3 ms·

LastPass has a number of features that make it more secure than you think, without having to type in the master password every time. You can tell it to trust sp

by NateDad 13y ago

LastPass has a number of features that make it more secure than you think, without having to type in the master password every time. You can tell it to trust specific machines (like your home desktop) that are highly unlikely to be compromised, and you won't need to type in your password except for information you mark as secure (for example, I require my master password to access the credit card data info I keep in lastpass). For slightly less physically secure machines (like a laptop), you can have the local login time out, so you only have to enter your master password once every N minutes/hours. You can also get 2 factor authentication (free with google authenticator on your smartphone, or slightly less free with yubikey and others). Thus, even if someone did somehow get/break your master password (unlikely), they still wouldn't be able to use it for anything. Lastpass really is quite great.

criley2 13y ago
You're discussing the very issues I have as if I don't bring them up. Allowing your lastpass to "trust" your machine means ANYONE with physical access to your machine has access to 100% of every password you store there. How is that not the same as writing down passwords on a sticky note and sticking them under my keyboard?
- coryfklein 13y ago
  If somebody sees your password on a sticky note, they now know your password. If they get access to your computer with LastPass logged in, they can't get your master password. Small distinction, but there it is. Also, with LastPass you are just trading risks. You increase the risk of your accounts being compromised by access to your computer, but you decrease your risk of accounts being compromised because HN password database was cracked. I use LastPass because I think that trade results in less overall risk, especially because it replaced saving my passwords in Chrome's less-secure password manager.
- nobodysfool 13y ago
  How is Lastpass any less secure? Anyone with access to your computer could put a USB keylogger on it and get all your passwords that way. The only way to prevent that would be to use an on screen keyboard, but then all the attacker would have to do is stand behind you or remote control your computer.
  - criley2 13y ago
    My point is simple: Memorizing a few unique passwords for mission critical services while using generic throwaways for low-priority sites is more secure than LastPass can ever be. I started this thread asking if there was a better solution that memorizing 5-10 passwords and using some variable of a throwaway for the majority of everything else, and I'm still not convinced that my method isn't the best outside of just hard memorizing a unique password for every site. Fact is: my memorized passwords can only be compromised where they are stored on servers (or through a keylogger). LastPass can be compromised every single way that my memorized passwords can, in addition to being compromisable on any computer you use it on, and the LastPass services stores all of your passwords offsite, all of them, adding in another huge vector for attack against your entire catalog--- in a way that my memory can never be attacked (without say, interrogation/force). I don't know, I don't like the idea of a digital store of all of my most critical information put behind a password that doesn't even pop-up on your computer. Mine as well just store all your passwords in Chrome. Same amount of security. Actually Chrome probably does better since it won't automatically push your passwords to the cloud unless you sync...
    - subsection1h 13y ago
      I started this thread asking if there was a better solution that memorizing 5-10 passwords and using some variable of a throwaway for the majority of everything else, and I'm still not convinced that my method isn't the best outside of just hard memorizing a unique password for every site. When I was younger, I had only 5-10 important accounts and I memorized unique passwords that I thought were strong. Now I have many more important accounts, including four brokerage accounts, several bank accounts, half a dozen credit card accounts, two domain registrar accounts associated with tens of thousands of dollars worth of domains, etc. I have a separate computer that I only use to access these important accounts, and my passwords for these accounts are stored in KeePass, which allows me to have unique passwords with 200+ bits of entropy. I prefer my current setup more than my old setup.
sillysaurus2 13y ago
You can tell it to trust specific machines (like your home desktop) that are highly unlikely to be compromised Highly likely to be compromised, you mean? Viruses are a thing, and you can bet malware will target LastPass in order to get to finances.

by NateDad 13y ago

criley2 13y ago

You're discussing the very issues I have as if I don't bring them up. Allowing your lastpass to "trust" your machine means ANYONE with physical access to your machine has access to 100% of every password you store there. How is that not the same as writing down passwords on a sticky note and sticking them under my keyboard?

coryfklein 13y ago
If somebody sees your password on a sticky note, they now know your password. If they get access to your computer with LastPass logged in, they can't get your master password. Small distinction, but there it is. Also, with LastPass you are just trading risks. You increase the risk of your accounts being compromised by access to your computer, but you decrease your risk of accounts being compromised because HN password database was cracked. I use LastPass because I think that trade results in less overall risk, especially because it replaced saving my passwords in Chrome's less-secure password manager.
nobodysfool 13y ago
How is Lastpass any less secure? Anyone with access to your computer could put a USB keylogger on it and get all your passwords that way. The only way to prevent that would be to use an on screen keyboard, but then all the attacker would have to do is stand behind you or remote control your computer.
- criley2 13y ago
  My point is simple: Memorizing a few unique passwords for mission critical services while using generic throwaways for low-priority sites is more secure than LastPass can ever be. I started this thread asking if there was a better solution that memorizing 5-10 passwords and using some variable of a throwaway for the majority of everything else, and I'm still not convinced that my method isn't the best outside of just hard memorizing a unique password for every site. Fact is: my memorized passwords can only be compromised where they are stored on servers (or through a keylogger). LastPass can be compromised every single way that my memorized passwords can, in addition to being compromisable on any computer you use it on, and the LastPass services stores all of your passwords offsite, all of them, adding in another huge vector for attack against your entire catalog--- in a way that my memory can never be attacked (without say, interrogation/force). I don't know, I don't like the idea of a digital store of all of my most critical information put behind a password that doesn't even pop-up on your computer. Mine as well just store all your passwords in Chrome. Same amount of security. Actually Chrome probably does better since it won't automatically push your passwords to the cloud unless you sync...
  - subsection1h 13y ago
    I started this thread asking if there was a better solution that memorizing 5-10 passwords and using some variable of a throwaway for the majority of everything else, and I'm still not convinced that my method isn't the best outside of just hard memorizing a unique password for every site. When I was younger, I had only 5-10 important accounts and I memorized unique passwords that I thought were strong. Now I have many more important accounts, including four brokerage accounts, several bank accounts, half a dozen credit card accounts, two domain registrar accounts associated with tens of thousands of dollars worth of domains, etc. I have a separate computer that I only use to access these important accounts, and my passwords for these accounts are stored in KeePass, which allows me to have unique passwords with 200+ bits of entropy. I prefer my current setup more than my old setup.

sillysaurus2 13y ago

You can tell it to trust specific machines (like your home desktop) that are highly unlikely to be compromised Highly likely to be compromised, you mean? Viruses are a thing, and you can bet malware will target LastPass in order to get to finances.