/bitwarden/server/tree/master/bitwarden_license/src/Sso https://github.com/bitwarden/server/tree/master/bitwarden_li... Correction: that part of the source seems to be only 'source available' rather than FOSS.
peterangular 4y ago
I moved to Bitwarden from KeePass and haven't looked back. The UIX of Bitwarden can be a bit meh at times but it's also boring, predictable, and solid. I'm just saying this as someone who hates save buttons in the upper-right hand corner of things - just... small nitpicky stuff like that. Sometimes I have to look for a button or their use of iconography confuses me a bit. I would do my own hosting for a distributed password database but the older I get the less I trust myself to keep that stuff locked down and patched. Given the number of users I feel Bitwarden has more skin in the game to keep their solutions tight. If you're not looking to self-host I can't recommend Bitwarden enough!

FatActor 4y ago

How do we know 1Password doesn't have similar glaring oversights like LP? We can't audit their code unless it is open source? I'm not going to just believe them at face value because some random internet personality says so. Unless some respected authority can publish an audit of the security posture and source code, we're just taking them at their word. Granted, if I had to chose today, I would instantly pick 1Password based on what I can find on google, and LP has far, far more leaks than 1P. But let's not kid ourselves that 1P is somehow more trustworthy without audits. And I'll eat crow if 1P has proof that they are routinely audited by 3rd parties. EDIT: removed snark. EDIT#2: If Signal can publish open source, why cant 1Password? If security is done right, the source code should be visible to everyone without jeopardy, or at least that's what I've been led to believe. EDIT#3: Thanks for the link y'all, here it is at top level: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... ... mmmm crow EDIT#4: We trust browsers too much. 1P stores the secret key on every device so that you only have to enter your passphrase. I'd really like that code to be public because that's a great way to lose control of everyone's secret key. Extensions worry me because they are a critical component in any password manager's usability-vs-security. But perhaps that is a digression or worth an Ask HN.

samwillis 4y ago
There is a white paper on 1passwords design: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... They also regularly have audits and pen tests, with the reports pushed publicly: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ Finally, it's been built by people who are respected in the security industry.
- FatActor 4y ago
  Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.

geocrasher 4y ago

After reading this, I acted on a decision I was on the fence about. I already have moved to Bitwarden and like it a lot better, but this post prompted me to go into LastPass and actively delete my account. The next thing to do will be to start changing passwords. As with most of us, that's a project of serious scope that I do not look forward to.

barbazoo 4y ago
I switched to 1Password a long time ago but never deleted my LP account unfortunately. Did so this week, AFTER the recent breach.
joegahona 4y ago
> As with most of us, that's a project of serious scope that I do not look forward to. I've spent the better part of the past three days doing just this. Get some good music and some good coffee, and it can actually be pretty cathartic. I enjoyed the hygiene exercise much more than I thought I would.
- cmurf 4y ago
  Some accounts I'm just deep sixing by changing the password with the online service but then not recording it anywhere. Buhbyeeeee!
  - joegahona 4y ago
    Yes! I too have had many sites fall into that category. Also it's been a fascinating exercise in user-interface/-experience competitive research. Some websites just do not give a crap. Here's one gem: https://i.imgur.com/yBLmuHt.png https://i.imgur.com/yBLmuHt.png I can't help but feel pity for the local/city-level websites though. You can tell they've just Frankenstein-d stuff together on meager budgets and under crippling administrative loads.
dqv 4y ago
So I've been doing this and I strongly recommend keeping LastPass (LP) until you've deleted all your credentials from there. My workflow is to launch the login from LP (using the app), use those credentials, and change the passwords using Bitwarden. Otherwise, you might accidentally set a new password that doesn't actually work and have to go through painful password reset processes.

