3 ms·

LastPass is such utter trash.

by Exuma 3y ago

sethammons 3y ago
Among their many failures, I am still shocked that the notes section for each password was not encrypted. All kinds of assumed-safe info will be in there from secret question answers to former passwords and account numbers. What fool of a project manager pushed for that?
- Operyl 3y ago
  > we need that extra 300msec of speed, Jim! Web metrics are all that matter!!!!11one
- peblos 3y ago
  I don’t recommend lastpass but notes were encrypted. This stemmed from an original miscommunication from a CS rep to a customer before it blew up but was later corrected. Independently verified because we can’t take Lastpass at their word: https://www.reddit.com/r/Lastpass/comments/zzz5x4/notes_are_encrypted/ https://www.reddit.com/r/Lastpass/comments/zzz5x4/notes_are_...
  - SV_BubbleTime 3y ago
    That was my understanding as well, but there were definitely unencrypted portions like URL. I assume for sharing purposes.
    - peblos 3y ago
      Yeah you’re right, URL was unencrypted along with some others. Doesn’t seem critical if we’re talking Facebook and twitter but becomes problematic with human rights orgs and the like. The justification was that it was used to match login fields against vault items. I’m no crypto expert but it seemed flimsy to me
gboss 3y ago
I agree. I’m looking for a better alternative. Been putting it off, any recommendations?
- taberiand 3y ago
  Depends on your requirements but 1Password and BitWarden are decent.
  - hedora 3y ago
    BitWarden works ok. I run the rust reimplementation of the server on a lan with no incoming port forwards. The main problem is that I can’t add or edit passwords when I am not home. I’d love another, similar, open source solution that used a crdt to merge offline database edits.
- rumblefrog 3y ago
  Been loving 1Password. If your work has 1Password Enterprise, you can get a free separate personal account.
  - SV_BubbleTime 3y ago
    That is true for most services now, including Lastpass and BW (iirc).
- deleted 3y ago
  [deleted]
- bboygravity 3y ago
  I'm using Keypass with Syncthing which is really great (both on Android and PC), but I need something that can properly auto-fill forms. Lastpass wasn't great at doing this automatically, but Keypass cannot do this automatically at all. Any recommendations?
  - skeaker 3y ago
    I run the Kee extension/plugin for autofilling with KeePass, works without issue in firefox (I have tried briefly in chrome and it seems okay there too, haven't used it nearly as much though).
deleted 3y ago
[deleted]

LastPass is such utter trash.

by Exuma 3y ago

LastPass is such utter trash.

Among their many failures, I am still shocked that the notes section for each password was not encrypted. All kinds of assumed-safe info will be in there from secret question answers to former passwords and account numbers. What fool of a project manager pushed for that?

Operyl 3y ago
> we need that extra 300msec of speed, Jim! Web metrics are all that matter!!!!11one
peblos 3y ago
I don’t recommend lastpass but notes were encrypted. This stemmed from an original miscommunication from a CS rep to a customer before it blew up but was later corrected. Independently verified because we can’t take Lastpass at their word: https://www.reddit.com/r/Lastpass/comments/zzz5x4/notes_are_encrypted/ https://www.reddit.com/r/Lastpass/comments/zzz5x4/notes_are_...
- SV_BubbleTime 3y ago
  That was my understanding as well, but there were definitely unencrypted portions like URL. I assume for sharing purposes.
  - peblos 3y ago
    Yeah you’re right, URL was unencrypted along with some others. Doesn’t seem critical if we’re talking Facebook and twitter but becomes problematic with human rights orgs and the like. The justification was that it was used to match login fields against vault items. I’m no crypto expert but it seemed flimsy to me

gboss 3y ago

I agree. I’m looking for a better alternative. Been putting it off, any recommendations?

taberiand 3y ago
Depends on your requirements but 1Password and BitWarden are decent.
- hedora 3y ago
  BitWarden works ok. I run the rust reimplementation of the server on a lan with no incoming port forwards. The main problem is that I can’t add or edit passwords when I am not home. I’d love another, similar, open source solution that used a crdt to merge offline database edits.
rumblefrog 3y ago
Been loving 1Password. If your work has 1Password Enterprise, you can get a free separate personal account.
- SV_BubbleTime 3y ago
  That is true for most services now, including Lastpass and BW (iirc).
deleted 3y ago
[deleted]
bboygravity 3y ago
I'm using Keypass with Syncthing which is really great (both on Android and PC), but I need something that can properly auto-fill forms. Lastpass wasn't great at doing this automatically, but Keypass cannot do this automatically at all. Any recommendations?
- skeaker 3y ago
  I run the Kee extension/plugin for autofilling with KeePass, works without issue in firefox (I have tried briefly in chrome and it seems okay there too, haven't used it nearly as much though).

deleted 3y ago

[deleted]