5 ms·

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a l

by samtho 4y ago

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin in the Infosec world. As an aside, it’s interesting to see their fall from grace from their reception section on Wikipedia: https://en.m.wikipedia.org/wiki/LastPass#Reception https://en.m.wikipedia.org/wiki/LastPass#Reception I’m moving to bitwarden and not looking back. I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually.

Fire-Dragon-DoL 4y ago
I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked together PR from myself that will help you export the password history The import worked very well in 1password aside from attachments/history. What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag
- metabagel 4y ago
  >> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.
  - samtho 4y ago
    I ran into this before, actually. As of about a year ago, Lastpass partially used cached data to generate some portion of exported data, but that cache is not diligently kept up to date.
    - kcartlidge 4y ago
      > but that cache is not diligently kept up to date Is the ability to take a payment the only thing LastPass got right?
      - Fire-Dragon-DoL 4y ago
        No, not true. I'm using 1Password and while I like it, there are a few things LastPass got right where it even beats 1Password. The one on top of my mind is that you can unlock LastPass with a PIN. My wife has a phone with a glass cover (to protect it from the children), which "broke" fingerprint unlock. She's required to type the full password every time to unlock it, which is particularly hard on phone (long password). On top of that, lastpass app (phone) had the option to "force" autofill from a notification. For some apps where the popup never really shows up with 1Password, I was able to force it using LastPass and then fill. With 1Password the only option is to go to the app and copy-paste. Those are not game-breaking though, given the many, many bugs that LastPass (app on phone) had, the most annoying was: open the autofill and when searching, just no result shows up. This made the autofill useless a good chunk of the time. On top of that, LastPass EXTENSION (chrome) has the option of choosing between sharing states between browser profiles or not sharing states between browser profiles. This is very useful in my case, because my wife has a chrome profile under my OS user, but we can still have 2 different lastpass "logins". From this perspective, 1Password is actually entirely broken: if you login into the native application (which is basically required for decent functionality), you are not allowed to login into 2 different 1password profiles through the chrome extension unless they are on different URLs (e.g. mycompany.1password.com vs 1password.ca). Finally, LastPass was consistent: web, extension and app had the same capabilities. 1Password is highly inconsistent, where the native app has more capabilities than all of them, the extension has no edit capabilities but has better read capabilities than the web version and the web version has a mix of edit and read capabilities. For example, the native app can "batch add tag", but the web cannot do that.
        kcartlidge 4y ago
        Fair enough. And I used it myself for many years. TBH it was more of a throw-away sarcastic outburst, an exclamation, an out-breath, than a genuine question. And also based mainly on the security side of things. I didn't make that clear, however, so I apologise for leading you into expending so much effort on your excellent reply.
  - Fire-Dragon-DoL 4y ago
    Sorry I didn't realize the formatting was way off, I'll write a better message in a minute
  - Fire-Dragon-DoL 4y ago
    To perform a LastPass migration, there are 4 phases involved: 1. Export passwords 2. Export attachments 3. Export password history 4. Export form fills (THIS IS NOT POSSIBLE FROM MY UNDERSTANDING, form fills also appear to not be encrypted?!) # 1. Export passwords In the extension, go to Account Options -> Advanced -> Clear Local Cache, this WILL LOG YOU OUT. Then, log-in and Account Options -> Advanced -> Refresh Sites, this will update your local cache. Finally, begin the export process and follow the instructions, make sure to USE THE EXTENSION (not the website): Account Options -> Advanced -> Export -> LastPass CSV file. When saving the CSV, do not copy-paste the content of the HTML manually, instead use the popup to download the file that LastPass provides. You might need to allow popups for LastPass extension the first time you perform the export, then perform another one to get the popup. # 2. Export attachments Use lastpass-cli to export attachments. A script is provided in version 1.3.4: https://github.com/lastpass/lastpass-cli/blob/v1.3.4/contrib/lpass-att-export.sh https://github.com/lastpass/lastpass-cli/blob/v1.3.4/contrib... Keep in mind that the script works also on version 1.3.3, which is the one provided pre-compiled by Ubuntu, you just have to copy-paste the script to your local machine. # 3. Export password history This is not possible natively, you can use my modified PR, but it's not trivial, bash knowledge, familiarity with C syntax is expected: https://github.com/lastpass/lastpass-cli/issues/245#issuecomment-1366526206 https://github.com/lastpass/lastpass-cli/issues/245#issuecom... Keep in mind that YOU SHOULD AUDIT THE SOURCE CODE, I modified an existing PR and it's hacked together, I brought it only to where I needed it to, to get the password history out for my specific use-case. # 4. Export form fills Unsupported from my understanding # Conclusion Tag the items or mark them in your new password manager with something to remind you that they were breached on lastpass in august 2022 and remove such mark when you change their password.
    - avnigo 4y ago
      Awesome work on the password history export, thanks a lot! I audited the code to the best of my ability and it doesn't look like it's malicious, but I certainly could've missed something, so to anyone who's thinking about using this, it works, but do your due diligence.
- RulerOf 4y ago
  >What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.
  - Fire-Dragon-DoL 4y ago
