4 ms·

Don't use any brain space for any passwords (except one ofcourse). https://lastpass.com/ https://lastpass.com/ Steve Gibson uses it, I won't pretend to be as

by bargl 13y ago

Don't use any brain space for any passwords (except one ofcourse). https://lastpass.com/ https://lastpass.com/ Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. Edit: Last pass can be loaded once in the browser, and if you link it to a yubikey it is much more secure. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-from-security.html http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f....

druiid 13y ago
I personally prefer Dashlane as it has a desktop interface as well. Not a big fan of only having the password manager in the browser, myself.
criley2 13y ago
I use lastpass sometimes, but it seems very insecure to keep passwords on my machine. I don't like keeping lastpass with a master password because typing a strong, long master password every single time I want any password is not a use case I enjoy, and I certainly don't want to lock up my passwords with something that is easily defeatable. And without a strong master password locking every attempt to use lastpass, it becomes far, far less secure than memorizing passwords.
- bargl 13y ago
  I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f... http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authentication-options/yubikey-authentication/ https://helpdesk.lastpass.com/security-options/multifactor-a... EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-was-carrying-password-for-secret-files-on-piece-of-paper.html http://www.telegraph.co.uk/news/uknews/crime/10276460/David-... Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.
  - DanBC 13y ago
    Steve Gibson has some flaws, and you really shouldn't be listening to him for any kind of security advice. If you have obsolete hard drives you might find his spinrite product useful.
    - bqe 13y ago
      Anyone remember his theory that removing raw socket access in Windows XP will stop the impending doom of spoofed packets and mass DDoS? http://www.theregister.co.uk/2001/06/25/steve_gibson_really_is_off/ http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...
  - mseebach 13y ago
    Bruce Schneier thinks it's OK to keep your password on a piece of paper in your wallet. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... But, of course, don't write the password to an encrypted drive on a piece of paper that you keep with the drive.
    - dllthomas 13y ago
      It depends what the alternatives are, and what threats you face.
    - bargl 13y ago
      That's also from 2005... Which isn't to say that it isn't still relevant. Most people don't understand that you really do need random passwords, which means that you must figure out how to create them properly. Sure write them down if they don't matter, but don't write your bank account password down, or your google account. Especially if you have your ID in your wallet it'd be pretty easy to find you and get all your passwords if you lost your wallet. If you DO write them down, leave some portion of your password off. I.E. your password is "password*&^&" only write down "password" and append the rest from memory.
  - criley2 13y ago
    Someone can photograph my wallet picture? Then they could go to my computer and photograph my LastPass which, as this thread explains, is perfectly 'secure' to leave without a master password on 'trusted' machines. Literally identical threat, IMO, being personally targeted for password theft. If they can get my wallet, they can get to my desktop, I imagine.
- munin 13y ago
  I think that your gut is right. a problem with storing your passwords electronically (or really anything electronically) is that you don't have any notification of when they are compromised. assuming that every place you use a password is both competent and honest (which is a stretch), the only way for someone to get your passwords is to compromise your computer. if they do that, and you use lastpass, then they have all of your passwords. for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse.
  - IgorPartola 13y ago
    LastPass is a huge net gain in security compared to almost anything else you could reasonably do. As almost anyone online, I have a lot of different accounts. Aside from my main bank account and my email, I do not know any of them as they are long random single use strings. LastPass has made certain compromises in security to give you more functionality. For example, you can log into their website and enter your master password, to retrieve any other password. This is bad since the browser can be compromised. However, I trust the browser and LastPass more than I trust my ability to keep the passwords secure. There is no way that I am going to remember the 300 or so passwords I have stored in LastPass and I will certainly not be able to change them as fast as I sometimes have to. I am not saying that LastPass is the end-all-be-all of security, but compared to what 99.999% of people are doing, it is a huge win. IMHO, your statements are spreading FUD. > assuming that every place you use a password is both competent and honest (which is a stretch), the only way for someone to get your passwords is to compromise your computer. if they do that, and you use lastpass, then they have all of your passwords. That assumption has been proven time and again to be completely false. As someone who had their BTC stolen while using what would be considered a secure password, I can say that password cracking against a stolen database dump is not a theoretical threat. > for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. This goes directly against your initial point that you don't know when your passwords have been compromised. You have no idea when someone takes a picture of your password sheet :)
  - stonemetal 13y ago