danShumway 4y ago

I moved off of LastPass a while ago, but hadn't actually deleted my account because of laziness/inertia. This breach was finally the impetus to get me to full-on delete my vault and start the process of cleaning up my old accounts. Luckily I've been off of it long enough that I suspect most of my regularly used accounts are different anyways, but I'm still going through the process now of methodically rotating all of them (I may change some of the email addresses as well). ---- I think a lot of people even casually knew LastPass wasn't at the same quality level as other solutions, but inertia is powerful. Sometimes you need something glaring to be the final straw that breaks the camel's back. It's been long overdue; I moved off of Gmail as well a while ago but haven't gone through and systematically changed all of my account email addresses; there are still a few older services I have that send emails over. The new year is a good opportunity to clean that stuff up.

ChrisClark 4y ago
The scariest part was it was a backup of theirs that was stolen. So deleting all your info might not have even protected it. It could still be in an old backup and get stolen. :( I've deleted my stuff now anyway, it's all we can do. :(
- kcartlidge 4y ago
  > The scariest part was it was a backup of theirs that was stolen. I knew it was a backup, but I don't recall seeing anywhere how old it was. Do we have any more information? My data was confirmed deleted by them mid last year when I moved to BitWarden, and I'm hoping the backup was older. If not then I'm in the unfortunate position of being at greater risk than those who signed up more recently. I need to change everything anyway just in case, but knowing more would help with peace of mind. I used them for so many years I probably only had the 5,000 (or maybe even the 500) iteration config they never once mentioned.

thefounder 4y ago

Just enable webauthn and forget the passwords non-sense

gizmo 4y ago
You cannot use webauthn for e2ee apps because you cannot have webauthn manage a public/private key pair.
quenix 4y ago
For the two websites that support it?

bob1029 4y ago

Use of 3rd party password trackers has been a periodic concern for our organization. We do B2B business with banks, so the temperature is increased somewhat. There are kinds of credentials we have access to that genuinely terrify me. I've been debating building an in-house solution for managing secrets, if for no other reason than to get all of this information off of 3rd party computers. No serious proposals have been put forth, but I don't think this stuff is exactly rocket science either. Our requirements are functionally-equivalent to a copy of passwords.xlsx on a network share.

1123581321 4y ago
If I were a bank customer, I would not want to hear your second paragraph…
- bob1029 4y ago
  The system is fairly broken from my perspective. Especially, as the size of the financial institution decreases. We work with smaller customers. At this small scale, everything is vendored out. Many times, 2+ different vendors will need to directly exchange something like a password for the bank's core system. Email is the preferred technique, typically with some theatrical secure email crap on top - involving yet another 3rd party in the secret exchange mess. As you get into the scale of an organization like Capital One or BofA, you start to see more of that Hollywood-style credential exchange & control with multiple consenting parties, Iron Mountain trash cans, biometric doors and one-time passwords. If you are concerned about the IT/security of your financial institution, you may prefer larger ones. These have more employees running just IT compliance than many of our clients have in total. If you are concerned about bad customer service or losing access to funds, you may prefer smaller ones. Being able to realistically talk to a board member of the bank about a dispute makes a lot of people feel better about where their money is.
29083011397778 4y ago
Why not whichever Keepass client you prefer, and Syncthing (if it's even necessary for your use-case)? Open-Source, old enough to have a few revisions and be looked at pretty closely, completely off-line, and forgiving if updates are needed to passwords (with many clients having the option of merging changes with your open database). This way, you don't make the same mistake as Telegram as well; I.E., don't roll your own crypto if you can help it, especially if there are ready-made tools that already do what you want, doubly so when those tools are battle-tested and looked over by actual experts.

