Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

311–320 of 322 posts

Re: I Lost All Faith in LastPass

#311

Post by peterangular »

quaintdev wrote: post #269
peterangular wrote: post #33

Earlier quoted context omitted.

I moved to Bitwarden from KeePass and haven't looked back. The UIX of Bitwarden can be a bit meh at times but it's also boring, predictable, and solid. I'm just saying this as someone who hates save buttons in the upper-right hand corner of things - just... small nitpicky stuff like that. Sometimes I have to look for a button or their use of iconography confuses me a bit. I would do my own hosting for a distributed p…

I did reverse, I wonder what your reasons are.

Needed a solution that I could use on all devices easily - browser, shell, phone... basically anywhere I need a password. KeePass isn't distributed by nature, relying on a filesystem DB - this worked for me for _years_ and is a fine system, but I started getting nervous using Google Drive to tote the database around from device to device.

Also planning for my passing, I think it'll be easier for my SO to get into a simple web-based solution with my TFA scratch code if they need to handle any of my affairs vs. tracking down my KeePass file that would be behind disk encryption etc.

Like I said - used KeePass for years, and I love it to death. I have just moved on in my usage and needs =)

Re: I Lost All Faith in LastPass

#312

Post by quaintdev »

peterangular wrote: post #311
quaintdev wrote: post #269

Earlier quoted context omitted.

I did reverse, I wonder what your reasons are.

Needed a solution that I could use on all devices easily - browser, shell, phone... basically anywhere I need a password. KeePass isn't distributed by nature, relying on a filesystem DB - this worked for me for _years_ and is a fine system, but I started getting nervous using Google Drive to tote the database around from device to device. Also planning for my passing, I think it'll be easier for my SO to get into a s…

I use Syncthing to sync tha password database across devices. It's been working like a charm.

I needed something selfhosted and have used bitwarden for that until I got burned down when I could not recover the instance.

Re: I Lost All Faith in LastPass

#313

Post by IcePic »

kstrauser wrote: post #69
jrochkind1 wrote: post #46

> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)

At the risk of conjuring a strawman, I've heard people worry about the loss of control, like maybe the process has some sensitive data in RAM that it will release and then the OS will alloc() it to another process. And that's true on one level, but nothing prevents a garbage collected language from overwriting all the data in a block of RAM as it free()s it. I think the risk of memory related bugs in a non-managed la…

> At the risk of conjuring a strawman, I've heard people worry about the loss of control, like maybe the process has some sensitive data in RAM that it will release and then the OS will alloc() it to another process.

I'm sure some people worry about this, but I think you will be hard pressed to find a modern OS that actually would give away your contents to another PID.

Just because a program can malloc(8), fill eight bytes with known content, free() the pointer, malloc(8) again and see their old content doesn't mean the OS hands your data to anyone, just that the libc (or whatever runtime you use) is not actually getting a whole page for that single 8 byte malloc, and it didn't give it back to the OS at free() either, so you "owned" the page where those 8 bytes lives all the time during execution of this simple test.

The limit for which your allocator starts _actually_ handing back data is probably never less than 4k and upwards to 256k depending on page size, malloc settings and OS/libc defaults.

So while there are a lot of traps code can fall into as mentioned in other comments in this thread, I think everyone can stop worrying about "the next program to malloc() will get my old data" because that just doesn't happen.

Re: I Lost All Faith in LastPass

#314

Post by avnigo »

Fire-Dragon-DoL wrote: post #256
metabagel wrote: post #102

Earlier quoted context omitted.

>> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.

To perform a LastPass migration, there are 4 phases involved: 1. Export passwords 2. Export attachments 3. Export password history 4. Export form fills (THIS IS NOT POSSIBLE FROM MY UNDERSTANDING, form fills also appear to not be encrypted?!) # 1. Export passwords In the extension, go to Account Options -> Advanced -> Clear Local Cache , this WILL LOG YOU OUT. Then, log-in and Account Options -> Advanced -> Refresh S…

Awesome work on the password history export, thanks a lot!

I audited the code to the best of my ability and it doesn't look like it's malicious, but I certainly could've missed something, so to anyone who's thinking about using this, it works, but do your due diligence.

Re: I Lost All Faith in LastPass

#315

Post by roustem »

nequo wrote: post #121
aidos wrote: post #94

Earlier quoted context omitted.

They are in the business of doing business. How much of the codebase that makes up their business model would you like them to expose?

Bitwarden is in the business of doing business, too. But their source code is publicly available. A lot of it is even under GPL: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ....

Fun fact: Bitwarden also includes some of the 1Password open-source code: https://github.com/bitwarden/clients/blob/c10e93c0d9cf306a59...

Re: I Lost All Faith in LastPass

#316

Post by roustem »

EMIRELADERO wrote: post #289
maccard wrote: post #270

Earlier quoted context omitted.