    Or don't put important passwords in lastpass. I know my bank password is the least secure password I have because it wasn't randomly generated by lastpass and is easy for me to remember. On the other hand it has the lowest risk of theft profile(not in lastpass, not written down, etc.) As a security layperson I am not sure which matters more, secure as in password strength or secure in terms of ease of discovery.
- NateDad 13y ago
  LastPass has a number of features that make it more secure than you think, without having to type in the master password every time. You can tell it to trust specific machines (like your home desktop) that are highly unlikely to be compromised, and you won't need to type in your password except for information you mark as secure (for example, I require my master password to access the credit card data info I keep in lastpass). For slightly less physically secure machines (like a laptop), you can have the local login time out, so you only have to enter your master password once every N minutes/hours. You can also get 2 factor authentication (free with google authenticator on your smartphone, or slightly less free with yubikey and others). Thus, even if someone did somehow get/break your master password (unlikely), they still wouldn't be able to use it for anything. Lastpass really is quite great.
  - criley2 13y ago
    You're discussing the very issues I have as if I don't bring them up. Allowing your lastpass to "trust" your machine means ANYONE with physical access to your machine has access to 100% of every password you store there. How is that not the same as writing down passwords on a sticky note and sticking them under my keyboard?
    - coryfklein 13y ago
      If somebody sees your password on a sticky note, they now know your password. If they get access to your computer with LastPass logged in, they can't get your master password. Small distinction, but there it is. Also, with LastPass you are just trading risks. You increase the risk of your accounts being compromised by access to your computer, but you decrease your risk of accounts being compromised because HN password database was cracked. I use LastPass because I think that trade results in less overall risk, especially because it replaced saving my passwords in Chrome's less-secure password manager.
    - nobodysfool 13y ago
      How is Lastpass any less secure? Anyone with access to your computer could put a USB keylogger on it and get all your passwords that way. The only way to prevent that would be to use an on screen keyboard, but then all the attacker would have to do is stand behind you or remote control your computer.
Gormo 13y ago
Are there any advantages of LastPass over KeePass? I've always been very wary about storing passwords in a third-party hosted webapp.
- coryfklein 13y ago
  I'm not familiar with KeePass, but I can tell you that LastPass does not know your master password. They just keep an encrypted copy of your password database which gets decrypted locally when you type in the password. For this reason, if you lose your master password, LastPass can't unlock your passwords for you. You'll have to go to the NSA for that.
- rpdillon 13y ago
  I'm not a security expert, but this seems to be a fair question. I use KeePass (have for years). One of my problems with LastPass is that the whole system is bootstrapped over HTTPS, which is has some insecurities. Essentially, LastPass sends your browser JavaScript via HTTPS which is then used to encrypt all your passwords using AES and send them over the net. The problem is that the original JavaScript payload could be compromised by third parties that have access to the root CA. I realize that revelations about HTTPS insecurity are new and limited to nation-state attacks, but we're talking about all your passwords, here. Putting HTTPS insecurity aside, we really shouldn't be implementing crypto in JavaScript. http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ KeePass is both native and open-source, so it avoids many of the problems that LastPass presents, IMHO. Simply install the client program and sync via SparkleShare, git, Dropbox, UbuntuOne, Google Drive, etc.
  - orthecreedence 13y ago
    Ehh, going to come out and say Matasano is wrong here. You can do crypto in JS, just don't download it every time (distribute signed packages via browser add-ons). The part of the article that attacks extensions just makes a bunch of assumptions (like, you're going to download scripts and eval them from your extension). It's a leap. Plus that article attacks JS doing crypto that the server will decrypt (which, yes is useless, use TLS). It doesn't address using browser add-ons to do AES encryption, have your data stored on the server in encrypted form, and only decrypted when you download it again. Is this method flawed? Only if you do a web-app instead of a browser add-on. Once you package the client code, it can be just as hard to break as something like KeePass (assuming the add-on itself has a decent security policy, ie don't eval()code from random places). Plus, modern browsers now have "window.crypto" which provides a PRNG. So there goes that argument. The article is just completely wrong in many ways. The only valid point I see it make is about garbage collection and potential for reading decrypted memory directly (MANY languages have this problem, not just JS). One of the points you brought up is extremely valid though: LastPass is closed-source, so it's nearly impossible to truly validate the crypto. Keepass (I also use it) is a much better option, and great when paired with some sort of sync utility.
MichaelGG 13y ago
>Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. The last person you should take security advice is from Steve Gibson. He's done an amazing job of making himself out to be a "security expert" but his understanding of security is ... exceedingly limited. Read this post to see one example how he just, like, doesn't understand anything at all: https://www.grc.com/ssl/ev.htm https://www.grc.com/ssl/ev.htm

by bargl 13y ago

druiid 13y ago

I personally prefer Dashlane as it has a desktop interface as well. Not a big fan of only having the password manager in the browser, myself.