LarryMullins 4y ago

I think that keepass with periodic manual backups of the keystore is the right solution for most people (maybe not for orgs.) I've never trusted these "cloud" password companies to do their job right.

snehk 4y ago

I used to be a LastPass user and also used to use their GoTo services for work. Shortly before all of this was revealed, I noticed a problem with their API and sent their customer service team message about how their API is not working correctly and is simply responding with wrong data and they basically said "too bad" and said they weren't gonna fix it due to time constraints. I even tried their forums but they deleted the Thread, marking it as "Spam". I then stopped using my account on LastPass and literally a few weeks later they revealed the "security incident". Had to change all my passwords but I'll never get near this company ever again.

jrochkind1 4y ago

> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)

grecy 4y ago
> What are the security problems with garbage-collected languages? None that I'm aware of. I think this is a petty swipe at programmers who use garbage-collected languages, implying they're "less" than programmers who use "real" languages that don't have garbage collection.
- deleted 4y ago
  [deleted]
kstrauser 4y ago
At the risk of conjuring a strawman, I've heard people worry about the loss of control, like maybe the process has some sensitive data in RAM that it will release and then the OS will alloc() it to another process. And that's true on one level, but nothing prevents a garbage collected language from overwriting all the data in a block of RAM as it free()s it. I think the risk of memory related bugs in a non-managed language is far, far greater than any GC-related hypothetical risks. And then you have languages like Rust which "feels" like it's a GC language because it manages all the alloc()s and free()s for you, but isn't GC at all because the language's semantics make those calls deterministic. I'd vastly rather see sensitive security software developed in a modern garbage collected language (or in Rust and similar languages) than in C or C++.
- IcePic 4y ago
  > At the risk of conjuring a strawman, I've heard people worry about the loss of control, like maybe the process has some sensitive data in RAM that it will release and then the OS will alloc() it to another process. I'm sure some people worry about this, but I think you will be hard pressed to find a modern OS that actually would give away your contents to another PID. Just because a program can malloc(8), fill eight bytes with known content, free() the pointer, malloc(8) again and see their old content doesn't mean the OS hands your data to anyone, just that the libc (or whatever runtime you use) is not actually getting a whole page for that single 8 byte malloc, and it didn't give it back to the OS at free() either, so you "owned" the page where those 8 bytes lives all the time during execution of this simple test. The limit for which your allocator starts _actually_ handing back data is probably never less than 4k and upwards to 256k depending on page size, malloc settings and OS/libc defaults. So while there are a lot of traps code can fall into as mentioned in other comments in this thread, I think everyone can stop worrying about "the next program to malloc() will get my old data" because that just doesn't happen.

samtho 4y ago

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin in the Infosec world. As an aside, it’s interesting to see their fall from grace from their reception section on Wikipedia: https://en.m.wikipedia.org/wiki/LastPass#Reception https://en.m.wikipedia.org/wiki/LastPass#Reception I’m moving to bitwarden and not looking back. I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually.

Fire-Dragon-DoL 4y ago
I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked together PR from myself that will help you export the password history The import worked very well in 1password aside from attachments/history. What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag
- metabagel 4y ago
  >> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.
  - samtho 4y ago
    I ran into this before, actually. As of about a year ago, Lastpass partially used cached data to generate some portion of exported data, but that cache is not diligently kept up to date.

pleb_nz 4y ago

Reading through these comments I am surprised at how many people were/are still using LsstPass. I used it until they had an incident 5 or 7 years ago. And there face need others since. How many chances did an organization get with highly sensitive information before people move on?

Barrin92 4y ago

I feel like a shill at this point but just use Bitwarden. open source, cloud sync by default, alternative self-hostable backend if you want to, no device limit, doesn't cost anything which is just about the only thing that concerns me because the free plan seems too good honestly.

