Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass stores passwords so securely, not even its users can access them

theregister.co.uk

Post reply on HN
Print view View original

31–40 of 266 posts

Re: LastPass stores passwords so securely, not even its users can access them

#31

Post by yreg »

awinder wrote: post #8
scandox wrote: post #5

Earlier quoted context omitted.

Yeah they'll never go down. Why don't these systems support local storage as well? Is there greater security risk in syncing to a local device? Edit: I do not mean browser localStorage

1Password does support local storage, cloud is used for syncing to local storage so obviously in case of an outage you wouldn’t be able to sync updates. But you would be able to access and modify locally and then it would push when things came back online.

It also lets you sync via alternative services like Dropbox/Mega.

Re: LastPass stores passwords so securely, not even its users can access them

#32

Post by ailideex »

navidfarhadi wrote: post #3

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

BitWarden is one of the few things I pay for even though I don't have to simply because I really want it to keep existing.

Re: LastPass stores passwords so securely, not even its users can access them

#33

Post by LeifCarrotson »

The article went up an hour and a half ago, at the exact same time as https://status.lastpass.com/ updated to say they were investigating. In under an hour, they acknowledged, identified, fixed, and verified the issue.

The fix went out less than half an hour after they learned about it, and this HN submission was posted 1 hour ago, so no one learning of the issue by means of this HN submission will have been able to reproduce the problem.

Also, if you've enabled offline access to your vault (which used to be the default IIRC, and would be smart regardless of your password manager of choic) this won't affect you.

Re: LastPass stores passwords so securely, not even its users can access them

#35

Post by kefabean »

I like Enpass (enpass.io):

- non-subscription version available

- multi-platform (IOS, Android, MacOS, Linux, Windows)

- offline access (local DB)

- sync via non-Enpass servers (eg use dropbox, google drive, iCloud, box etc)

- actively maintained

I have been using for ~3 years on a revolving door of devices and have never experienced any issues - just works.

(Not affiliated in any way with Enpass)

Re: LastPass stores passwords so securely, not even its users can access them

#36

Post by gregod »

sigwinch28 wrote: post #18

I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom. [0]: https://www.passwordstore.org/

For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with.

When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.

Re: LastPass stores passwords so securely, not even its users can access them

#37

Post by croon »

navidfarhadi wrote: post #3

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

I'm 3 years into Bitwarden and have never looked back. I backed the kickstarter that failed some while back, but it seems he/they ended up managing without it. I should probably subscribe even if I don't need the extra features.

Re: LastPass stores passwords so securely, not even its users can access them

#38

Post by charles_f »

kalleboo wrote: post #14
NopeNotToday wrote: post #2

Some alternatives: * https://keepass.info/ * https://bitwarden.com/ * https://1password.com/

I evaluated a bunch of team password managers last year. Lastpass was really buggy and had a confusing UI. Dashlane also had odd limitations. 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. I ended up recommending Bitwarden. Surprisingly the open source option had a great UI and great clients, with the bonus of being open source on both ends.

> 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive.

Unsurprising, and at the same time it makes 1password's security scheme much more bullet proof.

You need that piece of information to identify the client, and even 1password doesn't have it, which means that when inevitably one of these cloud services gets attacked with success, it will less likely be them. Plus they can't see your stuff, that's a plus.

Security is not free.

Re: LastPass stores passwords so securely, not even its users can access them

#39

Post by MonadIsPronad »

kalleboo wrote: post #14
NopeNotToday wrote: post #2

Some alternatives: * https://keepass.info/ * https://bitwarden.com/ * https://1password.com/

I evaluated a bunch of team password managers last year. Lastpass was really buggy and had a confusing UI. Dashlane also had odd limitations. 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. I ended up recommending Bitwarden. Surprisingly the open source option had a great UI and great clients, with the bonus of being open source on both ends.

I think I may have read your review (did you make an article online?) and I'm now happily using Bitwarden. I just signed up for premium, not because I want the features, but because I want to support what they're doing.

Re: LastPass stores passwords so securely, not even its users can access them

#40

Post by docdeek »

oarsinsync wrote: post #28
docdeek wrote: post #23

Earlier quoted context omitted.

It’s surprising to me that the “master key” system on 1Password proved difficult for your users. For me, this is one of the simplest things about it: you remember one password that unlocks everything else. Am I talking about the same thing as you when I call this password the “master key”? I feel like I must be as this is flat-out the thing that makes 1Password easy to use.

There are four bits of information you need with 1Password teams 1. The team address .1password.com 2. Your login name (email usually) 3. Your 'secret key' 4. Your 'master password' I suspect GP is talking about item #3 being the point of confusion.

Ah, that might be it - I was talking as an individual user rather than imagining a team deployment.
Post reply on HN