Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

181–190 of 210 posts

Re: Lastpass setting the delete account div to display: none

#181

Post by jason2323 »

rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

Bitwarden. I’ve been using them ever since Lastpass discontinued their free version. I simply made a text file export of all my pw’s on lastpass and imported them into Bitwarden. Just make sure you delete your text file!

Re: Lastpass setting the delete account div to display: none

#182

Post by screamingninja »

xyst wrote: post #91
rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

Probably not the “HN consensus”, but if you have apple devices the built in password manager works great for me. Can even setup totp with each site and safari will auto fill

> if you have apple devices

Does it work if you have apple devices and also non-apple devices?

Re: Lastpass setting the delete account div to display: none

#183

Post by gavinhoward »

c0balt wrote: post #172
gavinhoward wrote: post #162

This reminds me of something I want: a centralized password manager where * The entire file is encrypted, * Using OPAQUE, * On a FOSS local native client * That integrates with a FOSS browser extension that pulls the information only from the local copy. * And the only thing the server does is store the file and user account information. How hard could it be? (Well, outside of getting the cryptography right.) Looking…

Well, the stopgap solution for this scenario is quite simple: Keepassxc + Keepassxc Browser Extension + Cloud Storage of your choice. OPAQUE is not covered but I'd argue that that would puttoo much of a restraint on the storage layer. Both Keepassxc[0] and the browser extension are FOSS and the cloud storage may be FOSS, like Nextcloud or "just" whatever works for you rn (Google Drive, Seafile, ...). On android Keepa…

Yes. I use KeePassXC in exactly this way.

Re: Lastpass setting the delete account div to display: none

#184

Post by renonce »

simooooo wrote: post #164
dividedbyzero wrote: post #108

Earlier quoted context omitted.

> designed to be run and operated and secured by you exclusively Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.

The official bit warden self host runs something like 13 docker containers. Good luck securing that as a normal person

Vaultwarden uses just 1 docker container so I am using that.

Re: Lastpass setting the delete account div to display: none

#185

Post by seized »

simooooo wrote: post #164
dividedbyzero wrote: post #108

Earlier quoted context omitted.

> designed to be run and operated and secured by you exclusively Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.

The official bit warden self host runs something like 13 docker containers. Good luck securing that as a normal person

There is a beta test of a new all in one container option as of earlier this month:

https://bitwarden.com/blog/new-deployment-option-for-self-ho...

Re: Lastpass setting the delete account div to display: none

#186

Post by Fire-Dragon-DoL »

autophagian wrote: post #54
garganzol wrote: post #11

Is LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a funny joke for anyone who understands even a little about cryptography.

According to their security notice from a couple days ago, they have "fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data." So, according to them, they encrypt the other fields. I suppose the website field is unencrypted to enable autodetection or something like that.

As I reported, they encrypt everything but URLs, which is still very bad

Re: Lastpass setting the delete account div to display: none

#187

Post by mrjin »

jiggawatts wrote: post #6
bigmattystyles wrote: post #4

I work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just waiting for a call from infosec asking me to log on and to rotate a bunch of creds. Happy Holidays.

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent ano…

Oh dear, what you were doing was just a little bit less than pointing at the CISO's nose and saying: "Look, you don't know what you are doing by choosing such a sh*tty product!" Of course, nothing going to happen. As any actions taken afterwards to mitigate the issues you highlighted can be and amlost for sure will be taken as evidence of failing to do his/her job. All office politics, nothing to do with facts.

Re: Lastpass setting the delete account div to display: none

#188

Post by lopkeny12ko »

dividedbyzero wrote: post #108
lopkeny12ko wrote: post #90

Earlier quoted context omitted.

I have been self-hosting bitwarden_rs for many years now, and am very happy with it. It's free as in freedom, open source, and designed to be run and operated and secured by you exclusively, so you have full control over your data and don't need to rely on a third party being available.

> designed to be run and operated and secured by you exclusively Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.

Compared to 10-15 years ago, securing a deployment of a web service is trivial today. Let's Encrypt gets you TLS certificates for free. Wireguard gives you an out-of-the-box secure VPN solution so you can access services outside of your home network (setup is even easier now that it's part of the kernel). Wire everything together with Nginx/Caddy/Traefik and you're off to the races.

Re: Lastpass setting the delete account div to display: none

#189

Post by csomar »

rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

Bitwarden. Period. They are open source, written in Rust and you can very easily run your own instance.

They also have incredible support (browsers, iOS, apps, etc...)

Re: Lastpass setting the delete account div to display: none

#190

Post by csomar »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

I was opposed to pw managers too, but then found out that my "master" password was leaked, which means I needed to reset all passwords (and good luck doing that because are you keeping a list of all sites you are using?)

I also found out that I can easily forget passwords if they outnumber 5. Doing creative passwords around websites also does not generate enough entropy if one of your passwords is leaked.

I then tried Trezor/Ledger and Yubi. They are the best solution, theoretically. However, I find myself more than once in a situation where I am at an airport and I need quick access to something through my phone. All options above require a laptop, though with Yubi NFC it might be possible. But that means you are also taking your Yubi everywhere you go...

Bitwarden fixes all of that, or any pw that is open source and self-hosted. I'm using the paid version because 1. I want to support them and 2. self-hosted can be a dangerous option if your server goes down and you are locked out of your stuff...

Post reply on HN