    So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed. The web portion has *less edit capabilities* than the native app. You should have the extension and the native app installed at the same time, the extension should connect to the native app (and share login). In the native app you can click on one item and then hold shift or control (Windows) to select multiple items, then you literally drag them on the tag on the left. It will feel laggy a few seconds if you tag 1000 items like I did and it might not work perfectly, so double check that all the items got tagged. To do that check, you have to: click on the tag, then scroll to the end. It will tell you the count of all the items for that tag. Repeat the "bulk tagging" until the count is what you expect. Do notice that if you click on one item and then hold shift and click on the item at the end of the list, it will select all of them, so this process is pretty fast. I had to do only 2 tries before all of the items got the tag. EDIT: You must have added the tag to at least 1 item manually for the tag to show up in the sidebar. To do that just press "edit" on the item and at the bottom there is a "tags" field, you can add one. In the web version, you just type tags and separate them by commas. The native version has a way better control. Secret about tag: if your tag is named `foo/bar` it will represent them in a tree-like structure in the native app, so `foo` -> `bar`.
    - RulerOf 4y ago
      >So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed. I like this design a lot. LastPass _used_ to work like this ages ago. >You must have added the tag to at least 1 item manually for the tag to show up in the sidebar. I did get stuck here for a minute but was able to get it set up. Thank you! I discovered that every time you click "export" in lastpass, the export accumulates a copy of the vault. My second export had 2x of everything in it, 3x for third, etc. I see the features in 1Password and I almost cannot forgive myself for holding onto Lastpass for such a long time.
spacefiish 4y ago
I'll be in the same boat when my subscription is up, not sure exactly when it is (I should really check). My discontent had been growing for a while and it's been getting harder to defend it to friends and family, who I had to BEG to get to use a password manager to start, even though now they all swear by it. I'd like them to change along with me, but am worried about how difficult it would be.
danShumway 4y ago
Seeing more articles about export/import woes would be great. When I moved over to KeePass I was able to export and import all of my passwords but the field labels got pretty mixed up, and it was a little bit of a pain to correct. That might be fixed now, but it would be interesting to see people's experiences importing into other services beyond just "here's how you export from LastPass to CSV". Edit: as other people mentioned, I also didn't get any password history with my export, which isn't a big deal to me but is worth highlighting.
waboremo 4y ago
I've made the transition to multiple different services over the years, not on a large professional scale so I cannot comment on doing that and I reckon doing that would require completely different advice than I am suggesting below. I would highly recommend starting new. Every transition between managers has wound up leaving me having to manually delete fields after the fact anyways, or just keep those fields littering the manager. Sometimes even incorrect fields when moving away from LastPass which is even more of a bother. Starting new also gives you a chance to get more used to the new manager's features, and when transitioning you can add specific fields based on crucial information that might have otherwise been lost in automatic moves. Use this transition as a justification to change your passwords to the services you use, and also a way to decide whether you want to keep using that service or submit a deletion (most you can do this on your own, other times you have to send a GDPR deletion request). I know it takes more effort, but spend a chill weekend doing so, and you'll be glad you did. Plus you can also review some security settings on your services, like force sign out all other devices and changing your 2FA settings. Think of it as a new year refresh
- yjftsjthsd-h 4y ago
  That's a good point; especially since LP just had a breach, it's a good time to ensure that none of your passwords are the same as what's in their database anyways.
luckydata 4y ago
you can ask them to cancel ahead of time and get a refund as long as you explain it's because the lost of trust and the fact that they don't provide the service they advertise. I did it yesterday and I encourage everyone to do it. Even if they stop, the refunds send a STRONG message to management. Also don't be shy to chargeback if your CC company allows you to. Companies like LastPass need to be made an example of, and you have the power in this situation.
kcartlidge 4y ago
> I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually. Did it about 18 months ago. I was expecting it to be more cumbersome than it was. Export from LastPass, import to BitWarden, manually compare. Simples. It all worked IIRC, though I only have a few dozen entries as I'm in the habit of clearing old ones down. Left LastPass going for a few weeks just in case, then closed it down and the data was deleted. Edit: If I was doing it now, I'd do it from scratch and change every LastPass-aware credential as I go. That info is out there now; you don't want to be using it any more.
- gregmac 4y ago
  I also transitioned to bitwarden about 18 months ago, but I haven't deleted my lastpass account yet. I've used LastPass for password history once, and a couple times for notes (which don't get exported). Now I want to delete my lastpass account completely but what would be helpful is if I can mark all my bitwarden passwords that are still the same as the ones in LastPass, as I'd like to change all of them. Anyone know a way to do this?
  - kcartlidge 4y ago
    Sorry, no. All I can think of is exporting from them both, stripping each down to just the account name, login, and password, sorting them the same way, then doing a diff. Laborious, but possibly less so than a manual comparison if you have quite a few.

