Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

481–490 of 587 posts

Re: Lastpass Security Incident

#481
post #175

Earlier quoted context omitted.

Can you give some idea why Bitwarden is better?

free for personal use, open source, cloud synced, no device limits. and as OP mentioned different server implementations if you want to host it yourself. No idea why people stick to any of the proprietary solutions.

I would prefer to not self-host as none of my family (who rely on passwords) are technical, and if anything should happen to me, they would be stuck.

Re: Lastpass Security Incident

#482

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

This really hurt me last year, when I migrated away. I didn't realize at the time how much didn't come with, so I've been playing the reset / recovery game since.

I keep thinking I should reset my passwords anyway (not moving of apples keychain tho) and should probably just move off using gmail at same time!

Re: Lastpass Security Incident

#483
post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

Bro wat? This comment is basically "I'm too smart to work for this company".

Your ego will be your downfall.

There is so much I can learn from a developer, junior OR senior by just seeing how they implement something simple like that. I feel like you have a full fledged case of Dunning Kruger effect. Since you don't know what exactly they were looking for, you brush it off to "LeL, LaST pAsS so DuM aSsEsMeNt".

Re: Lastpass Security Incident

#484

Earlier quoted context omitted.

Uh oh, now I’m paranoid my LastPass export didn’t have everything, and I deleted my account years ago

Personally, I'm more paranoid concerning whether the deletion actually worked when I deleted my LastPass three or four major security incidents ago...

If you look at LastPass page in wiki, someone from LastPass org keeps deleting the incidents.

https://news.ycombinator.com/item?id=15756044

Re: Lastpass Security Incident

#485
post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

Only answer to this one: Don't use inheritance (unless you're building an UI framework, and even then ...)

The whole point is probably to weed out people who can't do it or don't understand inheritance.

If thats what they are asking for, implement it, programmers and their ego always trying to "LoL, DuM iNtErViEw QuEsTiOn".

There is so much to learn from a person by just seeing how they solve a simple problem like this one.

Re: Lastpass Security Incident

#486

Earlier quoted context omitted.

It's packed with enormous amount of bugs that make the day to day experience terrible. I want to move but I'm terrified of the export process

I moved to BitWarden a year ago after a billing problem with LastPass that their support handled badly. I haven't had any problems with the migrated data and I finally deleted my LastPass account last month.

Likewise, deleted my LastPass account after a year with Bitwarden. I regret suffering LastPass’ UX for so long.

Re: Lastpass Security Incident

#487

Earlier quoted context omitted.

Only answer to this one: Don't use inheritance (unless you're building an UI framework, and even then ...)

The whole point is probably to weed out people who can't do it or don't understand inheritance. If thats what they are asking for, implement it, programmers and their ego always trying to "LoL, DuM iNtErViEw QuEsTiOn". There is so much to learn from a person by just seeing how they solve a simple problem like this one.

Well yes, I'm asking String Reverse hundreds of times and learned a lot.

Re: Lastpass Security Incident

#488

Earlier quoted context omitted.

Avoid such trouble is why I want to avoid using symbols for password. Just use more alphanum characters for strength.

I want to as well, but annoyingly there are many sites that insist on a "special" character because their strength measure says "low" for the 20 character alphanumeric string I generated %-}

My favorite is when they actually limit what special characters you can use. Must include 1 of x special characters. Why? I always just assume they baked their own password storage and couldn't figure out how to handle the whole set of special characters

Re: Lastpass Security Incident

#489
post #395

Earlier quoted context omitted.

I don't use them, but my conclusion is that at least one major cloud password manager has been hacked already without any disclosure. If they disclose it, the company should logically be dead. Thus, the incentive would just be to cover it up.

Thanks to the GDPR a coverup is no longer an option.

How do you figure? If a company never reports an incident, how would the government regulator know about it?

Re: Lastpass Security Incident

#490
post #250

Earlier quoted context omitted.

Only very marginally so. Or what would you say storing a (unique, long) password next to a TOTP hash actually achieves?

Well the totp (even in your passwd manager) defends against phishing I'd thought vs password alone.

For a "service based" password manager, sure. (It can prevent the service from ever handing over your encrypted database to an attacker.)

In a local password manager, it doesn't work like that. A challenge-response mechanism can help there, but the cost/benefit analysis looks pretty different there, IMO.

Post reply on HN