Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass stores passwords so securely, not even its users can access them

theregister.co.uk

Post reply on HN
Print view View original

101–110 of 266 posts

Re: LastPass stores passwords so securely, not even its users can access them

#101

Post by zndr »

ghastmaster wrote: post #100

Given the possibility of software failure, would it be wise to use multiple password managers? I have the feeling this is a .45 vs 9mm question that doesn't have a real answer. More software exposes risk of data being exposed vs redundancy. I do not use software managers. I use a password protected spreadsheet(100 passwords). I hope they are safely encrypted.

A seccond PW manager? Not necessary, an offline backup? Great idea. Most PW managers allow you to export in some way shape or form. Doing so and encrypting said file is a great idea, but also something that's hard to do enough for most people that I don't have a good solution.

Re: LastPass stores passwords so securely, not even its users can access them

#102

Post by dwaite »

Supermancho wrote: post #68
sgift wrote: post #61

Earlier quoted context omitted.

> The fix went out less than half an hour after they learned about it, The article says the issues started on Friday and users told them then. So, it seems to be three days for a fix, not half an hour.

> it seems to be three days for a fix, not half an hour. You are trying to conflate 2 different metrics. The first assertion, is from the time the ticket was investigated, not submitted. It might be useful to talk about expectation of service, since that's what you are getting at. 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate.

> 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate.

This line of reasoning sounds backwards to me. It is the importance of the service that drives the needed level of reliability and people should expect there to be a cost to match that level of urgency and have guarantees that the vendor understands and will meet those needs.

If LastPass expects user password management (aka consumer access to websites) to require under two 9's, they are wrong. If they can't meet a minimum level of reliability with a free tier, they should not be offering a free tier.

Re: LastPass stores passwords so securely, not even its users can access them

#103

Post by zndr »

filipn wrote: post #7

So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/

I'm more than a decade in on my 1Pwd journey. Loved it the whole time!

Re: LastPass stores passwords so securely, not even its users can access them

#104

Post by stronglikedan »

tryptophan wrote: post #45
ailideex wrote: post #32

Earlier quoted context omitted.

BitWarden is one of the few things I pay for even though I don't have to simply because I really want it to keep existing.

Same. And at 10$/year, its not like its un-affordable. Its probably my 3-4th most used piece of software, after win10, firefox, and thunderbird.

I just wish I could donate. I don't need the premium features, and I don't need yet-another-subscription-plan to worry about.

Re: LastPass stores passwords so securely, not even its users can access them

#105

Post by iamaelephant »

ryanmercer wrote: post #73
magd wrote: post #43

LP has a history of problems, but my company forces us to use that crappy product. I've complained about it for years. I use keepassx for personal, 1password for work, and lastpass for anything that I need to share with coworkers. I always wondered who got the kickback from LP.

>LP has a history of problems, but my company forces us to use that crappy product. I've been using them the better part of a decade, I've never had an issue and find calling it a 'crappy product' to be shocking. What sort of issues have you had?

LastPass is riddled with problems, and the quality has dropped precipitously since their acquisition by LogMeIn. For a sampling of their problems I suggest searching this site for their name.

https://hn.algolia.com/?q=lastpass

Re: LastPass stores passwords so securely, not even its users can access them

#106

Post by kingosticks »

mprev wrote: post #51
exhilaration wrote: post #15

Earlier quoted context omitted.

If you have a Raspberry Pi lying around, there's a docker image for the excellent bitwarden_rs server available that makes it a snap to get up and running: https://github.com/dani-garcia/bitwarden_rs/wiki/Which-conta...

Forgive my ignorance, and possibly laziness, but if the Pi SD card dies do your passwords go with it?

If you care about Pi reliability then don't have the root partition on an sd card.

Re: LastPass stores passwords so securely, not even its users can access them

#107

Post by ghastmaster »

arcticfox wrote: post #94
mk89 wrote: post #69

Earlier quoted context omitted.

It's a nice trick that many companies use. The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.

I learned another nice trick from GCP the other day; Stackdriver log ingestion was down, at least for me and a number of people on Twitter, and they simply put a yellow warning at the top of status.cloud.google.com while fixing it instead of making an official incident. Magic, 100% uptime!

If the service is down for a limited amount of individuals I consider it still up. This does beg the question of how many constitutes "down". I think the nature of the problem and quantity of users affected is important.

Re: LastPass stores passwords so securely, not even its users can access them

#108

Post by iamaelephant »

criley2 wrote: post #49

I'm shocked to see a post of such low quality on hacker news. It reads like an instagram post or twitter replies. I'm not familiar with "theregister.co.uk" but I honestly think it's the lowest quality article I've ever seen on this website

> I'm not familiar with "theregister.co.uk"

Then you're not qualified to be discussing software or the tech industry, frankly.

Re: LastPass stores passwords so securely, not even its users can access them

#109

Post by ghastmaster »

zndr wrote: post #101
ghastmaster wrote: post #100

Given the possibility of software failure, would it be wise to use multiple password managers? I have the feeling this is a .45 vs 9mm question that doesn't have a real answer. More software exposes risk of data being exposed vs redundancy. I do not use software managers. I use a password protected spreadsheet(100 passwords). I hope they are safely encrypted.

A seccond PW manager? Not necessary, an offline backup? Great idea. Most PW managers allow you to export in some way shape or form. Doing so and encrypting said file is a great idea, but also something that's hard to do enough for most people that I don't have a good solution.

Excellent points.

Re: LastPass stores passwords so securely, not even its users can access them

#110

Post by jupp0r »

chousuke wrote: post #91
harryf wrote: post #53

Earlier quoted context omitted.

Not the OP and personally less radically against cloud-based services... But storing something as critical as passwords with a SAAS company which is obviously going to be target of attack and may or may not have the engineering resources to provide a reliable quality of service... seems like a bad idea. Google(Drive) at least I trust to have the engineering resources to keep data secure, perhaps not from government s…

They don't really store your passwords, just an encrypted blob that's openable with your master password (more accurately, a key that is derived from it using an expensive operation so that brute-forcing is unfeasible.) You do need to trust them enough that they will never sniff your master password (AFAIK even the web vault is local only) but eg. the command-line client is open source, so you can at least verify the…

It depends on what plan you are on. Afaik, the enterprise plans have key escrow and an option to recover your account if you forgot your password.
Post reply on HN