criley2 13y ago

I use lastpass sometimes, but it seems very insecure to keep passwords on my machine. I don't like keeping lastpass with a master password because typing a strong, long master password every single time I want any password is not a use case I enjoy, and I certainly don't want to lock up my passwords with something that is easily defeatable. And without a strong master password locking every attempt to use lastpass, it becomes far, far less secure than memorizing passwords.

bargl 13y ago
I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f... http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authentication-options/yubikey-authentication/ https://helpdesk.lastpass.com/security-options/multifactor-a... EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-was-carrying-password-for-secret-files-on-piece-of-paper.html http://www.telegraph.co.uk/news/uknews/crime/10276460/David-... Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.
- DanBC 13y ago
  Steve Gibson has some flaws, and you really shouldn't be listening to him for any kind of security advice. If you have obsolete hard drives you might find his spinrite product useful.
  - bqe 13y ago
    Anyone remember his theory that removing raw socket access in Windows XP will stop the impending doom of spoofed packets and mass DDoS? http://www.theregister.co.uk/2001/06/25/steve_gibson_really_is_off/ http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...
- mseebach 13y ago
  Bruce Schneier thinks it's OK to keep your password on a piece of paper in your wallet. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... But, of course, don't write the password to an encrypted drive on a piece of paper that you keep with the drive.
  - dllthomas 13y ago
    It depends what the alternatives are, and what threats you face.
  - bargl 13y ago
    That's also from 2005... Which isn't to say that it isn't still relevant. Most people don't understand that you really do need random passwords, which means that you must figure out how to create them properly. Sure write them down if they don't matter, but don't write your bank account password down, or your google account. Especially if you have your ID in your wallet it'd be pretty easy to find you and get all your passwords if you lost your wallet. If you DO write them down, leave some portion of your password off. I.E. your password is "password*&^&" only write down "password" and append the rest from memory.
- criley2 13y ago
  Someone can photograph my wallet picture? Then they could go to my computer and photograph my LastPass which, as this thread explains, is perfectly 'secure' to leave without a master password on 'trusted' machines. Literally identical threat, IMO, being personally targeted for password theft. If they can get my wallet, they can get to my desktop, I imagine.
munin 13y ago
I think that your gut is right. a problem with storing your passwords electronically (or really anything electronically) is that you don't have any notification of when they are compromised. assuming that every place you use a password is both competent and honest (which is a stretch), the only way for someone to get your passwords is to compromise your computer. if they do that, and you use lastpass, then they have all of your passwords. for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse.
- IgorPartola 13y ago
  LastPass is a huge net gain in security compared to almost anything else you could reasonably do. As almost anyone online, I have a lot of different accounts. Aside from my main bank account and my email, I do not know any of them as they are long random single use strings. LastPass has made certain compromises in security to give you more functionality. For example, you can log into their website and enter your master password, to retrieve any other password. This is bad since the browser can be compromised. However, I trust the browser and LastPass more than I trust my ability to keep the passwords secure. There is no way that I am going to remember the 300 or so passwords I have stored in LastPass and I will certainly not be able to change them as fast as I sometimes have to. I am not saying that LastPass is the end-all-be-all of security, but compared to what 99.999% of people are doing, it is a huge win. IMHO, your statements are spreading FUD. > assuming that every place you use a password is both competent and honest (which is a stretch), the only way for someone to get your passwords is to compromise your computer. if they do that, and you use lastpass, then they have all of your passwords. That assumption has been proven time and again to be completely false. As someone who had their BTC stolen while using what would be considered a secure password, I can say that password cracking against a stolen database dump is not a theoretical threat. > for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. This goes directly against your initial point that you don't know when your passwords have been compromised. You have no idea when someone takes a picture of your password sheet :)
- stonemetal 13y ago
  Or don't put important passwords in lastpass. I know my bank password is the least secure password I have because it wasn't randomly generated by lastpass and is easy for me to remember. On the other hand it has the lowest risk of theft profile(not in lastpass, not written down, etc.) As a security layperson I am not sure which matters more, secure as in password strength or secure in terms of ease of discovery.
NateDad 13y ago
LastPass has a number of features that make it more secure than you think, without having to type in the master password every time. You can tell it to trust specific machines (like your home desktop) that are highly unlikely to be compromised, and you won't need to type in your password except for information you mark as secure (for example, I require my master password to access the credit card data info I keep in lastpass). For slightly less physically secure machines (like a laptop), you can have the local login time out, so you only have to enter your master password once every N minutes/hours. You can also get 2 factor authentication (free with google authenticator on your smartphone, or slightly less free with yubikey and others). Thus, even if someone did somehow get/break your master password (unlikely), they still wouldn't be able to use it for anything. Lastpass really is quite great.
- criley2 13y ago
  You're discussing the very issues I have as if I don't bring them up. Allowing your lastpass to "trust" your machine means ANYONE with physical access to your machine has access to 100% of every password you store there. How is that not the same as writing down passwords on a sticky note and sticking them under my keyboard?
  - coryfklein 13y ago
    If somebody sees your password on a sticky note, they now know your password. If they get access to your computer with LastPass logged in, they can't get your master password. Small distinction, but there it is. Also, with LastPass you are just trading risks. You increase the risk of your accounts being compromised by access to your computer, but you decrease your risk of accounts being compromised because HN password database was cracked. I use LastPass because I think that trade results in less overall risk, especially because it replaced saving my passwords in Chrome's less-secure password manager.
  - nobodysfool 13y ago
    How is Lastpass any less secure? Anyone with access to your computer could put a USB keylogger on it and get all your passwords that way. The only way to prevent that would be to use an on screen keyboard, but then all the attacker would have to do is stand behind you or remote control your computer.

