Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

101–110 of 210 posts

Re: Lastpass setting the delete account div to display: none

#101

Post by yreg »

feanaro wrote: post #65
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Reusing passwords or having low entropy passwords is a larger risk. The thing is... Your password manager should be offline, not a cloud service.

>Your password manager should be offline, not a cloud service.

Why?

Re: Lastpass setting the delete account div to display: none

#102

Post by bpye »

lopkeny12ko wrote: post #90
rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

I have been self-hosting bitwarden_rs for many years now, and am very happy with it. It's free as in freedom, open source, and designed to be run and operated and secured by you exclusively, so you have full control over your data and don't need to rely on a third party being available.

I do the same but FYI it's called Vaultwarden now.

Re: Lastpass setting the delete account div to display: none

#103

Post by derkades »

scarab92 wrote: post #85
Schnitz wrote: post #58

Earlier quoted context omitted.

A local keepass is a great alternative, been doing that for ages and honestly copying my keepass db to a device every once in a while is way less troublesome than quadruple factoring into lastpass/1password or whatever.

For most people, the keepass db will need to be synced and they’ll also want clients on their computers and phones to access it. What’s the difference, security wise, to an all in one offering that works the same way under the hood, like 1password cloud or bitwarden? It seems to me that those syncing keepass databases around are just incurring pain without any real increase in security.

Having a different vendor for the frontend software and the cloud storage part does arguably increase security.

Let's say a national security agency wants access to your passwords. They can "easily" make LastPass send a custom version of the client to your browser. This custom version could send your password to LastPass, allowing them to decrypt your database.

To me it seems like it would be harder to ship a malicious KeePass program to a single user. Especially if that user has installed KeePass using their Linux OS package manager.

Re: Lastpass setting the delete account div to display: none

#105

Post by flandish »

halukakin wrote: post #75

Before deleting your account it would be good measure to update passwords to passwords you don't really use. You never know if deleted data is deleted from db as well.

For sure but we also don’t know how much “effective dated” data they store. If a backup from 3 months ago is leaked… what the pw on the acct was the day you deleted it won’t matter.

Re: Lastpass setting the delete account div to display: none

#106

Post by weaksauce »

theturtletalks wrote: post #83
dhdgrygev wrote: post #43

Earlier quoted context omitted.

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

I use BitWarden, but I'm thinking of self-hosting BitWarden. BitWarden's commercial offering might be tempting to crack from a hacker's perspective, but I don't think they would go after a specific user's instance.

there's a non-zero risk of hosting it yourself and not keeping up with the maintenance/security updates of whatever server you host it on. gotta weigh that in the calculus. It might not be likely that they target you specifically but there could be a drive by bot that slurps up your password vault.

Re: Lastpass setting the delete account div to display: none

#107

Post by koolba »

0x45696e6172 wrote: post #50
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Because it is better than the alternative. Pick two: (1) memorizable passwords (2) bruteforce-resistant passwords (3) account-unique passwords. The best tradeoff for me is (2)+(3) sacrificing (1), so I use a local password manager (named 'pass'). That said, I would never trust a 3rd party like LastPass.

Not being able to do #1 can be a feature. If you can’t easily login to your accounts it adds just the right amount of friction to buying things online.

Re: Lastpass setting the delete account div to display: none

#108

Post by dividedbyzero »

lopkeny12ko wrote: post #90
rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

I have been self-hosting bitwarden_rs for many years now, and am very happy with it. It's free as in freedom, open source, and designed to be run and operated and secured by you exclusively, so you have full control over your data and don't need to rely on a third party being available.

> designed to be run and operated and secured by you exclusively

Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.

Re: Lastpass setting the delete account div to display: none

#109

Post by irrational »

I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working right now to move off of LastPass. Unfortunately I have nearly 2,000 passwords on there, so it is taking forever.

Re: Lastpass setting the delete account div to display: none

#110

Post by userbinator »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

You could just tell users to write down their unique passwords physically and store them somewhere safe instead of reusing the same password, but that wouldn't fit the narrative of being able to sell services for password management and no doubt another thing the "security" community seems to be highly against.

I agree it's 100% stupid --- "all your eggs in one basket" is exactly the phrase that comes to mind for me too. Centralisation makes for one massive point of failure. If everyone stored passwords in their head or offline, it'd already make it much harder for attackers but there's no recurring $$$ for services in helping people do that. If people can be convinced to believe fake news, what other irrationalities can they be persuaded to believe? It's all just the power of marketing.

Post reply on HN