Live data from Hacker News

LastPass requesting password reset after facing unknown anomaly

blog.lastpass.com

11–20 of 66 posts

Re: LastPass requesting password reset after facing unknown anomaly

#11
That's not very smart considering that a lot of people won't be able to lockin to their email to verify their emails because they don't have access to the login details of their email because they haven't verified it.

And why the hell didn't they use scrybt in the first place? For a company so paranoid, that seems to border on neglect.

Re: LastPass requesting password reset after facing unknown anomaly

#12
post #9

Suddenly, I'm glad I switched to 1Password.

Yeah 1Password is pretty awful when you consider the amount of features you get with LastPass like multi-factor authentication. 1Password relies on Dropbox. Your passwords are all stored on your computer. Granted they're in an encrypted format, but if you have a jerk for a room mate they could copy your encrypted files, key log your vault password, and have access to all your passwords.

On the other hand, if you get my LastPass password you better have my grid too (I keep it online so I can access it wherever, password protected). Additionally LastPass is working on SMS codes for login.

Re: LastPass requesting password reset after facing unknown anomaly

#13
post #11

That's not very smart considering that a lot of people won't be able to lockin to their email to verify their emails because they don't have access to the login details of their email because they haven't verified it. And why the hell didn't they use scrybt in the first place? For a company so paranoid, that seems to border on neglect.

And that, right there, highlights why all of my passwords aren't kept with their (or any) service - for many, it just introduced a single point of failure. Imagine being locked out of every website you have an account on, just like that.

Nope. I'll make strong passwords on my own and encrypt my own copies, thanks.

Re: LastPass requesting password reset after facing unknown anomaly

#15
post #9

Suddenly, I'm glad I switched to 1Password.

Yeah 1Password is pretty awful when you consider the amount of features you get with LastPass like multi-factor authentication. 1Password relies on Dropbox. Your passwords are all stored on your computer. Granted they're in an encrypted format, but if you have a jerk for a room mate they could copy your encrypted files, key log your vault password, and have access to all your passwords. On the other hand, if you get…

The there's somebody how can key log hardware you (think you can) trust, you're hosed whatever security you're relying on.

Re: LastPass requesting password reset after facing unknown anomaly

#16
post #14

Nice to see a company so transparent about situations which could easily have been hushed down.

I didn't think it was transparent at all. More like the minimum corpspeak required to inform their users that they should change their passwords

Transparent would have been describing exactly what they saw

Re: LastPass requesting password reset after facing unknown anomaly

#18
post #9

Suddenly, I'm glad I switched to 1Password.

Yeah 1Password is pretty awful when you consider the amount of features you get with LastPass like multi-factor authentication. 1Password relies on Dropbox. Your passwords are all stored on your computer. Granted they're in an encrypted format, but if you have a jerk for a room mate they could copy your encrypted files, key log your vault password, and have access to all your passwords. On the other hand, if you get…

LastPass also has YubiKey support for really nice 2-factor auth.

Re: LastPass requesting password reset after facing unknown anomaly

#19
post #9

Suddenly, I'm glad I switched to 1Password.

Yeah 1Password is pretty awful when you consider the amount of features you get with LastPass like multi-factor authentication. 1Password relies on Dropbox. Your passwords are all stored on your computer. Granted they're in an encrypted format, but if you have a jerk for a room mate they could copy your encrypted files, key log your vault password, and have access to all your passwords. On the other hand, if you get…

LastPass also has YubiKey support for really nice 2-factor auth.

Re: LastPass requesting password reset after facing unknown anomaly

#20
post #11

That's not very smart considering that a lot of people won't be able to lockin to their email to verify their emails because they don't have access to the login details of their email because they haven't verified it. And why the hell didn't they use scrybt in the first place? For a company so paranoid, that seems to border on neglect.

And that, right there, highlights why all of my passwords aren't kept with their (or any) service - for many, it just introduced a single point of failure. Imagine being locked out of every website you have an account on, just like that. Nope. I'll make strong passwords on my own and encrypt my own copies, thanks.

just separately save your email password, all other services restore the password via email
Post reply on HN