When an article states "...the bug relies on executing malicious JavaScript...", why is the bug considered to be in the plugin and not JavaScript?
Using a programming language to exploit something doesn't mean the programming language is flawed.
LastPass bug leaks credentials from previous site
81–90 of 196 posts
Re: LastPass bug leaks credentials from previous site
#82Earlier quoted context omitted.
I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.
> KeePass and similar are a better way to go, if slightly more labor intensive. Slightly? Just thinking about the synchronization between machines makes this an understatement in my opinion.
For just over a year I've been using Syncthing with a folder specifically for KeePass, and it's worked really well - I just have a raspberry pi running 24/7 so my phone and PC pick up the changes whenever I reopen my database. I imagine it's similarly hassle-free with a self-hosted cloud like Owncloud, too.
Re: LastPass bug leaks credentials from previous site
#83Earlier quoted context omitted.
Love to hear more about why BitWarden is a safer choice than Lastpass if anyone cares to chime in. Thanks.
It isn't. But they're both safe choices. Both are based on the same underlying principles (AES encrypted database, encrypted using a slow hash of the master password). Both have been audited professionally. Both have browser extensions whose source code you can read (it is JavaScript, just open the extensions directory). Both support a full array of 2F options. People are moving from LastPass to BitWarden because it…
Thank you, that's helpful.
Re: LastPass bug leaks credentials from previous site
#84Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.
I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.
Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate.
I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no password manager at all because it was too cumbersome.
Re: LastPass bug leaks credentials from previous site
#85I quit LastPass when they were acquired by LogmeIn and doubled their prices to $24 a year, and their constant issues with autofill (atleast for websites in my country). I switched to Bitwarden and haven't faced an issue since.
Even worse, before it was just 12$ and now it is 24$ before taxes so you end up paying 29,52$. A 246% increase.
I got my renewal notice email in the other day. It's $36 now.
"Your LastPass Premium subscription will renew at $36 per year; this reflects the 2019 updated list price."
I think I'm going to switch to Bitwarden after reading some of the comments in the thread.
Re: LastPass bug leaks credentials from previous site
#86I hope this fixes the issue I have with one of my banking sites where it propoluates the login with my old username and password which aren't stored in LastPass anymore. Really weird that it seems to have them cached somewhere so I have manually select the bank's credentials in order to log in.
Re: LastPass bug leaks credentials from previous site
#87When an article states "...the bug relies on executing malicious JavaScript...", why is the bug considered to be in the plugin and not JavaScript?
Using a programming language to exploit something doesn't mean the programming language is flawed.
So, are they using the phrase "malicious JavaScript" correctly? Shouldn't they remove "malicious"?
Re: LastPass bug leaks credentials from previous site
#88Earlier quoted context omitted.
Not parent, but BW is opensource, and they have not had any high-profile incident yet, afaik.
They also give you the option to self-host, so you don't have to trust their hosting service if you don't want to. Own your data!
Can you trust your own hosting though?
Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. It is easy to misconfigure Linux to be insecure, most distro's ship with too much software, and auto-update is often inadequate to maintain a secure environment.
There's far too many compromised Linux servers out in the world that people set up "to do one thing" turned on auto-update and then forgot about for years. Botters and spammers love them.
This has little to do with Bitwarden itself and everything to do with how much knowledge and time is required to correctly run any internet accessible server. People are inherently lazy and it is very easy to get apathetic when it just continues to work, until something bad happens.
Re: LastPass bug leaks credentials from previous site
#89Earlier quoted context omitted.
Love to hear more about why BitWarden is a safer choice than Lastpass if anyone cares to chime in. Thanks.
It isn't. But they're both safe choices. Both are based on the same underlying principles (AES encrypted database, encrypted using a slow hash of the master password). Both have been audited professionally. Both have browser extensions whose source code you can read (it is JavaScript, just open the extensions directory). Both support a full array of 2F options. People are moving from LastPass to BitWarden because it…
Pretty sure LP's source is minified/obfuscated, it isn't just "open the extension's directory". In my experience LastPass was also much much slower in too many use-cases.
Re: LastPass bug leaks credentials from previous site
#90It's interesting to note that browser extensions continue to be the primary point of vulnerability for password management solutions. IIRC, it's been quite a long time since vaults themselves were breached. It is an undeniably more secure option to use password managers without their associated extensions. Certainly less convenient, but ponder carefully your threat model.
Unfortunately the browsers persist in not providing the necessary APIs to allow the password managers to work safely.
The Mozilla bug (1344788) has been open for three years with no meaningful action in 2. It's been stuck waiting for security review, with nobody empowered to do it.