11–20 of 118 posts
Wow, color me surprised. Software developers aren't perfect, and closed source software with less eyes on it tends to be even less perfect. I will never trust my passwords all being in one place other than my brain.
You can't keep varied, secure passwords in your head unless you barely use any services.
Earlier quoted context omitted.
You can't keep varied, secure passwords in your head unless you barely use any services.
There are no good options until someone figures out a good alternative to passwords.
Wow, color me surprised. Software developers aren't perfect, and closed source software with less eyes on it tends to be even less perfect. I will never trust my passwords all being in one place other than my brain.
You can't keep varied, secure passwords in your head unless you barely use any services.
I use abbreviations of several different long sentences with random characters added in random positions.
To me this is far more secure than trusting a single authoritative source with 10 different random character strings that I have no real ownership of, and can all easily be stolen (or lost) at once.
I can’t figure out why LastPass is still so popular. Ease of use since it’s completely browser based? They were early to market? I don’t get it. So many better designed, more secure options out there. KeePass, Bitwarden, or 1Password to name a few.
That is a whole lot of opinion, but not much substance. What makes LastPass inferior to these other options?
Well, for one, the very first sentence of the article here.
But no follow-up via email? Maybe it's time to start looking at other options.
I can’t figure out why LastPass is still so popular. Ease of use since it’s completely browser based? They were early to market? I don’t get it. So many better designed, more secure options out there. KeePass, Bitwarden, or 1Password to name a few.
I think it is mostly inertia and cross-platform support. Before they were acquired, they seemed to care a lot more about security, instead of just security theater. They also have some nice crypto features: For instance, I forgot my master password, and they have a one time password reset protocol that lets them send you an unlock code that only works on previously logged in devices. Also, it has rock-solid offsite b…
I like a number of features in LastPass. The auto fill, the auto password change feature, password sharing, etc.
Wow, color me surprised. Software developers aren't perfect, and closed source software with less eyes on it tends to be even less perfect. I will never trust my passwords all being in one place other than my brain.
You can't keep varied, secure passwords in your head unless you barely use any services.
I can’t figure out why LastPass is still so popular. Ease of use since it’s completely browser based? They were early to market? I don’t get it. So many better designed, more secure options out there. KeePass, Bitwarden, or 1Password to name a few.
I'm hoping the Autofill API in Android Oreo can bring more competition.
Are you ready?
You log in to their support forums and online community with the same password you decrypt your vault with.
[0]: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-...
EDIT:
To answer some of the comments, since understandably not everyone is a security expert:
What happens if LastPass’s web forum is compromised and all their additional security counts for nothing?
Even if not: you have no problem with people being conditioned to enter the password securing all their passwords repeatedly into random pages for random content not related in any way, shape, or form to their vault in a web browser?
Containment is the name of the game. It’s hard enough making one app secure enough to enter your password into. Then extending that with an SSO, relying on The security of none other than notoriously crappy phpBB, vulnerable to upstream code injections, XSS, phishing attacks, and god knows what else, and you still think you can trust them to keep your master password secure?
LastPass is such a juicy target and this is such an easy attack vector that I can virtually guarantee at some point phpBB - or, more accurately, their abuse of it - will be a massive liability and the source of a huge catastrophe for them, if it hasn’t secretly already.
Of course they know to treat changes to their authentication apps very carefully and code review each and every syllable added or removed (well, I hope so). But do they review upstream patches to the forum software they use? What about the third party template they have installed? Do they hold off on patches after a security bug is discovered in phpBB so they can review the code changes? Do they even upgrade their forums? What about a vulnerability in PHP itself? Do they secure the server hosting their authentication apps in the same manner as the server hosting their forums? Do their web developers undergo the same background checks and scrutiny their core developers undergo? How many sysadmins have access to the website? Do they provide the same access monitoring to people managing an ancillary feature like their forum software?
The list just goes on forever. You’re as secure as the weakest link. All anyone that want to break into LastPass has to do is get some code into phpBB or the random phpBB themes and plugins they use and it’s game over for millions of LP users and billions of credentials worldwide.
See the problem?