Let's put our passwords on a remote server which convinces us they're secure. How did we even get here that such information leaves our control?
LastPass stores passwords so securely, not even its users can access them
81–90 of 266 posts
Re: LastPass stores passwords so securely, not even its users can access them
#82IMO[0] everyone should have at most one password - to their email account. Everything else should be something along the lines of (in order of preference): 1) SSO (federated! Not the Google/Twitter/Facebook/GitHub oligopoly nonsense we have now), using email addresses as ids. 2) Emailed login links, a la Slack's magic links. Email addresses aren't perfect, but they're the globally unique, federated IDs we have, and g…
I hope that emailed login links cease to exist. I work at a large company. As a combination of lots of security scanning and, I think, intentional slowdown for virus spread mitigation, external email can take minutes to be delivered. More than 50% of the time I receive such a link (including from Slack, for example), it has timed out before it gets to me. Just let me use a good, long, randomly-according-to-a-recipe-g…
Seems pretty specific to large organizations though? That's a completely different thread model than someone wanting to log in to their social network to share cat memes. You're completely right that it needs to be handling differently and appropriately. But for everyday use, I've never had an issue with delivery on commodity email providers.
Re: LastPass stores passwords so securely, not even its users can access them
#83Not actually related to the article, but the headline makes me think of the "Muddy Puddle Test" for crypto, which goes like this: 1) Drop your device(s) into a muddy puddle (destroying them). 2) Slip in said puddle so you hit your head. On waking up you're absolutely fine, but are entirely incapable of remembering your passwords or encryption keys. 3) Can you get your cloud data back? If you can, then it's not actual…
What about biometrics?
Re: LastPass stores passwords so securely, not even its users can access them
#84If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.
Switched from LastPass to BitWarden over the weekend. I have 1,200+ passwords, and the transition was seamless. I even set up BitWarden on one of my web servers so that I can control my data -- even that took less than 30 minutes, thanks to BitWardenRS docker container.
The only thing I have yet to figure out for BitWarden is how to get a little icon to show up next to user/password fields in forms. I just have to right click and go to BitWarden (FireFox) to get there, which it just slightly more work. Still worth it.
Why would I pay $36/year (LastPass) for something that I can control for free?
Re: LastPass stores passwords so securely, not even its users can access them
#85Earlier quoted context omitted.
I evaluated a bunch of team password managers last year. Lastpass was really buggy and had a confusing UI. Dashlane also had odd limitations. 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive. I ended up recommending Bitwarden. Surprisingly the open source option had a great UI and great clients, with the bonus of being open source on both ends.
It’s surprising to me that the “master key” system on 1Password proved difficult for your users. For me, this is one of the simplest things about it: you remember one password that unlocks everything else. Am I talking about the same thing as you when I call this password the “master key”? I feel like I must be as this is flat-out the thing that makes 1Password easy to use.
They are talking about the "Secret Key" that is used in addition to your "Master Password." It was previously called an "Account Key."
Re: LastPass stores passwords so securely, not even its users can access them
#86Earlier quoted context omitted.
If you have a Raspberry Pi lying around, there's a docker image for the excellent bitwarden_rs server available that makes it a snap to get up and running: https://github.com/dani-garcia/bitwarden_rs/wiki/Which-conta...
The cost of electricity and my time is probably more than $10 a year.
Bitwarden is free anyways if you just need username and password stored
Re: LastPass stores passwords so securely, not even its users can access them
#87IMO[0] everyone should have at most one password - to their email account. Everything else should be something along the lines of (in order of preference): 1) SSO (federated! Not the Google/Twitter/Facebook/GitHub oligopoly nonsense we have now), using email addresses as ids. 2) Emailed login links, a la Slack's magic links. Email addresses aren't perfect, but they're the globally unique, federated IDs we have, and g…
Email is an incredibly vulnerable single point of failure. Plus the existing password infrastructure of the web isn't going away. Password managers are the best and most realistic option for most people.
Re: LastPass stores passwords so securely, not even its users can access them
#88Let's put our passwords on a remote server which convinces us they're secure. How did we even get here that such information leaves our control?
Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how.
It's not the best option, of course, but certainly better than weak and reused passwords, right?
Re: LastPass stores passwords so securely, not even its users can access them
#89keepassxc (just a simple encrypted password file) + syncthing (copies that file to all your devices) has been working pretty well for me on Linux/Android. I believe there's still no syncthing client for iOS unfortunately.
Re: LastPass stores passwords so securely, not even its users can access them
#90Some alternatives: * https://keepass.info/ * https://bitwarden.com/ * https://1password.com/
Keepass is very difficult to use in an automated way and the open-source clients are buggy. I had to search for hours for an ancient Perl script which amazingly works with both 1.x and 2.x Keepass databases (still the only library I've found that does so), then write a custom app to convert the output into something else.