Even the LastPass will be stolen, deal with it (2015) [pdf]
1–10 of 23 posts
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#2This tweet[0] from about a month ago is pretty interesting.
"If you ever wanted to dump someone's entire LastPass vault, this is where you start :D"
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#3Does anyone know how other password managers compare? 1password, Bitwarden, etc.
Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#4Does anyone know how other password managers compare? 1password, Bitwarden, etc. Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
I moved from lastpass to bitwarden about 2 years ago, then to self hosting vaultwarden about 6 months ago. Bitwarden wasn't as feature-full as lastpass at the time, but I liked it a lot. My father was using lastpass in the meantime and I saw it devolve into an unpleasant mess UX wise and these days, ignoring the elephant of the hack, am confident bitwarden is a much better experience overall compared to lastpass.
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#5Does anyone know how other password managers compare? 1password, Bitwarden, etc. Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
For me, 1password continues to work and improve on its features in a good way with biometric unlock support (Windows Hello, iOS/MacOS biometric unlock) and the SSH Agent is nice, so I use it and was paying the yearly subscription for it before my work started to give me a license for free. While it's my choice, I can see why most don't like 1password 8's subscription-only and cloud-only model (you effectively have to use 1password.com, can't store your vault on dropbox gdrive etc).
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#6Does anyone know how other password managers compare? 1password, Bitwarden, etc. Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
I moved from lastpass to bitwarden about 2 years ago, then to self hosting vaultwarden about 6 months ago. Bitwarden wasn't as feature-full as lastpass at the time, but I liked it a lot. My father was using lastpass in the meantime and I saw it devolve into an unpleasant mess UX wise and these days, ignoring the elephant of the hack, am confident bitwarden is a much better experience overall compared to lastpass.
I have moved away from LastPass as soon as they were bought by LogMeIn. It was already a UX shitshow and it only got worse.
I now mostly use 1Password but I also host a VaultWarden instance. I haven't yet moved to it fully because even though 1P is also devolving and I don't like having my passwords db on a 3rd party server, I still find BW's clients clunky especially the browser integration.
My question was specifically about the kinds of issues in the OP though. I poked around my Firefox profiles and haven't found much but I don't really know what I'm looking for.
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#7Does anyone know how other password managers compare? 1password, Bitwarden, etc. Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
For me, 1password continues to work and improve on its features in a good way with biometric unlock support (Windows Hello, iOS/MacOS biometric unlock) and the SSH Agent is nice, so I use it and was paying the yearly subscription for it before my work started to give me a license for free. While it's my choice, I can see why most don't like 1password 8's subscription-only and cloud-only model (you effectively have to…
Cheers, I'm also currently on 1P and it's fine. Although I'm not nearly as positive about their improvements as you, it's still a fine product from the user's pov.
My question is related to the OP though, I'm not looking for UX/UI or feature comparisons.
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#8Video of the actual talk: https://www.youtube.com/watch?v=MlmEiT5bhxg
Aside: I never really understood distributing just slides from a talk. Any good talk most of the information isn’t in the slides.
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#9Does anyone know how other password managers compare? 1password, Bitwarden, etc. Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
People have been dunking on LastPass for a very long time. I haven't seen the same infosec people do the same with 1Password and Bitwarden. The constant criticism was a bit push to finally get me to move to 1P.
The one good thing about LastPass was basically how easy it was to set up. Everything else was a bit of a mess. 1Password was tricky to set up, and they took a bit longer to launch a cloud service.
One thing that bothers me about 1Password is that they only let you set up one security key, which is very impractical for people like me. OTOH, this is not unusual, and I assume part of it is to keep bad actors from adding more security keys to your account or something like that. Still not great when you can lose access to everything if you lose your key.
Re: Even the LastPass will be stolen, deal with it (2015) [pdf]
#10Does anyone know how other password managers compare? 1password, Bitwarden, etc. Edit: to clarify, I'm asking specifically about client-side security of these products - NOT feature or UI/UX comparisons.
I still use KeePass, albeit with a ridiculously high iteration count to protect against brute-forcing. It's completely client-side, so no cloud involved and nobody to blame other than you if your vault gets into the wrong hands ;-)
Although personally, I use OneDrive to sync it across devices