91–100 of 188 posts
Earlier quoted context omitted.
KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.
Which mobile app do you use with KeePass? I use MiniKeePass and am pretty happy with it.
Earlier quoted context omitted.
KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.
I would suggest KeePassXC, which in my opinion, looks better since uses Qt rather than mono so has a more native feel. https://keepassxc.org/
Once it's implemented I may reconsider, but for now at least, I'd shy away from it.
Earlier quoted context omitted.
It's not like Tavis is creating these bugs. He's merely pointing out that the emperor has no clothes. Quite a socially awkward situation for town folk who've been living as if the clothes are wonderful. Additionally, in general and as is the case here, the bugs aren't in some nice kid's hobby project. It's not like he's pointing out that grandma's blog has XSS vulnerabilities. These are security products, which often…
I don't think I'd call them a 'sham'. They're not advertising something they don't do. I think they do everything that they say they do[1]. If this was a case where someone was able to get plaintext passwords from lastpass's server, you'd be right. The first thing I think people should realize is that there are vulnerabilities in every software, and addressing that fact goes a long way. I doubt that they weren't foll…
Yes there are vulnerabilities in every software. Even if your code is perfect the compiler will generate bugged code. Even if you fix that, the CPU still has bugs. These are certainly hard problems. However there's a difference between a subtle bug caused by a typo and complete lack of understanding of fundamentals. [1]
As for what products I consider having strong security, the crypto part of the Go standard library is good. Among large projects Chrome is good. Neither of them are perfect.
--
[1] I especially like the case of CryptoCat, a chat program that generated random crypto keys by concatenating strings of digits. https://tobtu.com/decryptocat.php
This doesn't seem to me like it compromised the passwords though. Am I missing something?
Any lastpass RPC was able to be called, which does mean that it compromised the passwords. Now, the worse part is that any code (any .bat file, which on windows is similar to a bash script) could be run on the host computer, which means they can effectively take over the host computer.
Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge pile of accounts. Second, there could be a relatively unsophisticated person with a grudge, like an ex-partner. In a distant third, there are nation-state-level actors. If I keep a local encrypted password file and copy it around by hand, I may have some vulne…
Also, I believe that a hacker who gained access to LastPass's database would merely get a bunch of encrypted passwords. LastPass doesn't know your master vault password, which is needed to unlock your vault and use the passwords that are stored there. So, they are a big target, but primarily for attacks like this where an individual page might be able to hijack the plugin for users visiting the site, and not because some could hack LastPass and get everyone's passwords.
Earlier quoted context omitted.
It's always worth remembering that using something like LastPass should be compared with the status quo that it often fixes (same password for everything, post-it notes, teams emailing passwords around).
Sure. Which is why Last Pass makes you safer if you use it for the long tail of rarely used non-critical passwords. The problem is once you are using Last Pass for those, it becomes more and more tempting to use it for passwords that actually matter, and for those you really really don't want to be using an online password manager. In fact, for the average person, I am not sure a post-it note full of passwords in the…
This actually sounds pretty good; I might start recommending this to non-technical friends and family.
EDIT: phone auto-completed "non-technical" to "non-profit technical"
Update: another vulnerability found, not patched yet. https://mobile.twitter.com/taviso/status/844312124541186048
Well. This is not a good week for lastpass. And for all the users of password managers which use a browser extension or a cloud synced database, KeepPassXC[1] is a good alternative, because it won't come close to touching your browser or any remote server. It is cross platform so you have no excuse. It also has a mobile app which is not made by the same developers but a different company so I would be wary of the app…
Brilliant find by taviso. So simple yet thousands of others passed over it. It takes a relentless mind to comb through all this code and actually find such an issue.
is that true? how do you know?
Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.
KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.
Are these a huge improvement from what was offered previously?