Seems likely that the link will be replaced by a link to Tavis's write-up https://bugs.chromium.org/p/project-zero/issues/detail?id=19..., but media coverage is interesting on its own, so I'll note the link is currently https://www.zdnet.com/article/lastpass-bug-leaks-credentials... / title "LastPass bug leaks credentials from previous site". I won't quote specific passages, it's just interesting to watch attempts to distill a technical issue into something for the general public's consumption.
LastPass bug leaks credentials from previous site
101–110 of 196 posts
Re: LastPass bug leaks credentials from previous site
#102Earlier quoted context omitted.
> KeePass and similar are a better way to go, if slightly more labor intensive. Slightly? Just thinking about the synchronization between machines makes this an understatement in my opinion.
I store the keepass file in a cloud sync service. The file is encrypted. The keepass application can perform "auto-type" which works for all sensible applications and websites that have username/password input fields and a log-in button. Recently, more and more websites split the log-in into two screens, first email and then password. This completely breaks auto-type and is horrible in every way. Please don't do it.
PasswordWallet can auto-type across split login screens since it can be configured to pause between username/password.
Re: LastPass bug leaks credentials from previous site
#103Earlier quoted context omitted.
1Password has a Families plan for this.
I will look into this. I do trust certain family members with access to my vault password, but the notification of access and ability to give access to a trusted third party (my lawyer) that is available with LP is very compelling.
1Password allows you to add family members with access to specific values either read-only or read/write. The system for adding access is multi-step so unless you add someone to a vault they shouldn’t see, you have the flexibility to share as little or as much as you want. Since you can name the vaults you can name them things like “Shared with M Toussant (Attorney)” or “Samir Martha and Paul” which can make it easy to determine where to store what secrets. Have been using Business for a few years with some of my companies and Family with my family and have had good experiences. You can initiate recoveries as the administrator as well which has been helpful in both cases.
Re: LastPass bug leaks credentials from previous site
#104Earlier quoted context omitted.
Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no…
>> Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. Sorry, not doomed to fail. I'm not gonna use a password manager that is "context aware" and has the capability to auto-fill for sensitive sites - that's just my threat model. I'm okay with context aware storing of less critical passwords.
The vast majority of people don't have the same threat model, and unfortunately just want the product to work, or they won't use it at all. If you can't provide relevant information for the current website, you just won't be able to succeed as a password manager outside of niche markets.
Re: LastPass bug leaks credentials from previous site
#105I have been using enpass, and I'm very satisfied. I was a LastPass user once, but never trusted their security model. Then switched to 1password, but the lack of good multiplatform support and their push to a cloud model made me look for alternatives. What I want is support for Mac, Windows, Linux, and Android; possibly one time payment; and local storage (most important). For syncing I use my own nextpass cloud. Bit…
I’m still using non-cloud 1password but I cant recommend it to anyone else or my employees because of the forced cloud thing
FYI, 1Password doesn’t force you to use their cloud service. Even if you subscribe (as opposed to standalone), you still don’t have to actually use it. I switched from an older standalone version to the current subscription version, but I’m not using their cloud service to sync my vault.
Re: LastPass bug leaks credentials from previous site
#106Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.
I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.
KeePass isn't a solution in case you want to share passwords with family or team members.
KeePass is barely decent for personal use only, and only for the desktop.
The quality of the available apps differs from platform to platform. For example Bitwarden has a decent iOS app, 1Password has a superb iOS app and in contrast the available KeePass app for iOS is a piece of shit – no offense intended but it's basically unmaintained, barely usable and does no sync so you'd better watch out for conflicts.
Re: LastPass bug leaks credentials from previous site
#107Earlier quoted context omitted.
> KeePass and similar are a better way to go, if slightly more labor intensive. Slightly? Just thinking about the synchronization between machines makes this an understatement in my opinion.
I store the keepass file in a cloud sync service. The file is encrypted. The keepass application can perform "auto-type" which works for all sensible applications and websites that have username/password input fields and a log-in button. Recently, more and more websites split the log-in into two screens, first email and then password. This completely breaks auto-type and is horrible in every way. Please don't do it.
You're able to adjust auto-type for accounts that break the login into two pages. I learned this fairly recently as I had the same frustration as you. Ref: https://keepass.info/help/base/autotype.html
Re: LastPass bug leaks credentials from previous site
#108Earlier quoted context omitted.
Love to hear more about why BitWarden is a safer choice than Lastpass if anyone cares to chime in. Thanks.
lastpass' privacy policy is very privacy hostile. They're now aggressively offering a free product with the ability to monitor (and sell) all browsing behavior tied to you as an individual (thanks to LogMeIn). >How We Use the Information We Collect and Receive >LogMeIn may access (which may include, with your consent, limited viewing or listening) and use the data we collect as necessary (a) to provide and maintain t…
LastPass only collects data on how you use the product and how well the product works. It doesn't collect info about your sites or browsing activity.
Re: LastPass bug leaks credentials from previous site
#109Earlier quoted context omitted.
They also give you the option to self-host, so you don't have to trust their hosting service if you don't want to. Own your data!
Can you trust your own hosting though? Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. It is easy to misconfigure Linux to be insecure, most distro's ship with too much software, and auto-update is often inadequate to maintain a secure environment. There's far too many compromised Linux servers out in the world that people set up "to do one thing" turned on auto-update and t…
> Can you trust your own hosting though?
Some people, organizations, or groups can, absolutely.
While this is definitely a valuable question to ask, self-hosting is still valuable for many. Also, as we have seen repeatedly, assuming a random company will devote resources towards security can be a very silly assumption.
Re: LastPass bug leaks credentials from previous site
#110This is one reason why I believe that browser based password managers are flawed. I've written about this in the past (link below). These apps are popular with normal people (due to convenience), but long-term, we should not trust web browsers plugins or add-ons as password managers. https://github.com/w8rbt/dpg#why-traditional-password-manage...
While in browser password managers have drawbacks, they have the big advantage that they stop fishing / fake domain attacks. I think I'm much mor likely to fall for one of those, than my password manager get hacked.
Also, generating all passwords off one master password deterministicly sounds like an awful, awful idea. If someone manages to get one of my passwords, they can try performing an offline attack against the encoding password. If they succeed, they have everything.