by samtho 4y ago

Fire-Dragon-DoL 4y ago

I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked together PR from myself that will help you export the password history The import worked very well in 1password aside from attachments/history. What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag

metabagel 4y ago
>> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.
- samtho 4y ago
  I ran into this before, actually. As of about a year ago, Lastpass partially used cached data to generate some portion of exported data, but that cache is not diligently kept up to date.
  - kcartlidge 4y ago
    > but that cache is not diligently kept up to date Is the ability to take a payment the only thing LastPass got right?
    - Fire-Dragon-DoL 4y ago
      No, not true. I'm using 1Password and while I like it, there are a few things LastPass got right where it even beats 1Password. The one on top of my mind is that you can unlock LastPass with a PIN. My wife has a phone with a glass cover (to protect it from the children), which "broke" fingerprint unlock. She's required to type the full password every time to unlock it, which is particularly hard on phone (long password). On top of that, lastpass app (phone) had the option to "force" autofill from a notification. For some apps where the popup never really shows up with 1Password, I was able to force it using LastPass and then fill. With 1Password the only option is to go to the app and copy-paste. Those are not game-breaking though, given the many, many bugs that LastPass (app on phone) had, the most annoying was: open the autofill and when searching, just no result shows up. This made the autofill useless a good chunk of the time. On top of that, LastPass EXTENSION (chrome) has the option of choosing between sharing states between browser profiles or not sharing states between browser profiles. This is very useful in my case, because my wife has a chrome profile under my OS user, but we can still have 2 different lastpass "logins". From this perspective, 1Password is actually entirely broken: if you login into the native application (which is basically required for decent functionality), you are not allowed to login into 2 different 1password profiles through the chrome extension unless they are on different URLs (e.g. mycompany.1password.com vs 1password.ca). Finally, LastPass was consistent: web, extension and app had the same capabilities. 1Password is highly inconsistent, where the native app has more capabilities than all of them, the extension has no edit capabilities but has better read capabilities than the web version and the web version has a mix of edit and read capabilities. For example, the native app can "batch add tag", but the web cannot do that.
      - kcartlidge 4y ago
        Fair enough. And I used it myself for many years. TBH it was more of a throw-away sarcastic outburst, an exclamation, an out-breath, than a genuine question. And also based mainly on the security side of things. I didn't make that clear, however, so I apologise for leading you into expending so much effort on your excellent reply.
- Fire-Dragon-DoL 4y ago
  Sorry I didn't realize the formatting was way off, I'll write a better message in a minute
- Fire-Dragon-DoL 4y ago
  To perform a LastPass migration, there are 4 phases involved: 1. Export passwords 2. Export attachments 3. Export password history 4. Export form fills (THIS IS NOT POSSIBLE FROM MY UNDERSTANDING, form fills also appear to not be encrypted?!) # 1. Export passwords In the extension, go to Account Options -> Advanced -> Clear Local Cache, this WILL LOG YOU OUT. Then, log-in and Account Options -> Advanced -> Refresh Sites, this will update your local cache. Finally, begin the export process and follow the instructions, make sure to USE THE EXTENSION (not the website): Account Options -> Advanced -> Export -> LastPass CSV file. When