Gormo 13y ago

Are there any advantages of LastPass over KeePass? I've always been very wary about storing passwords in a third-party hosted webapp.

coryfklein 13y ago
I'm not familiar with KeePass, but I can tell you that LastPass does not know your master password. They just keep an encrypted copy of your password database which gets decrypted locally when you type in the password. For this reason, if you lose your master password, LastPass can't unlock your passwords for you. You'll have to go to the NSA for that.
rpdillon 13y ago
I'm not a security expert, but this seems to be a fair question. I use KeePass (have for years). One of my problems with LastPass is that the whole system is bootstrapped over HTTPS, which is has some insecurities. Essentially, LastPass sends your browser JavaScript via HTTPS which is then used to encrypt all your passwords using AES and send them over the net. The problem is that the original JavaScript payload could be compromised by third parties that have access to the root CA. I realize that revelations about HTTPS insecurity are new and limited to nation-state attacks, but we're talking about all your passwords, here. Putting HTTPS insecurity aside, we really shouldn't be implementing crypto in JavaScript. http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ KeePass is both native and open-source, so it avoids many of the problems that LastPass presents, IMHO. Simply install the client program and sync via SparkleShare, git, Dropbox, UbuntuOne, Google Drive, etc.
- orthecreedence 13y ago
  Ehh, going to come out and say Matasano is wrong here. You can do crypto in JS, just don't download it every time (distribute signed packages via browser add-ons). The part of the article that attacks extensions just makes a bunch of assumptions (like, you're going to download scripts and eval them from your extension). It's a leap. Plus that article attacks JS doing crypto that the server will decrypt (which, yes is useless, use TLS). It doesn't address using browser add-ons to do AES encryption, have your data stored on the server in encrypted form, and only decrypted when you download it again. Is this method flawed? Only if you do a web-app instead of a browser add-on. Once you package the client code, it can be just as hard to break as something like KeePass (assuming the add-on itself has a decent security policy, ie don't eval()code from random places). Plus, modern browsers now have "window.crypto" which provides a PRNG. So there goes that argument. The article is just completely wrong in many ways. The only valid point I see it make is about garbage collection and potential for reading decrypted memory directly (MANY languages have this problem, not just JS). One of the points you brought up is extremely valid though: LastPass is closed-source, so it's nearly impossible to truly validate the crypto. Keepass (I also use it) is a much better option, and great when paired with some sort of sync utility.

MichaelGG 13y ago

>Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. The last person you should take security advice is from Steve Gibson. He's done an amazing job of making himself out to be a "security expert" but his understanding of security is ... exceedingly limited. Read this post to see one example how he just, like, doesn't understand anything at all: https://www.grc.com/ssl/ev.htm https://www.grc.com/ssl/ev.htm