Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

261–270 of 322 posts

Re: I Lost All Faith in LastPass

#261

Post by jeffybefffy519 »

majkinetor wrote: post #9

God damnit, but what doesn't. I am sure BitWarden has its own problems and it (seems?) not 100% FOSS but its core is. LP extension and web vault ARE pure garbage: 1. It can't even recognize sites correctly ?! WTF really. I usually get 10 or so (looks like random) hits for any site but not the one that I should. 2. It offers me to extend pro support 5 years after I stopped paying for it. What I need to do for it to st…

Reading about what password managers people prefer is interesting and a good example of why UI is hard. The fact some people like lastpass UI is fascinating but also not surprising because it does have a less modern look that some people could be into.

Re: I Lost All Faith in LastPass

#262

Post by RulerOf »

Fire-Dragon-DoL wrote: post #241
RulerOf wrote: post #153

Earlier quoted context omitted.

>What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.

So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed. The web portion has *less edit capabilities* than the native app. You should have the extension and the native app installed at the same time, the extension should connect to the native app (and share login). In the native app you can click on one item and then hold shift or control (Windows) to select multiple…

>So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed.

I like this design a lot. LastPass _used_ to work like this ages ago.

>You must have added the tag to at least 1 item manually for the tag to show up in the sidebar.

I did get stuck here for a minute but was able to get it set up. Thank you!

I discovered that every time you click "export" in lastpass, the export accumulates a copy of the vault. My second export had 2x of everything in it, 3x for third, etc.

I see the features in 1Password and I almost cannot forgive myself for holding onto Lastpass for such a long time.

Re: I Lost All Faith in LastPass

#263

Post by s17n »

nine_k wrote: post #7

The post looks a bit weird on first sight: "I always knew LastPass has a ton of flaws, but promoted it anyway". This may make sense though. LastPass seemed to be the only one with a good enough UX. And without a good enough UX, you can't make users actually use it. Using an imperfect but usable password manager is still much better than not using one with better security but poor UX. (Here comes the old adage: make t…

It seems like using lastpass was worse than not using a password manager, though (if you had an old vault that is going to get cracked).

Re: I Lost All Faith in LastPass

#264

Post by jeffybefffy519 »

nine_k wrote: post #7

The post looks a bit weird on first sight: "I always knew LastPass has a ton of flaws, but promoted it anyway". This may make sense though. LastPass seemed to be the only one with a good enough UX. And without a good enough UX, you can't make users actually use it. Using an imperfect but usable password manager is still much better than not using one with better security but poor UX. (Here comes the old adage: make t…

I think a lot of people promoted it because it has a free tier - getting people to switch to password manager and paying money is a hard sell.

Re: I Lost All Faith in LastPass

#265

Post by Fire-Dragon-DoL »

Fire-Dragon-DoL wrote: post #241
RulerOf wrote: post #153

Earlier quoted context omitted.

>What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.

So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed. The web portion has *less edit capabilities* than the native app. You should have the extension and the native app installed at the same time, the extension should connect to the native app (and share login). In the native app you can click on one item and then hold shift or control (Windows) to select multiple…

> I discovered that every time you click "export" in lastpass, the export accumulates a copy of the vault. My second export had 2x of everything in it, 3x for third, etc.

WTF

> I see the features in 1Password and I almost cannot forgive myself for holding onto Lastpass for such a long time.

The export process was the thing that mainly held me.

There was also an issue where 1Password would not work properly with a Work Profile on Android if you ALSO had a non-work-profile version of the app, which translated to "if you use 1password at work and in your personal life and you have a Work Profile, you cannot use 1password inside the work profile (it must be outside)"

In the end, this is just a bag of passwords, so as long as it's keeping things safe, it should be acceptable.

It didn't.

And it also doubled the price without giving any software improvement over the years, which is very bad.

Re: I Lost All Faith in LastPass

#266

Post by duped »

im3w1l wrote: post #233
duped wrote: post #184

Earlier quoted context omitted.

> Also, you could write a destructor that scrambles the memory location before the object is collected. This assumes you can write destructor at all and that it's run deterministically. > though you can probably force that to happen in most GCed languages I'd actually be surprised if any GC'd language allows this. You normally need to resort to different kinds of tricks for RAII-like behavior.

Java has try-with-resources for this. Python has with . Unlike say C++ you do have to indent your code once for every such resource though which can be cumbersome.

Neither of these things are equivalent to destructors, however

Re: I Lost All Faith in LastPass

#267

Post by pjungwir »

SailingCactus33 wrote: post #251
pjungwir wrote: post #174

I use a mix of pass(1) and LastPass, but this incident has convinced me to put everything on pass. But I don't really use it the "recommended" way, where you put the password on the first line. It's not a great fit for a consultant when half my customers want to give me my own Gmail/Atlassian/etc account. So I tend to keep big files of free-form text instead. But if I'm going to use it with a browser, the manual copy…

I consider the flexibility of pass(1) to be one of the best features. In my case, I use a hierarchy to manage secrets across different orgs and classifications. The structure I use is:[ORGANIZATION]/[CLASSIFICATION]/[SITE|APP]/[USER] e.g.: Personal/Confidential/google.com/pjungwir@gmail.com Client1/Secret/google.com/pjungwir@example.com The folder structure allows for different keys to be used in .gpg-id files, so se…

This sounds like a very nice system, and I'll give it a try. I'm already using git to keep things synced between my desktop and my laptop. I've never even attempted syncing to my phone, but if I do that giving access to only a subset of the keys sounds great.

Re: I Lost All Faith in LastPass

#268

Post by JohnTHaller »

I have multiple folks I know using KeePass with the kdbx synced on Google Drive or similar. The authentication is a combination of a 1KB key file (manually copied onto each device via sneakernet) and a long password.

Re: I Lost All Faith in LastPass

#269

Post by quaintdev »

peterangular wrote: post #33
majkinetor wrote: post #9

God damnit, but what doesn't. I am sure BitWarden has its own problems and it (seems?) not 100% FOSS but its core is. LP extension and web vault ARE pure garbage: 1. It can't even recognize sites correctly ?! WTF really. I usually get 10 or so (looks like random) hits for any site but not the one that I should. 2. It offers me to extend pro support 5 years after I stopped paying for it. What I need to do for it to st…

I moved to Bitwarden from KeePass and haven't looked back. The UIX of Bitwarden can be a bit meh at times but it's also boring, predictable, and solid. I'm just saying this as someone who hates save buttons in the upper-right hand corner of things - just... small nitpicky stuff like that. Sometimes I have to look for a button or their use of iconography confuses me a bit. I would do my own hosting for a distributed p…

I did reverse, I wonder what your reasons are.

Re: I Lost All Faith in LastPass

#270

Post by maccard »

EMIRELADERO wrote: post #222
maccard wrote: post #131

Earlier quoted context omitted.

Why do you trust the source code is actually what they deploy to your device, or that what they build isnt linked against extra libraries, maybe even internal library?

It's a matter of trust and good faith. You could apply the same dichotomy to actual FOSS programs.

I do. Having source code available does6 mean anything if you can't verify the source yourself, or if the source can't be community certified. There's no point in a backend being open source, if nobody can verify what is running there. There's no point in an iOS app being open source if the app is distributed through the app store, as we have no way to verify that it is what it says it is.

Meanwhile if I'm running Debian I trust the maintainers have built the source code to distribute to me, similarly with homebrew and chocolatey.

> Its a matter of trust and good faith

Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not.

Post reply on HN