saving the CSV, do not copy-paste the content of the HTML manually, instead use the popup to download the file that LastPass provides. You might need to allow popups for LastPass extension the first time you perform the export, then perform another one to get the popup. # 2. Export attachments Use lastpass-cli to export attachments. A script is provided in version 1.3.4: https://github.com/lastpass/lastpass-cli/blob/v1.3.4/contrib/lpass-att-export.sh https://github.com/lastpass/lastpass-cli/blob/v1.3.4/contrib... Keep in mind that the script works also on version 1.3.3, which is the one provided pre-compiled by Ubuntu, you just have to copy-paste the script to your local machine. # 3. Export password history This is not possible natively, you can use my modified PR, but it's not trivial, bash knowledge, familiarity with C syntax is expected: https://github.com/lastpass/lastpass-cli/issues/245#issuecomment-1366526206 https://github.com/lastpass/lastpass-cli/issues/245#issuecom... Keep in mind that YOU SHOULD AUDIT THE SOURCE CODE, I modified an existing PR and it's hacked together, I brought it only to where I needed it to, to get the password history out for my specific use-case. # 4. Export form fills Unsupported from my understanding # Conclusion Tag the items or mark them in your new password manager with something to remind you that they were breached on lastpass in august 2022 and remove such mark when you change their password.
  - avnigo 4y ago
    Awesome work on the password history export, thanks a lot! I audited the code to the best of my ability and it doesn't look like it's malicious, but I certainly could've missed something, so to anyone who's thinking about using this, it works, but do your due diligence.
RulerOf 4y ago
>What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.
- Fire-Dragon-DoL 4y ago
  So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed. The web portion has *less edit capabilities* than the native app. You should have the extension and the native app installed at the same time, the extension should connect to the native app (and share login). In the native app you can click on one item and then hold shift or control (Windows) to select multiple items, then you literally drag them on the tag on the left. It will feel laggy a few seconds if you tag 1000 items like I did and it might not work perfectly, so double check that all the items got tagged. To do that check, you have to: click on the tag, then scroll to the end. It will tell you the count of all the items for that tag. Repeat the "bulk tagging" until the count is what you expect. Do notice that if you click on one item and then hold shift and click on the item at the end of the list, it will select all of them, so this process is pretty fast. I had to do only 2 tries before all of the items got the tag. EDIT: You must have added the tag to at least 1 item manually for the tag to show up in the sidebar. To do that just press "edit" on the item and at the bottom there is a "tags" field, you can add one. In the web version, you just type tags and separate them by commas. The native version has a way better control. Secret about tag: if your tag is named `foo/bar` it will represent them in a tree-like structure in the native app, so `foo` -> `bar`.
  - RulerOf 4y ago
    >So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed. I like this design a lot. LastPass _used_ to work like this ages ago. >You must have added the tag to at least 1 item manually for the tag to show up in the sidebar. I did get stuck here for a minute but was able to get it set up. Thank you! I discovered that every time you click "export" in lastpass, the export accumulates a copy of the vault. My second export had 2x of everything in it, 3x for third, etc. I see the features in 1Password and I almost cannot forgive myself for holding onto Lastpass for such a long time.

