Earlier quoted context omitted.
Wow. Is LastPass generally just really bad software? These bugs mentioned in this subthread make it sound like amateur hour.
It's packed with enormous amount of bugs that make the day to day experience terrible. I want to move but I'm terrified of the export process
Lastpass Security Incident
361–370 of 587 posts
Re: Lastpass Security Incident
#362I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…
Re: Lastpass Security Incident
#363I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…
Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…
Re: Lastpass Security Incident
#364I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…
Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…
Would you really just ignore the requirements and give the simplest starter as a way to start a conversation?
Re: Lastpass Security Incident
#365Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…
Probably just needs a screen and like 3 buttons: record/play/navigate mode (use your keyboard to actually navigate).
Re: Lastpass Security Incident
#366Earlier quoted context omitted.
Making direct comparisons of software to trades generally needs to stop. I understand that it's merely an analogy, but it's not a good one. Nails are extremely well understood with little room for improvement while the smallest piece of software is not so well understood and has infinite room for improvement. There are a handful of traits about an engineer that can make them incredibly valuable to an org that you'll…
This sub-thread was talking about "that specific coding task", not about binary tasks [edit: trees] in general. You might be very valuable building, say, a database application, while not being able to balance a binary tree, but if you can't do whatever we can all come up with as a small coding assessment (" little deck of cards"). It sounds to me like a good first filter, plus then a good talking piece to have a con…
Although I experienced recently what you said exactly! I was asked to build a deck of cards for the screening interview. It was a fun back-and-forth and I felt really good about things. Then in the next steps, I was asked to implement Conway's Game of Life. So like, I've been programming professionally for 13 years, I'm well aware of GoL and maybe should know how to do it, but I've never bothered since there are just a mountain of other projects, programming and not, that interest me over that. It's all good if you want your engineers to be able to solve that type of problem as it's your company and you do what you like with it. But like, they were an e-comm company and I have a ton of e-comm experience and was actually pretty into what they were doing, so why were they using something like GoL to assess me?
On the flip side of things to get a little tangential, I often feel companies reject me because they just don't like me, and I wish they would just say as much since that hurts way less than being told I'm a not a great engineer, lol.
Anyway, maybe a bit too much TMI... interviewing right now is a bit of a shitshow with all the recent layoffs and I'm maybe a little bitter, but also realllllly enjoying unemployment while it lasts.
Re: Lastpass Security Incident
#367Re: Lastpass Security Incident
#368Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!
Re: Lastpass Security Incident
#369Re: Lastpass Security Incident
#370Earlier quoted context omitted.
LastPass is architectured so that your master password is never sent to their servers. Decryption of your vault happens locally on your device. Maybe such an attacker might get your email address (username).
Is there a web UI ? If yes - I guess an attacker can just send "bad" JS to the client and steal the master password no? Or inject a malicious update. Most people probably have auto updates?
Still, local decryption is more secure than sending the master password to the server (so, just compromising the server holding your vault wouldn't be enough to steal your password). I think I will switch to BitWarden which uses the same approach, LastPass seems to be getting hacked alot nowdays.