LastPass stores passwords so securely, not even its users can access them • Hacker News Board

Re: LastPass stores passwords so securely, not even its users can access them

#91

Post by chousuke » Mon, Jan 20, 2020, 4:21 PM UTC

harryf wrote: post #53

daveoc64 wrote: post #42

Earlier quoted context omitted.

I'm sorry, what is your justification for not using cloud-based services? Lastpass (like pretty much all of these online password managers) will work offline, so if the service goes down, you can still access your data locally.

Not the OP and personally less radically against cloud-based services... But storing something as critical as passwords with a SAAS company which is obviously going to be target of attack and may or may not have the engineering resources to provide a reliable quality of service... seems like a bad idea. Google(Drive) at least I trust to have the engineering resources to keep data secure, perhaps not from government s…

They don't really store your passwords, just an encrypted blob that's openable with your master password (more accurately, a key that is derived from it using an expensive operation so that brute-forcing is unfeasible.)

You do need to trust them enough that they will never sniff your master password (AFAIK even the web vault is local only) but eg. the command-line client is open source, so you can at least verify their protocol.

That said, I might switch to bitwarden at some point purely because it can be self-hosted.

Re: LastPass stores passwords so securely, not even its users can access them

#92

Post by karrotwaltz » Mon, Jan 20, 2020, 4:22 PM UTC

anonymouswacker wrote: post #84

navidfarhadi wrote: post #3

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

Switched from LastPass to BitWarden over the weekend. I have 1,200+ passwords, and the transition was seamless. I even set up BitWarden on one of my web servers so that I can control my data -- even that took less than 30 minutes, thanks to BitWardenRS docker container. The only thing I have yet to figure out for BitWarden is how to get a little icon to show up next to user/password fields in forms. I just have to ri…

With BitWaden FF, you can use Ctrl+Shift+L to auto fill your most recently used account for the current website.

Hope it helps.

Re: LastPass stores passwords so securely, not even its users can access them

#93

Post by ReidZB » Mon, Jan 20, 2020, 4:27 PM UTC

willyyr wrote: post #62

filipn wrote: post #7

So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/

I tried that once but ran into so many errors for passwords that contained characters like ", or ;" that I gave up. Is there a way around this other then copying every entry manually?

I did the same switch like 5 years ago, and I remember having to `sed` (i.e. global find + replace) the LastPass output .csv to fix special characters before importing it into 1Password. Sadly I don't remember any more detail than that, but yes, there may be some manual massaging required. YMMV.

Re: LastPass stores passwords so securely, not even its users can access them

#94

Post by arcticfox » Mon, Jan 20, 2020, 4:28 PM UTC

mk89 wrote: post #69

nullspace wrote: post #57

Earlier quoted context omitted.

That’s bullshit. In reality (I was affected by this and it’s now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it. I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now. This was not a quick response time, don’t give them credit for…

It's a nice trick that many companies use. The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.

I learned another nice trick from GCP the other day; Stackdriver log ingestion was down, at least for me and a number of people on Twitter, and they simply put a yellow warning at the top of status.cloud.google.com while fixing it instead of making an official incident.

Magic, 100% uptime!

Re: LastPass stores passwords so securely, not even its users can access them

#95

Post by arminiusreturns » Mon, Jan 20, 2020, 4:35 PM UTC

navidfarhadi wrote: post #3

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

I really like the idea of Bitwarden but haven't used it yet. I think it will probably eventually be my go-to recommendation in this space, having fought with some of the other non-foss offerings.

Re: LastPass stores passwords so securely, not even its users can access them

#96

Post by spookyuser » Mon, Jan 20, 2020, 4:36 PM UTC

I never see the app I am currently using for my password manager on HN password manager threads so I will recommend it now.

I have been using Safeincloud https://www.safe-in-cloud.com/en/ for I feel like forever. The dev is quick to add new features, like autofill on android, and windows hello on windows.

It's a one time payment on android and IOS, Desktop apps are free.

I know that 1password is prob better and more secure, but I can't afford the monthly rate.

Re: LastPass stores passwords so securely, not even its users can access them

#97

Post by arminiusreturns » Mon, Jan 20, 2020, 4:38 PM UTC

BuildTheRobots wrote: post #67

Not actually related to the article, but the headline makes me think of the "Muddy Puddle Test" for crypto, which goes like this: 1) Drop your device(s) into a muddy puddle (destroying them). 2) Slip in said puddle so you hit your head. On waking up you're absolutely fine, but are entirely incapable of remembering your passwords or encryption keys. 3) Can you get your cloud data back? If you can, then it's not actual…

This is what paper keys stored in a secure location are for.

Re: LastPass stores passwords so securely, not even its users can access them

#98

Post by iamaelephant » Mon, Jan 20, 2020, 4:42 PM UTC

One of the best things I've done in my personal software life recently is getting off LastPass. The only other piece of software I have seen decay in quality so rapidly and markedly is PocketCasts.

Re: LastPass stores passwords so securely, not even its users can access them

#99

Post by uptown » Mon, Jan 20, 2020, 4:44 PM UTC

What’s the best (translation: easiest) password manager for non-technical users with Windows and iOS devices? I’m trying to find a good solution to help protect the accounts of my older parents. I use a legacy non-subscription 1Password version for myself so I’m not up to date about the subscription model or product changes of recent versions.

Re: LastPass stores passwords so securely, not even its users can access them

#100

Post by ghastmaster » Mon, Jan 20, 2020, 4:46 PM UTC

Given the possibility of software failure, would it be wise to use multiple password managers? I have the feeling this is a .45 vs 9mm question that doesn't have a real answer. More software exposes risk of data being exposed vs redundancy. I do not use software managers. I use a password protected spreadsheet(100 passwords). I hope they are safely encrypted.