181–188 of 188 posts
Earlier quoted context omitted.
same here. Trialling Dashlane, but not quite convinced yet..
If you're interested in an open source option that compares quite well to the LastPass feature-set, check out bitwarden: https://bitwarden.com/ (note: I am the lead developer).
Earlier quoted context omitted.
He also found vulnerabilities in many more security products out there. At some point, years ago, Microsoft became very hostile toward him, but things seem to be better now.
> Microsoft became very hostile toward him What happened?
http://www.theverge.com/2013/5/23/4358400/google-engineer-ba...
"Microsoft treat vulnerability researchers with great hostility," he says.
Earlier quoted context omitted.
That is honestly embarrassing. I'm glad I don't use LastPass.
My girlfriend was wondering why programmers are so pedantic, and my primary response was "because they can never be wrong", and as a corollary it becomes important to always be right and develop a culture that points out every flaw in competence. Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations.
With that said, I definitely agree on things that aren't security related.
Earlier quoted context omitted.
Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passp…
1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously. 1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to…
LastPass also unfortunately has in-pane banner pop-ups which I do not trust at all. Blind and automatic autofill is dangerous. I'm not sure if you can enable that.
Another feature I like is the detection of compromised sites and password rotation reminders.
The test page is still vulnerable for me. https://lock.cmpxchg8b.com/SaiGhij5/lastpass.html Chrome 57.0.2987.110 (64-bit) Version: 4.1.42 Built: Thu Mar 09 2017 12:40:16 GMT-0500 (EST) Binary Component: true (Native Messaging version 4.1.34, built Jan 11 2017 01:45:24) Any idea why? I thought no user action was required? No custom error message for NXDOMAIN (I think?), I see the Lastpass site, then calc.exe opens. ht…
Earlier quoted context omitted.
I've wanted to use such a thing, but the requirement to use a specific browser is always a massive bother same with things like yubikey It seems like it would be better to just fake a keyboard output instead? then you could have something that could work on all platforms in all situations
KeePass does this. Autofill activates the last window, finds the "input control" on the window, then tries to type in the username, tab key, password. It breaks in all the expected ways, and sometimes new and exciting ways.
Hardware faking of the keyboard would work fine though
>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…
Personal attacks are not allowed on HN. We ban accounts that do this, so please don't do it again. Unfortunately, your comment history has plenty of uncivil and unsubstantive comments. It also has some really good ones, so we aren't banning you, but if you keep doing this, we'll have to, so please fix it. We detached this subthread from https://news.ycombinator.com/item?id=13927087 and marked it off-topic.
I should have used a gentler tone. Sorry for rankling.
Earlier quoted context omitted.
Please don't give security advice unless you know what you are talking about. It just spreads misinformation.
Please elucidate. Misinformation like, "Always use a reputable cloud password manager, like LastPass?" Along with a trusty antivirus, am I right? To be further contrarian, if the common man is going to use a password manager, use Chrome's built-in auto-fill, without antivirus or other 3rd-party bolt-ons, be they LastPass, KeepPass, 1password etc. You know who Tavis works for, right? Chrome's application security is b…
If you are going to memorize passwords, feel free to memorize ASCII gibberish if that's what you are into. Or memorize random phrases, since many (most?) humans find those easier to remember.