DerekBickerton 4y ago
Bitwarden is great, and their commercial offering of $10.00 per year is so cheap as to be effectively free. My only issue is the fact their servers could be wiped and I no longer have access to my data, but that's where KeepassXC comes in. I keep one Bitwarden and one Keepass DB as a fallback, and keep them updated with the same login entries. I store my KeepassXC database in various cloud storage services, as-well as keeping various local copies.
- DavideNL 4y ago
  > My only issue is the fact their servers could be wiped and I no longer have access to my data So is the Bitwarden database not also stored/always up to date local (like how IMAP works for e-mail, if the server goes offline you still have all your emails locally) ?

blobster 4y ago

This is why we need good OS-level password managers. Phones and now computers have dedicated security chips which are infinitely more secure than any cloud solution. Such an easy market to grab that it boggles me why Apple and Google aren't aggressively going for it.

jefftk 4y ago
Apple and Google both have solid options here, and I'm a happy user of Google's. But I also wouldn't want either of them to push their solutions aggressively, for competition reasons.
- dns_snek 4y ago
  Do you consider your passwords to be "disposable" or easily replaceable? I could never trust Google with hundreds of passwords. The thought of their AI going haywire and essentially locking me out of the internet is terrifying.
  - jefftk 4y ago
    > The thought of their AI going haywire and essentially locking me out of the internet is terrifying. I think this is really unlikely; since https://news.ycombinator.com/item?id=34092956 https://news.ycombinator.com/item?id=34092956 I've been gathering lockout reports on HN and they're mostly things like adding a phone number to your account and then forgetting about that when switching numbers.
easeout 4y ago
iCloud Keychain syncing, strong password suggestions in Safari, and WebAuthn passkeys are all part of Apple's strategy. When they don't buy a third party and deeply integrate it, they tend to operate by insinuating themselves as the platform default. What would you have them add to that?
- blobster 4y ago
  Their "password manager" on Mac is called Keychain Access. The UX is very bad, the interface is old and clunky and it doesn't sync with iOS (if for example you create a secure note there's no way to access it on iOS) - not to mention that most people don't even know it exists, it's kind of a hidden feature. Meanwhile, on iOS the password manager is hidden in the settings and again it has pretty bad UI/UX. I understand that they want to hide the complexity away from the end user and make these kinds of features "just work", but in practice they feel pretty half-baked.

Havoc 4y ago

Leaning strongly towards self-hosting. Name brand cloud managers just make too juicy a target for sophisticated attackers regardless of their competence/care of the pass manager co. I know it's got a bit of security via obscurity vibes, but I've concluded the combo of residential IP, wireguard, firewall and dedicated VM is probably more secure. That would require someone with decent skill targeting me specifically...in which case they're probably better off with a wrench attack anyway. The big unknown is uptime.

PartiallyTyped 4y ago
You can always self-host BitWarden! NB: Not affiliated with the company, just a very happy customer.
- Havoc 4y ago
  Yeah, trying to decide between bitwarden, vaultwarden and a sync'd KeePassXC implementation. My LP password is thankfully on the stronger side of things so hoping I've got time to try them all
  - michaelcampbell 4y ago
    FWIW, I've used Keepass format for years. Different clients, different syncing mechanisms, but currently on KeepassXC + Syncthing.
- kivle 4y ago
  I was self-hosting bitwarden-rs (alternative implementation in Rust) in a Docker container, and I had set up Watchtower to automatically update it nightly. I thought I would be relatively safe and keep up with updates. Well, it turns out the project in question had to change their name from bitwarden-rs to vaultwarden-rs since they violated the trademark. Updates stopped being pushed to the original docker image url, and several months passed until I suddenly noticed this. In the meantime I could easily have missed some important security upgrades. I understand it's only myself at fault here, but it made me migrate to a hosted account instead. As fun as it is to self host things, something this security critical is probably better left to dedicated people.

darig 4y ago

[dead]

photonbeam 4y ago

Trusting a 3rd party password manager seems troublesome

oluwie 4y ago
By your standards, trusting any 3rd party solution seems troublesome. The entire web is built on 3rd party solutions. Should we all write our encryption libraries b/c we shouldn't trust any 3rd party solution?
DerekBickerton 4y ago
For me, one cloud solution, and a local KeepassXC database as a fallback. Works like magic. If the cloud solution (Bitwarden) fails, then I fallback to Keepass.

swarfield 4y ago

Can't believe that they were using Electronic Coloring Book mode!

sys_64738 4y ago

All online cloud password managers have vulnerabilities of some form or another. As computer people why would you think otherwise? I don't understand any of the assumptions that your data would be safe in the cloud. I had this same point to a past employer that LastPass (or other password in the cloud manager) will always be vulnerable. But it falls on deaf ears. I would never, ever trust my passwords to an online storage provider.

