I used Google Passwords for a long time before deciding to move to something not OS dependent. My first pick was LastPass. I used it for maybe one month, but found their browser extension and Android app pretty bad. So I decided to move to BitWarden. I am very glad that I did this, otherwise I would have been changing all my passwords like a maniac.
I Lost All Faith in LastPass
91–100 of 322 posts
Re: I Lost All Faith in LastPass
#92> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)
I suppose it's a lot more difficult to wipe memory clean in a garbage collected language. For example: password = "my-secret-password"; // do stuff then remove the pass from memory password = "" or null or delete or unset We have no guarantee that the first string "my-secret-password" will be collected and removed any time soon whereas in C or C++ we could just memset it before freeing it. But that feels like a very…
C# has SecureString. I assume BitWarden uses this.
edit: https://learn.microsoft.com/en-us/dotnet/api/system.security...
Re: I Lost All Faith in LastPass
#93Earlier quoted context omitted.
There is good insight into this from this comment from them in 2014: https://1password.community/discussion/comment/114870/#Comme...
That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible .
Because they like being in business vs just giving away their software?
Where is the repo of software that you've paid an unknown number of developers to work on for multiple years over multiple versions that you charge for and run a viable business employing all of the peoples?
Re: I Lost All Faith in LastPass
#94Earlier quoted context omitted.
There is good insight into this from this comment from them in 2014: https://1password.community/discussion/comment/114870/#Comme...
That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible .
They are in the business of doing business. How much of the codebase that makes up their business model would you like them to expose?
Re: I Lost All Faith in LastPass
#95I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…
I've made the transition to multiple different services over the years, not on a large professional scale so I cannot comment on doing that and I reckon doing that would require completely different advice than I am suggesting below.
I would highly recommend starting new. Every transition between managers has wound up leaving me having to manually delete fields after the fact anyways, or just keep those fields littering the manager. Sometimes even incorrect fields when moving away from LastPass which is even more of a bother. Starting new also gives you a chance to get more used to the new manager's features, and when transitioning you can add specific fields based on crucial information that might have otherwise been lost in automatic moves.
Use this transition as a justification to change your passwords to the services you use, and also a way to decide whether you want to keep using that service or submit a deletion (most you can do this on your own, other times you have to send a GDPR deletion request). I know it takes more effort, but spend a chill weekend doing so, and you'll be glad you did. Plus you can also review some security settings on your services, like force sign out all other devices and changing your 2FA settings.
Think of it as a new year refresh
Re: I Lost All Faith in LastPass
#96Earlier quoted context omitted.
An appeal to authority is not a logical fallacy if the person in question is actually an authority in the domain .
I wish more people would remember this.
But its incorrect, its literally the logical fallacy, argument from authority, if the person us not an authority then it cannot by definition be argument by authority.
Experts must prove their views with evidence and not rely upon their reputation, that is the meaning of the fallacy.
No wonder so many people cant reason well.
Re: I Lost All Faith in LastPass
#97Use of 3rd party password trackers has been a periodic concern for our organization. We do B2B business with banks , so the temperature is increased somewhat. There are kinds of credentials we have access to that genuinely terrify me. I've been debating building an in-house solution for managing secrets, if for no other reason than to get all of this information off of 3rd party computers. No serious proposals have b…
Why not whichever Keepass client you prefer, and Syncthing (if it's even necessary for your use-case)? Open-Source, old enough to have a few revisions and be looked at pretty closely, completely off-line, and forgiving if updates are needed to passwords (with many clients having the option of merging changes with your open database).
This way, you don't make the same mistake as Telegram as well; I.E., don't roll your own crypto if you can help it, especially if there are ready-made tools that already do what you want, doubly so when those tools are battle-tested and looked over by actual experts.
Re: I Lost All Faith in LastPass
#98Earlier quoted context omitted.
Trust is a necessity, not authority. Those with authority are often not trustworthy.
I get it but in this context "authority" means an authority on a particular topic, not like a police officer or something. Appeal to authority becomes a fallacy when you appeal to someone who is not actually an authority on the subject at hand.
But how do you determine if someone is an authority? Our world is filled with epistemological bubbles. One person's expert is another's snake oil peddler.
Re: I Lost All Faith in LastPass
#99Earlier quoted context omitted.
I don't buy the "if it's open source we can see/audit/trust the service" argument. 1. Bugs get missed all of the time in OSS. There is no guarantee that the more eyes the better, and in fact there may be a negative correlation due to the bystander effect [citation needed]. 2. A software service is a complex interaction between many pieces of software. Two perfectly secure, audited pieces of software could interact in…
Source code is necessary for trust, but not sufficient.
It's a nice data point, but it's not necessary to me. Do you have the source code to your mail service provider or your online banking software? [1]
Having the source code available says a few nice things:
1. This company is confident enough to show their work
2. This company is "good" at software engineering (or it could reveal the opposite)
[1] I know some people can and do run their own mail servers. I can respect that, but I trust the Google devs and organization to be properly competent and incentivized to do a good job keeping my email account safe.
Re: I Lost All Faith in LastPass
#100The post looks a bit weird on first sight: "I always knew LastPass has a ton of flaws, but promoted it anyway". This may make sense though. LastPass seemed to be the only one with a good enough UX. And without a good enough UX, you can't make users actually use it. Using an imperfect but usable password manager is still much better than not using one with better security but poor UX. (Here comes the old adage: make t…
Security is not a binary thing. It's a spectrum and for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc. It's only after multiple episodes of what amounts to malicious incompetence that the cure becomes worse than the disease. I think we're collectively agreeing we've reached that point with LastPass.