Great technical reasoning, but no mention of the business practices. This is a consistent result we see when companies are acquired by private equity. Like Thoma Bravo did with SolarWinds, and is doing with Proofpoint. Vulture capitalists destroy the companies they target to extract short term value. This is why I warned people against using LastPass for several years. Sad to see I was already vindicated.
I Lost All Faith in LastPass
81–90 of 322 posts
Re: I Lost All Faith in LastPass
#82Trusting a 3rd party password manager seems troublesome
For me, one cloud solution, and a local KeepassXC database as a fallback. Works like magic. If the cloud solution (Bitwarden) fails, then I fallback to Keepass.
Re: I Lost All Faith in LastPass
#83I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…
I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer.
Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked together PR from myself that will help you export the password history
The import worked very well in 1password aside from attachments/history. What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag
Re: I Lost All Faith in LastPass
#84> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)
Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow.
With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last thread dying will release the memory for this variable. Since programmers often don't know when the password variable will be "free()ed", it is very unlikely that they scrambled the password before releasing the memory. Thus, leading to the password being kept in some region of the program memory, in clear text, exploitable by a buffer overflow & co. for an indefinite amount of time.
Re: I Lost All Faith in LastPass
#85I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…
I'll be in the same boat when my subscription is up, not sure exactly when it is (I should really check). My discontent had been growing for a while and it's been getting harder to defend it to friends and family, who I had to BEG to get to use a password manager to start, even though now they all swear by it. I'd like them to change along with me, but am worried about how difficult it would be.
Re: I Lost All Faith in LastPass
#86Earlier quoted context omitted.
Appeal to authority is not a fallacy, it's basically a necessity to function in the world.
Trust is a necessity, not authority. Those with authority are often not trustworthy.
I get it but in this context "authority" means an authority on a particular topic, not like a police officer or something. Appeal to authority becomes a fallacy when you appeal to someone who is not actually an authority on the subject at hand.
Re: I Lost All Faith in LastPass
#87How do we know 1Password doesn't have similar glaring oversights like LP? We can't audit their code unless it is open source? I'm not going to just believe them at face value because some random internet personality says so. Unless some respected authority can publish an audit of the security posture and source code, we're just taking them at their word. Granted, if I had to chose today, I would instantly pick 1Passw…
The older versions of 1Password are BYOH, bring your own hosting. I use it because I don’t want a single source of failure. My information is encrypted and stored in another cloud service. It doesn’t matter if that cloud service is breached. It doesn’t matter if 1Password is breached.
Re: I Lost All Faith in LastPass
#88> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)
I suppose it's a lot more difficult to wipe memory clean in a garbage collected language.
For example:
password = "my-secret-password";
// do stuff then remove the pass from memory
password = "" or null or delete or unset
But that feels like a very generous interpretation, I'm sure the author really meant it as a "real programmers don't use GC language"...
Re: I Lost All Faith in LastPass
#89Earlier quoted context omitted.
Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.
An appeal to authority is not a logical fallacy if the person in question is actually an authority in the domain .
The truth of a statement is what matters, not who uttered it.
Re: I Lost All Faith in LastPass
#90I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…
Seeing more articles about export/import woes would be great.
When I moved over to KeePass I was able to export and import all of my passwords but the field labels got pretty mixed up, and it was a little bit of a pain to correct. That might be fixed now, but it would be interesting to see people's experiences importing into other services beyond just "here's how you export from LastPass to CSV".
Edit: as other people mentioned, I also didn't get any password history with my export, which isn't a big deal to me but is worth highlighting.