I do. Having source code available does6 mean anything if you can't verify the source yourself, or if the source can't be community certified. There's no point in a backend being open source, if nobody can verify what is running there. There's no point in an iOS app being open source if the app is distributed through the app store, as we have no way to verify that it is what it says it is. Meanwhile if I'm running De…

> Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not. Precisely. By not showing their source code, they implicitly state that they don't care about whether you trust them or not when it comes to source code. It is not a meaningless distinction. Bitwarden for example lists being open-source as a plus in security . You may not personally see it that way,…

Intellectual property is important and making everything open source would allow our competitors to easily copy it or at least get an idea how to improve their products. It is hard to seriously compare the features, the security design, and the UX of Bitwarden to 1Password — it is not close. Just a few examples: being able to edit your data while offline, ability have large notes with Markdown formatting (aka "Moby Dick Workout"), support for large datasets (more than 100,000 items).

1Password has been in business for 17 years, longer that any other password manager. It is very difficult to have a long term business model built completely on open source.

Re: I Lost All Faith in LastPass

#317

Post by roustem »

idiot900 wrote: post #154
acatton wrote: post #147

When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password…

On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.

One of the tests we recently added to 1Password is the "Moby Dick Workout" for secure notes with Markdown rendering. Would love you to compare 1Password and Bitwarden:

https://www.hogbaysoftware.com/posts/moby-dick-workout/

Re: I Lost All Faith in LastPass

#318

Post by EMIRELADERO »

roustem wrote: post #316
EMIRELADERO wrote: post #289

Earlier quoted context omitted.

> Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not. Precisely. By not showing their source code, they implicitly state that they don't care about whether you trust them or not when it comes to source code. It is not a meaningless distinction. Bitwarden for example lists being open-source as a plus in security . You may not personally see it that way,…

Intellectual property is important and making everything open source would allow our competitors to easily copy it or at least get an idea how to improve their products. It is hard to seriously compare the features, the security design, and the UX of Bitwarden to 1Password — it is not close. Just a few examples: being able to edit your data while offline, ability have large notes with Markdown formatting (aka "Moby D…

I never said open source was to be the foundation. In fact, I never talked about open source at all. All I'm referring to is source availability.

As I said earlier I'm not going to complain that you won't use a free license such as MIT or AGPL or whatever else. The real issue is just the sources being publicly auditable. Are you worried about your competitors copying your non-copyrightable material? Ideas?

While there would still be an issue, I would be a bit less harsh on the policy if at least the clients were source-available. Transparency is security.

> It is hard to seriously compare the features, the security design, and the UX of Bitwarden to 1Password — it is not close.

How does Bitwarden not come close in security? All I can come up with is the secret key requirement. Is that all? If anything Bitwarden feels more secure because of its transparency. You can see the developers working live, each commit they make.

Re: I Lost All Faith in LastPass

#319

Post by zopa »

msla wrote: post #301
zopa wrote: post #300

Earlier quoted context omitted.

I agree about the problem —- I might quibble with the psychology, but close enough. But that’s exactly why the distinction I’m trying to draw is so important. If we keep in mind the difference between what we can rigorously establish and what we’re fundamentally taking on faith (however well-founded), then at least we can talk to people on the other side: clarify core disagreements, examine evidence, and occasionally…

Here is where I think we part ways, philosophically speaking: > If we keep in mind the difference between what we can rigorously establish and what we’re fundamentally taking on faith (however well-founded) From my perspective, we're taking everything in the real world "on faith" (and there is a loaded phrase ripe to be deliberately misinterpreted) to a certain extent, and not just because of brain-in-a-vat arguments…

I'd agree with almost all of that, but with two additions: I think we can locally approximate reality as an axiomatic system, with the axioms just being the stuff we've decided to treat as true for the moment. When the context changes what counts as an axiom changes, but that only rarely happens to me with chairs.

Second, I think there's at least a rough partial order on the things people propose as axioms: the order of how surprised I am when someone contests one, if you like. Very surprised, if it's the existence of external reality; not too surprised at all, sadly, if it's whether biologists are to be trusted over the pastor at their church on the origin of species.

The nice thing about that machinery is that when you meet the second sort of person, you're not forced to believe that they're fundamentally irrational and immune to all reason.

One more thing: trusting experts is a very convenient heuristic for me individually, and I use it all the time, but it's not epistemelogically all that useful. In principle you can always replace an appeal to the authority of a genuine expert with the evidence that they rely on to come to their judgement: if you can't, then they're speaking outside of their expertise. No one of us can win an argument on the internet that way; time is finite and we each only know so much. But if we all chip away at it, by supplying evidence where and when we can, we might get somewhere.

Re: I Lost All Faith in LastPass

#320

Post by jsmith99 »

majkinetor wrote: post #214
jsmith99 wrote: post #20

Earlier quoted context omitted.

Which bit of bitwarden is not FOSS?

It looks like premium features are not foss, like SSO for example (but I might be wrong): https://bitwarden.com/help/about-sso > Login with SSO is available for all customers with an Enterprise organization

Only saw the reply late. All enterprise features seem fully open source. Eg SSO is in the source at https://github.com/bitwarden/server/tree/master/bitwarden_li...

Correction: that part of the source seems to be only 'source available' rather than FOSS.

Post reply on HN