Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Now Checks If Your Sites Are Affected by Heartbleed

blog.lastpass.com

Post reply on HN
Print view View original

81–90 of 94 posts

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#81

Post by claudius »

awip wrote: post #50
plg wrote: post #20

Earlier quoted context omitted.

OK I'll bite ... why should I not use my browser's built in pw manager? (e.g. Safari on OS X Mavericks) I can see an argument about cross-platform use but is there another reason or reasons? thanks,

This is why: http://raidersec.blogspot.com/2013/06/how-browsers-store-you... TL;DR Firefox with a strong master password was considered safe at the time of that article's writing (June 2013). That + Firefox Sync is what I use - I would also be interested in anything more up to date on why this is or isn't a good idea.

It’s not the job of the browser to secure your data against OS-level adversaries, that’s the job of the OS (e.g. by using file permissions to protect against other users and ideally also MAC to protect against other software). It’s not even the responsibility of the browser to protect against someone else walking up to your computer while you’re using the toilet, that’s the job of the screensaver.

It is, however, the browser’s job to protect your passwords against other websites and the like, and I would be worried if there were bugs in that area, but your link doesn’t say anything about them (note also that using a password manager with an extension for protection against someone taking over the browser is useless, as that someone also owns the extension and hence can impersonate it towards the seperate password manager).

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#82

Post by regularfry »

alistairjcbrown wrote: post #77
regularfry wrote: post #76

Note: this is illegal in the UK.

[Citation needed]

Computer Misuse Act 1990, section 1.1. The test for the vulnerability requires running the exploit, whose only function is to secure unauthorised access to data held on the remote machine. Seems fairly clear-cut to me.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#83

Post by antsar »

davexunit wrote: post #26
devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software password manager that you can run on your own computer.

Why was this downvoted? Seems like sound advice not to drop the keys to your kingdom into a black box run by a business...

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#85

Post by blueskin_ »

devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

KeePass if you don't trust third parties and security is top priority, so you want an open source product that isn't web-based. (Disclosure: I use KeePass personally).

LastPass if sync/mobility is most important and you're fine trusting a (US?) company.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#86

Post by blueskin_ »

Spittie wrote: post #23
devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

With a question like this, you're probably going to get a lot of biased options. Not because people want you to use an inferior product, but because obviously one think that what he uses it the best. For example, as a current KeePass user, I'd suggest it. Lastpass overall is comfy, you do everything within your browser, it sync without much problems and you can use it on the go with the official applications and addo…

>The integrated sync support only ftp/webdav

There are KeePass addons for (from memory) SCP, SFTP, and FTPS (does anyone still really use FTP?), as well as others.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#87

Post by blueskin_ »

keypusher wrote: post #41
davexunit wrote: post #26

Earlier quoted context omitted.

It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software password manager that you can run on your own computer.

And what do I do when I have 3 or 4 devices? Home desktop, work desktop, laptop, tablet, etc?

KeePass has a basic builtin sync, with addons for more/better protocols, or if you primarily use one device with others as more readonly, you can just copy the file yourself.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#88

Post by blueskin_ »

sgeisenh wrote: post #34
grrowl wrote: post #31

Earlier quoted context omitted.

It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry. Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.

Authenticator tokens are pretty robust systems. I'd like to see more services start to make use of them.

Definitely, as long as there was a common standard (and open source, of course). Have a keychain token that you can link to accounts, then enter a password on that and it gives you a (time limited) key to use to login.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#90

Post by Karunamon »

antsar wrote: post #83
davexunit wrote: post #26

Earlier quoted context omitted.

It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software password manager that you can run on your own computer.

Why was this downvoted? Seems like sound advice not to drop the keys to your kingdom into a black box run by a business...

Because it's typical free-software-uber-alles posturing lacking logic.

Besides, it lacks applicability in this case. LP encrypts all your stuff client side before sending it along for storage, and the browser plugins that handle this are open source by way of being browser plugins. Whatever happens server side after that is mostly irrelevant.

Post reply on HN