Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass stores passwords so securely, not even its users can access them

theregister.co.uk

Post reply on HN
Print view View original

161–170 of 266 posts

Re: LastPass stores passwords so securely, not even its users can access them

#161

Post by justincredible »

franga2000 wrote: post #41

Wait, are they saying that the clients don't store a local copy? Or that the local copy is inaccessible without the servers working?? That seems incredibly irresponsible and I can't imagine a single reason for doing that. Or is there something else going on that corrupted the users' local copies? If the system is properly secure (i.e. data is encrypted and verifiable with the user's password-derived key) this shouldn…

Just from the comments it seems like a local copy is opt-in and also in the past the local copy was inaccessible when the servers weren't working.

Re: LastPass stores passwords so securely, not even its users can access them

#162

Post by bogomipz »

anonymouswacker wrote: post #84
navidfarhadi wrote: post #3

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

Switched from LastPass to BitWarden over the weekend. I have 1,200+ passwords, and the transition was seamless. I even set up BitWarden on one of my web servers so that I can control my data -- even that took less than 30 minutes, thanks to BitWardenRS docker container. The only thing I have yet to figure out for BitWarden is how to get a little icon to show up next to user/password fields in forms. I just have to ri…

Is there an exporter available for BitWarden then? I'm guessing your 1,200 password had a seamless transition because of some tooling the project provides? Is that correct? Cheers.

Re: LastPass stores passwords so securely, not even its users can access them

#164

Post by kevinmannix »

ars wrote: post #155
deepspace wrote: post #134

Earlier quoted context omitted.

I was a longtime LastPass customer, but the service just kept getting worse and worse, to the point where a year ago I realized I was spending more time fighting the user interface than it was saving me. And their support was absolutely useless. So I also switched over to 1Password, and never looked back. It is such a refreshing and trouble free experience compared to LP, and the few times I needed to ask a question,…

I've never used LastPass, why do people use it (or other password managers) instead of the built in browser password manager?

Having a password manager on mobile is needed, so I need multi-device support. I was really happy with the password manager support the last iOS included. Password entry and persistence are streamlined.

Re: LastPass stores passwords so securely, not even its users can access them

#165

Post by stuzenz »

maximente wrote: post #132
sigwinch28 wrote: post #18

I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom. [0]: https://www.passwordstore.org/

i love pass on GNU/linux but occasionally have to use OS X for a particular sponsor. the brew impl of pass using zsh does not seem to be autocompleting. i believe i have installed the correct autocompletions and mucked with .zshrc (.zshenv does not seem to be respected on OS X). any recommendations for OS X? is it worth building from source and/or getting it working outside of brew?

I had the same issue at some point. I now have autocomplete working on my pass with .zshrc

From memory I think autocomplete worked for pass once I started using antigen.

I have the following plugins in my .zshrc plugins=( zsh-syntax-highlighting git iterm2 dotenv osx zsh-autosuggestions )

and also run antigen with user bundles for zsh-autosuggestions zsh-syntax-highlighting zsh-completions

Some magic somewhere in the above provided autocomplete for me with pass.

I hope it helps.

Re: LastPass stores passwords so securely, not even its users can access them

#166

Post by rodgerd »

sys_64738 wrote: post #122
fullstop wrote: post #88

Earlier quoted context omitted.

Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how. It's not the best option, of course, but certainly better than weak and reused passwords, right?

Is convenience more important than security? That's what you're saying here.

Convenience is security.

Re: LastPass stores passwords so securely, not even its users can access them

#168

Post by geekamongus »

dentemple wrote: post #138

The reactionary nature of the typical HN poster is on full display here. Lastpass had a bug that affected a small percentage of users. They identified and fixed the bug within several days. What more do you want? Is there really a competing product out there that guarantees NO BUGS? So, then, why the extreme nod to #CancelCulture for what appeared to be just a temporary issue?

Probably because of the way the handled it (or didn't for a few days, as was the case here). Just guessing.

Re: LastPass stores passwords so securely, not even its users can access them

#169

Post by geekamongus »

JohnTHaller wrote: post #44

KeePass/KeePassXC on each device. Complex keyfile manually copied to each device (never in the cloud). Password database protected by the keyfile and a memorable complex password stored in your cloud folder of choice synced to your devices. You now have a free, open source, secure, cloud synced password service. For additional security, you can manually copy the database between devices as well. Or keep a separate ma…

OK but can you tell my 80 year-old mom how to do this?

Re: LastPass stores passwords so securely, not even its users can access them

#170

Post by yjftsjthsd-h »

sigwinch28 wrote: post #18

I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom. [0]: https://www.passwordstore.org/

I really want pass or something like it, but the two times I've tried, I got stuck trying to figure out the gpg part. I suppose I should go and learn that properly anyways, since in spite of its UX it's still an extremely widely used and powerful tool, but it's a lot higher barrier to entry compared to "type in password, unlock vault".
Post reply on HN