DavideNL 4y ago
All-or-nothing thinking aka "Splitting": https://en.wikipedia.org/wiki/Splitting_(psychology) https://en.wikipedia.org/wiki/Splitting_(psychology)

miguelazo 4y ago

Great technical reasoning, but no mention of the business practices. This is a consistent result we see when companies are acquired by private equity. Like Thoma Bravo did with SolarWinds, and is doing with Proofpoint. Vulture capitalists destroy the companies they target to extract short term value. This is why I warned people against using LastPass for several years. Sad to see I was already vindicated.

psnehanshu 4y ago

I used Google Passwords for a long time before deciding to move to something not OS dependent. My first pick was LastPass. I used it for maybe one month, but found their browser extension and Android app pretty bad. So I decided to move to BitWarden. I am very glad that I did this, otherwise I would have been changing all my passwords like a maniac.

tasuki 4y ago
> I used it for maybe one month You gave them your passwords. What makes you think your passwords are safe?
- psnehanshu 4y ago
  I deleted my LastPass account as soon as I imported all my passwords into BitWarden, and the passwords for the most critical sites have been reset since then. Moreover I use auto-generated passwords, so no password is used on two sites, plus they are super hard to brute-force.

cwoolfe 4y ago

LastPass user experience has grown terrible over the years. The iOS app regularly freezes for over ten seconds with no response. Trying to login to LastPass on a second device, with 2FA enabled, regularly takes me over five minutes. Why? Login to app. Lastpass tries to auth using watch app. That's broken, so ask for a SMS. Enter SMS. That doesn't work. it wants master password again. Ok we're in! but now whatever flow to login to an app is broken. Open app, try and use the helpful keyboard shortcut that's broken. ok go back to last pass. copy the password. Oops it wants to enter master password again. Ok. Good thing I picked a long master password. Ok now back in. need to search the site I wanted. got it. copy password, switch apps, paste. DONE! Also, security vulnerabilities?! Definitely going to switch to Bitwarden.

Veen 4y ago

He's probably right, but the post gives vibes of "I used to pimp (as he puts it) for LastPass and now I'm pimping for my friends over at 1Password."

luckydata 4y ago

I just canceled my yearly family subscription and moved to Bitwarden which to be fair is less polished in some aspects and more in others. Support refunded me my yearly fee 3 months into the year which was nice, but my feedback for them was that the only way I would ever consider them again would be if they fired EVERYONE in management, got acquired by a company whose reputation I trust and completely rebuilt their product. Which is to say I will never be a customer again or recommend them to anyone ever again.

Nimitz14 4y ago

Hopefully this will stop the replies to comments complaining about stupid password rules: "Just use a password manager". Why would you ever trust someone else with something like this?

dns_snek 4y ago
The advice should read "Just use a popular password manager that doesn't have a well-document history of being terrible, from a company that releases their regular security audit reports". The most basic form of "Do your own research" should reveal a long list of security incidents: https://en.wikipedia.org/wiki/LastPass#Security_incidents https://en.wikipedia.org/wiki/LastPass#Security_incidents

olkingcole 4y ago

Thoughts on Bitwarden vs 1Password? I have seen them both suggested by users on this site.