spacefiish 4y ago

I'll be in the same boat when my subscription is up, not sure exactly when it is (I should really check). My discontent had been growing for a while and it's been getting harder to defend it to friends and family, who I had to BEG to get to use a password manager to start, even though now they all swear by it. I'd like them to change along with me, but am worried about how difficult it would be.

danShumway 4y ago

Seeing more articles about export/import woes would be great. When I moved over to KeePass I was able to export and import all of my passwords but the field labels got pretty mixed up, and it was a little bit of a pain to correct. That might be fixed now, but it would be interesting to see people's experiences importing into other services beyond just "here's how you export from LastPass to CSV". Edit: as other people mentioned, I also didn't get any password history with my export, which isn't a big deal to me but is worth highlighting.

waboremo 4y ago

I've made the transition to multiple different services over the years, not on a large professional scale so I cannot comment on doing that and I reckon doing that would require completely different advice than I am suggesting below. I would highly recommend starting new. Every transition between managers has wound up leaving me having to manually delete fields after the fact anyways, or just keep those fields littering the manager. Sometimes even incorrect fields when moving away from LastPass which is even more of a bother. Starting new also gives you a chance to get more used to the new manager's features, and when transitioning you can add specific fields based on crucial information that might have otherwise been lost in automatic moves. Use this transition as a justification to change your passwords to the services you use, and also a way to decide whether you want to keep using that service or submit a deletion (most you can do this on your own, other times you have to send a GDPR deletion request). I know it takes more effort, but spend a chill weekend doing so, and you'll be glad you did. Plus you can also review some security settings on your services, like force sign out all other devices and changing your 2FA settings. Think of it as a new year refresh

yjftsjthsd-h 4y ago
That's a good point; especially since LP just had a breach, it's a good time to ensure that none of your passwords are the same as what's in their database anyways.

luckydata 4y ago

you can ask them to cancel ahead of time and get a refund as long as you explain it's because the lost of trust and the fact that they don't provide the service they advertise. I did it yesterday and I encourage everyone to do it. Even if they stop, the refunds send a STRONG message to management. Also don't be shy to chargeback if your CC company allows you to. Companies like LastPass need to be made an example of, and you have the power in this situation.

kcartlidge 4y ago

> I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually. Did it about 18 months ago. I was expecting it to be more cumbersome than it was. Export from LastPass, import to BitWarden, manually compare. Simples. It all worked IIRC, though I only have a few dozen entries as I'm in the habit of clearing old ones down. Left LastPass going for a few weeks just in case, then closed it down and the data was deleted. Edit: If I was doing it now, I'd do it from scratch and change every LastPass-aware credential as I go. That info is out there now; you don't want to be using it any more.

gregmac 4y ago
I also transitioned to bitwarden about 18 months ago, but I haven't deleted my lastpass account yet. I've used LastPass for password history once, and a couple times for notes (which don't get exported). Now I want to delete my lastpass account completely but what would be helpful is if I can mark all my bitwarden passwords that are still the same as the ones in LastPass, as I'd like to change all of them. Anyone know a way to do this?
- kcartlidge 4y ago
  Sorry, no. All I can think of is exporting from them both, stripping each down to just the account name, login, and password, sorting them the same way, then doing a diff. Laborious, but possibly less so than a manual comparison if you have quite a few.