LastPass Finds Security Holes In Its Online Password Manager

#1

Post by yurisagalov » Fri, Jul 11, 2014, 11:56 PM UTC

LastPass Finds Security Holes In Its Online Password Manager
blog.lastpass.com

Re: LastPass Finds Security Holes In Its Online Password Manager

#2

Post by zedpm » Sat, Jul 12, 2014, 12:46 AM UTC

Any security hole is of course concerning, but as a LastPass user, I'm not at all concerned about the two issues mentioned in this article. The two features in question are, IMHO, not part of a typical use case for the product.

Re: LastPass Finds Security Holes In Its Online Password Manager

#3

Post by jt2190 » Sat, Jul 12, 2014, 12:54 AM UTC

While this news is a little worrisome, I view LastPass as a "better than what I'd do otherwise" solution, not a "perfect" solution. I no longer use my small set of short, easy-to-remember passwords over and over again across multiple sites. Now most of my passwords are long random strings that I don't even know. The overall increase to my average security offsets the downsides of having a centralized target for attackers, I think.

Re: LastPass Finds Security Holes In Its Online Password Manager

#4

Post by FreeKill » Sat, Jul 12, 2014, 1:20 AM UTC

jt2190 wrote: post #3

While this news is a little worrisome, I view LastPass as a "better than what I'd do otherwise" solution, not a "perfect" solution. I no longer use my small set of short, easy-to-remember passwords over and over again across multiple sites. Now most of my passwords are long random strings that I don't even know. The overall increase to my average security offsets the downsides of having a centralized target for attac…

Agreed. Also, I like that they seem to be extremely transparent when it comes to any issue at all. Both these issues, and the one from a year or so ago, where they thought maybe their servers were hacked, were clearly explained to their customers. I really appreciate that as a user.

Re: LastPass Finds Security Holes In Its Online Password Manager

#5

Post by gojomo » Sat, Jul 12, 2014, 1:39 AM UTC

s/Finds/Discloses/

Re: LastPass Finds Security Holes In Its Online Password Manager

#6

Post by rcthompson » Sat, Jul 12, 2014, 1:40 AM UTC

jt2190 wrote: post #3

While this news is a little worrisome, I view LastPass as a "better than what I'd do otherwise" solution, not a "perfect" solution. I no longer use my small set of short, easy-to-remember passwords over and over again across multiple sites. Now most of my passwords are long random strings that I don't even know. The overall increase to my average security offsets the downsides of having a centralized target for attac…

> I view LastPass as a "better than what I'd do otherwise" solution

Do you think it's better than, say, using a desktop-based password manager to save passwords to an encrypted file, and then syncing that file to all your machines via Dropbox?

Re: LastPass Finds Security Holes In Its Online Password Manager

#7

Post by justizin » Sat, Jul 12, 2014, 1:43 AM UTC

rcthompson wrote: post #6

jt2190 wrote: post #3

While this news is a little worrisome, I view LastPass as a "better than what I'd do otherwise" solution, not a "perfect" solution. I no longer use my small set of short, easy-to-remember passwords over and over again across multiple sites. Now most of my passwords are long random strings that I don't even know. The overall increase to my average security offsets the downsides of having a centralized target for attac…

> I view LastPass as a "better than what I'd do otherwise" solution Do you think it's better than, say, using a desktop-based password manager to save passwords to an encrypted file, and then syncing that file to all your machines via Dropbox?

Absolutely - how can I get a million bank passwords at once by hacking Dropbox, which just has a bunch of encrypted fucking files on it? Geez.

Re: LastPass Finds Security Holes In Its Online Password Manager

#8

Post by john2x » Sat, Jul 12, 2014, 1:47 AM UTC

jt2190 wrote: post #3

While this news is a little worrisome, I view LastPass as a "better than what I'd do otherwise" solution, not a "perfect" solution. I no longer use my small set of short, easy-to-remember passwords over and over again across multiple sites. Now most of my passwords are long random strings that I don't even know. The overall increase to my average security offsets the downsides of having a centralized target for attac…

How do you login on mobile browsers?

Re: LastPass Finds Security Holes In Its Online Password Manager

#9

Post by aroch » Sat, Jul 12, 2014, 1:51 AM UTC

john2x wrote: post #8

jt2190 wrote: post #3

While this news is a little worrisome, I view LastPass as a "better than what I'd do otherwise" solution, not a "perfect" solution. I no longer use my small set of short, easy-to-remember passwords over and over again across multiple sites. Now most of my passwords are long random strings that I don't even know. The overall increase to my average security offsets the downsides of having a centralized target for attac…

How do you login on mobile browsers?

Lastpass for iOS [1] or Android[2]. On Android you can even have it fill passwords inside of other apps

[1]: https://itunes.apple.com/us/app/lastpass-for-premium-custome...

[2]: https://play.google.com/store/apps/details?id=com.lastpass.l...

Re: LastPass Finds Security Holes In Its Online Password Manager

#10

Post by quaunaut » Sat, Jul 12, 2014, 2:27 AM UTC

I wonder if they had any way to reasonably detect these being used maliciously after they'd fixed it, since they fixed this as long ago as September 2013.

It'd be a neat sort of non-honeypot.