mattwad 4y ago
Not sure about 1Password, but I am using Bitwarden free and there's no authenticator app. I just use Authy on Android, though, it works great
- simsla 4y ago
  I used Duo to set up a similar push notification 2fa system for bitwarden as lastpass had.
- ScoutOrgo 4y ago
  Does bitwarden work well with autofill? Lastpass was awful with that and very finicky.
  - yolovoe 4y ago
    For the sites I normally visit, it works well. GitHub and some famous banks/credit card providers. Mfa code doesn't autofill, but it's just a click to copy.
    - lavezzi 4y ago
      Pretty sure you can set it to auto-copy the TOTP, so you technically don’t need to click anything
  - lavezzi 4y ago
    They haven’t had the feature for a huge amount of time but it works alright, with some minor mistakes here and there. As with most managers, it struggles when there are more than two fields to populate
- josteink 4y ago
  > but I am using Bitwarden free and there's no authenticator app There is if you pay $10 annually for Bitwarden Pro. I use it, and it was the game changer I needed in terms of user-experience, to bother actually start using 2FA/MFA for all sites where it was an option (compared to before where I would only do it if required). I definitely recommend giving it a try.

acatton 4y ago

When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password manager is the one absolute thing I want to be auditable. 1Password with its follower "who know people who designed it" reminds me of "trust me bro", "funds are SAFU" in cryptocurrency projects. Leaving LastPass in order to sign up for 1Password feels like out of the pan into the fire. I've always use and will always recommend FOSS for password manager. I install Bitwarden on my technology-illeterate friends and family and I use KeepassxXC personally. I've looked briefly how vaults are encrypted in both software. The security is sound. Bitwarden was audited by Cure53[1] which is one of my favourite security auditing firm. (I highly recommend to read their audit of dovecot[2]) Anyway, you know what they say "fool me once…". I'll be eating popcorn when some claim will turn out to be false for 1Password… [1] https://cure53.de/pentest-report_bitwarden.pdf https://cure53.de/pentest-report_bitwarden.pdf [2] https://cure53.de/pentest-report_dovecot.pdf https://cure53.de/pentest-report_dovecot.pdf

idiot900 4y ago
On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.
- zeroonetwothree 4y ago
  Indeed I think BitWarden has the better UX
- alyandon 4y ago
  My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.
- 4y ago

wirrbel 4y ago

Wondering how Enpass Performs

richardpetersen 4y ago
Same
pentest_bob 4y ago
Closed source requires a lot of trust in this case.
- dpedu 4y ago
  While source code access is certainly a concern for some, it is worth pointing out that Enpass supports database sync methods such as Dropbox, Google Drive, and a proprietary "wifi" sync. This means that you can have sync like Lastpass or 1Password but retain complete control over your own data. I can't speak to Enpass's security, but I have been a user for several years. It feels less polished than 1Password but is freer and more open.
  - wirrbel 4y ago
    That is what I am using. I guess the Enpass attack would require either an attack on the client on my phone / pc or on the storage provider (if they are able to crack my passphrase). I had assumed lastpass and 1pssword were using the same approach

TillE 4y ago

> In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern This is the key point. Properly implemented, you should feel very relaxed if your encrypted data is leaked. I'm using BitWarden, but 1Password's "secret key" concept is smart, it means your data is still very secure even if your password sucks.

deleted 4y ago
[deleted]

mkl95 4y ago

TIL LastPass have been SOC2 and SOC3 certified for a few years. Huge facepalm

dsjoerg 4y ago
I'm not following, what's bad about that? Is that bad for Lastpass, or for SOC2/SOC3?
- mkl95 4y ago
  From my point of view, both.

pjungwir 4y ago

I use a mix of pass(1) and LastPass, but this incident has convinced me to put everything on pass. But I don't really use it the "recommended" way, where you put the password on the first line. It's not a great fit for a consultant when half my customers want to give me my own Gmail/Atlassian/etc account. So I tend to keep big files of free-form text instead. But if I'm going to use it with a browser, the manual copy-paste will get annoying, and I want to switch to the normal pattern. Does anyone have any suggestions? I guess with decent auto-complete I can do something like `google/foo` and `google/bar`. If you have tips let me know!

