Switched from LastPass to KeePass a couple months ago. Glad that I made the move.
LastPass bug leaks credentials from previous site
141–150 of 196 posts
Re: LastPass bug leaks credentials from previous site
#142Earlier quoted context omitted.
If you are only on Apple devices I would stay with Keychain Acess. Multi-platform? Bitwarden for me - if only for the external security audit they've done.
Keychain does not provide 2fa support, which is kind of a deal breaker
It that true? Apple does support 2FA for logging into your Apple ID which AFAIK is the only way to access synced keychain data.
Their approach is somewhat unique though. Once you log into any Apple device with a secure enclave (including all current macbooks, iphones, and ipads) that device becomes a second factor for authenticating future logins (which is prompted via an OS-level popup instead of a separate app or hardware dongle). So your computer itself can be the second factor which means you don't ever notice the 2FA enforcement, unlike most other systems that use a TOTP code or dongle.
Re: LastPass bug leaks credentials from previous site
#143They listed it as "Security: Minor bug fixes" in their release notes (v4.33.0, https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=...)
Leakage of credentials seems like more than a "minor" bug - particularly for software whose whole purpose is to securely store those credentials.
Re: LastPass bug leaks credentials from previous site
#144This is why I use pass and browserpass. I can't vouch for browserpass extension, but pass is just a wrapper for GnuPG. The encrypted files can be synced using almost any sync solution or even Git. There are apps for mobile too.
That makes no sense as the point of attack here is exactly the extension. So wrt this type of bug you gain nothing.
You have the option of not using the extension with this method, and the same vulnerability likely doesn't exist with Browserpass due to the communication method.
Re: LastPass bug leaks credentials from previous site
#145They listed it as "Security: Minor bug fixes" in their release notes (v4.33.0, https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=... ) Leakage of credentials seems like more than a "minor" bug - particularly for software whose whole purpose is to securely store those credentials.
well, users already leave passwords in the clipboard as normal usage...
Re: LastPass bug leaks credentials from previous site
#146The bug report says: by iframing popupfilltab.html (i.e. via moz-extension, ms-browser-extension, chrome-extension, etc). It's a valid web_accessible_resource. [...] y.src="chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/popupfilltab.html"; // or y.src="moz-extension://..."; My understanding is that this should not work with the Firefox version of LastPass, since each installation of the extension is given a uniq…
I have not read the article in detail, but earlier news stories I've seen said that not all platforms were effected. Chrome and I believe Opera were mentioned, but not firefox.
Re: LastPass bug leaks credentials from previous site
#147Is that true about LastPass being the most popular password manager? I just can't imagine it, I'm forced to use it with a client, and it has hands down the worst UI experience I've ever seen.
Really? I find this hard to believe, as a dev and internet user. Facebook, instagram, etc have far worse interfaces. You add the extension, easily add/generate/create/autofill your login info. It's usually as simple as clicking an icon that appears in the relevant field.
No, OP has to be exaggerating
Re: LastPass bug leaks credentials from previous site
#148Earlier quoted context omitted.
Even worse, before it was just 12$ and now it is 24$ before taxes so you end up paying 29,52$. A 246% increase.
People are really complaining about this, but honestly the features I get from the product absolutely justify paying $2/month. I'd probably pay $3-4 before it wouldn't become worth it for me
For me they have tripled the price since I first subscribed and the bugs aren't getting fixed.
I'm tired of the fill problems on iOS and Firefox and the price increases compound my irritation.
Re: LastPass bug leaks credentials from previous site
#149Earlier quoted context omitted.
> Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. Yes it is. It's a docker image, you're not setting up anything about the host that's exposed to the internet. Toss on watchtower to auto-update it and why would you ever need to touch it again? The system hosting docker isn't getting updates, no, but it's not publicly reachable, so that's low risk. The system that is publicly…
You just repeated back the exact problem scenario I set out above but abstracted it into a Docker container, adding an additional point of failure, and then called it a solved problem. Sorry, but nope. The Docker container itself is a fully functional machine. It also holds your most prized data (password database/password host). Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exa…
> Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exactly the problem I was posting about above.
What? It's not unmaintained at all. It's continuously maintained by the updates to the container. That's the whole point. Just because the user that did the deployment isn't the one doing the maintenance doesn't mean it's unmaintained.
The end-user isn't the one building the docker container, maybe that's where you're getting confused. Bitwarden themselves are maintaining it. That's how they are shipping the software for self-hosted deployments. Professionally maintained and self-hosted. That's why docker enters the picture, not for some imagined security reason as you incorrectly claim.
Re: LastPass bug leaks credentials from previous site
#150Earlier quoted context omitted.
>> Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. Sorry, not doomed to fail. I'm not gonna use a password manager that is "context aware" and has the capability to auto-fill for sensitive sites - that's just my threat model. I'm okay with context aware storing of less critical passwords.
What is your concern exactly? Bitwarden by default doesn't autofill forms, you have to open the Bitwarden menu and click on the title of the website you're on. There is an option to autofill, but it's buried in advanced settings and Bitwarden will display a warning if you try to enable it. (This message ought to be worded more explicitly—it currently says "this feature is in beta" rather than "this feature will decre…
[deleted]