Lastpass setting the delete account div to display: none

> I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site.

Being completely honest, I consider this a terrible strategy. I seriously doubt your "algorithm" is anywhere close to as secure as you think it is. Humans suck at coming up with passwords, period, no matter how clever they think they are, and then memorizing those passwords is at least as difficult. Any algorithm that would actually be secure would take far too long to mentally apply to each website each time you visit it.

Fully featured password managers like 1Password can include much more than just usernames and passwords, which increases their value significantly. Otherwise, users absolutely store that incredibly important information in completely unencrypted places, often synced with the cloud, because it is important information that they need access to, and they want to make sure it doesn't get lost. There is tremendous value in having a user-friendly encrypted vault.

Since the entire vault is fully end to end encrypted with any decent password manager (like 1Password), the weaknesses that repeatedly affect LastPass do not ever apply here. The only thing that matters is having a strong password on your vault, and keeping that password secure. It doesn't matter if 1Password gets hacked, no one will even know what websites you have accounts on. Coincidentally, 1Password also doesn't have the same history of breaches that LastPass does.

The only other security risk beyond a weak password is a supply chain attack, where 1Password ships a compromised version of the 1Password client that steals your vault password, but this is significantly harder for a malicious actor to pull off than the breaches LastPass has dealt with, and any software vendor that you trust could be compromised and install a keylogger on your device, which would achieve the same outcome, so this is not specific to 1Password, and therefore I don't consider it very relevant to the discussion beyond mentioning that other people might bring it up.

> That's my personal approach and I think it's a better way to go.

It's really not, but someone who comes to the internet to rant about this stuff is so strongly convicted of their belief that I don't think I'm going to be able to change it, so I'll just leave it at that. I have cared a lot about cybersecurity for a long time, even before I worked in the cybersecurity industry for a few years, which gave me lots of additional exposure to experienced people and current events.

I have never recommended LastPass to anyone, and I would never recommend it to anyone. 1Password is a completely different story. There are valid open source alternatives, which you can self host, but most people (outside of this forum) are not going to succeed at hosting their own password manager, so it's important to find a trustworthy hosted option.

[0]: https://en.wikipedia.org/wiki/Master_Password_(algorithm)

Offline-only is an additional attack surface reducing move. Sure, you may have to copy passwords manually between devices sometimes, but in practice it happens rarely enough not to matter.

> I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site.

That gets tedious when you also have to conform to stupid, different password policies on various sites.

If you want to compartmentalize things you could use multiple password databases with different master passwords? The master password is still something you have in your head.

The typical person, as long ago as 2015, had around (and possibly over) 100 accounts. I'm seeing people referring to many hundreds managed by LastPass or other password-management systems.

Using, say, a paper-based system whether in a bound journal or a set of index or Rolodex cards, a 500-account archive would take up most of a journal, or a pretty hefty chunk of cards, and that archive itself would require physical security (though at least data exfiltration would be slower than from a digital archive). It's not the sort of thing you could easily carry around with you, or access from multiple locations, should you need to do so.

In corporate use, the problem is compounded by:

- Multiple people requiring access to systems.

- Both shared-account and multi-account systems (e.g., a shared root to servers, master DBA account, or embedded / appliance devices with a single account).

- Multi-office (or remote / home office) access.

- Multi-device access (as in people are accessing systems from multiple devices).

This doesn't necessarily mean that a third-party service is your best or only option, but it strongly tends toward a managed third-party system being convenient where "convenient" means "our business which lacks a true CISO role would be dead in the water without it".

Mind: I'm not defending LastPass here, and I don't use it. The solutions I've seen in the past which have impressed me most were based on managed SSH keys with SSH access to critical systems, and the bare minimum of shared accounts.

I'd also like to see:

1) Far fewer authenticated services where that authentication is not necessary. For the most part, if I can avoid creating a new account, I do. (My circumstances leave me considerable latitude that many people wouldn't have, in this regard.) Systems based on asserted identity through PGP seem to me one option (e.g., rather than logging in and posting content, you'd post PGP-signed content, which the remote system would vet. Similarly, reading private content would be encrypted against your keys. This doesn't address all account-based interactions, but it does cover a large bit of landscape.

2) Physical-token based security particularly based on NFC or Yubikey-type devices. Keep in mind that an earlier widely-used technology, RSA keyfobs which would generate one-time PINs as a 2FA, turned out to have a nasty vuln some years back.

But fewer accounts, PKI-based auth, and physical 2FA ... seem increasingly necessary changes.

As numerous others apparently do: I use a local, encrypted, password keystore that is not managed by a third-party service.

(And don't even get me started on third-party data privacy doctrines.)