malteof 4y ago
I’ve been using Keepass for a while, it’s great.
SailingCactus33 4y ago
I consider the flexibility of pass(1) to be one of the best features. In my case, I use a hierarchy to manage secrets across different orgs and classifications. The structure I use is:[ORGANIZATION]/[CLASSIFICATION]/[SITE|APP]/[USER] e.g.: Personal/Confidential/google.com/pjungwir@gmail.com Client1/Secret/google.com/pjungwir@example.com The folder structure allows for different keys to be used in .gpg-id files, so secret access can be limited on different devices based on which keys are available. For example, only a subset of keys are available on my android phone via the Password Store app from F-Droid, with all devices using a shared password-store synced using git(1). Completion with bash works well (on Fedora) and following the convention of having the password on the first line allows for the android app to work and you don't need to worry about someone looking over your shoulder by using 'pass -c ...'.
- pjungwir 4y ago
  This sounds like a very nice system, and I'll give it a try. I'm already using git to keep things synced between my desktop and my laptop. I've never even attempted syncing to my phone, but if I do that giving access to only a subset of the keys sounds great.

darkstar999 4y ago

Are they still hiding the Delete Account button?

m000 4y ago

I jumped the LastPass ship a couple of years back. There had been some security incidents at that time, but they could still be downplayed. What drove me away was the lingering impression that they were more focused in figuring out how to monetize their product, rather than improving it: E.g. one year feature X required a $1/m plan, next year it was free, and the third year it required the $5/m plan. At the same time, their apps/extensions seemed sluggish and stagnant. That didn't exactly inspire trust in a product that is essentially the gateway to most of my online activities.

Octokiddie 4y ago

> ... Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. ... Seems bad. I took the author's advice and did the google search "jeremi gosney" + "lastpass". This 2015 article turned up: > A longtime LastPass user himself, Gosney says he doesn’t plan to change a thing following the breach – not even his master password. “I am confident in the strength of my master password. As a password cracker, I know it’s impossible to crack,” he says. https://www.secureidnews.com/news-item/consultant-dont-sweat-the-lastpass-breach/ https://www.secureidnews.com/news-item/consultant-dont-sweat... When the same author now recommends Bitwardenen and 1Password, it's hard to view it as anything other than more of the same. The author might want to tone down the unqualified language around computer security to avoid history repeating itself.

deleted 4y ago
[deleted]

JohnTHaller 4y ago

I have multiple folks I know using KeePass with the kdbx synced on Google Drive or similar. The authentication is a combination of a 1KB key file (manually copied onto each device via sneakernet) and a long password.

wazoox 4y ago
Exactly. I've used Keepass then KeepassX then KeepassXC, synchronized across devices with Dropbox then now Nextcloud. No problem, the whole database is safely encrypted, and nobody can access it but me anyway.

belter 4y ago

Users still using LastPass remind me of this closing scene: https://youtu.be/wtmnf7QlX_4 https://youtu.be/wtmnf7QlX_4

entropicgravity 4y ago

If you're a small operation it's not stupid to keep your passwords in a google spreadsheet. Google accounts are seeing attempted cracks 24/7 for the last fifteen years (or more) by nation states and it's been a long time since any of their accounts have been hacked. Remember when someone spliced their optical fiber under the Atlantic Ocean? That's what Google is up against. If you follow this. Keep your passwords in triplicate because if you fat finger the mouse over a cell it can evaporate (experience speaking here). Three copies means very little chance of losing a password. And keep a backup of course. Share the spreadsheet among your team. It's very easy to add and delete users. Yes I know this seems cheezy but sometimes the simplest way is the best. Good for up to about ten team members in my experience.

ahofmann 4y ago
I think that is dangerous advice. It's easier to use Bitwarden, or KeePassXC in Google Drive, than a spreadsheet where you have to follow such rules. And the former ist much more secure against a lot of mistakes and attacks.