No post body was provided.
LastPass: Notice of Security Incident
11–20 of 141 posts
Re: LastPass: Notice of Security Incident
#12Earlier quoted context omitted.
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
> Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading…
Yeah, again: all of this is great for you, but it doesn't change the fact that you are a very, very niche case. You can't just dismiss cloud syncing of passwords because you are the edge case who doesn't need it.
> I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers.
That doesn't work for mobile devices. Most people have a work mobile device.
> even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere
This is literally how LastPass and 1Password handle it. If you lose your key, the file in the cloud becomes useless.
> In exchange for a little extra work...
"A little extra work" that is beyond the skills of the vast majority of users.
> ...you gain a ton of utility and resiliency
As someone who used KeePass for more than 10 years until recently, I can honestly say that it was a massive reduction of utility and had no resiliency benefits.
Re: LastPass: Notice of Security Incident
#13https://blog.lastpass.com/2022/08/notice-of-recent-security-...
Not good! All a password manager sells is trust. Without that they don't offer anything of value.
Re: LastPass: Notice of Security Incident
#14I wish they were more definitive as to if there was (or was not) any compromise of the source code repository credentials. Eg could the attacker have injected malware into the code as in the Solarwinds incident?
Re: LastPass: Notice of Security Incident
#15Earlier quoted context omitted.
Or just use the tools already on your computer. www.passwordstore.org and stand up your own bare git repo.
Pass with Yubikey is great! It’s amazing how much this simple shell script can conveniently do. You can literary audit this password manager in 30 mins! Thus, I feel it’s more secure than a complex solution like LastPass, since the code is small and a Yubikey touch gives you a chance at one password (with other password managers the whole vault is unlocked and all passwords are at risk and may be extracted at once).…
Creator of pass is the creator of Wireguard, which is awesome for similar reasons.
Guy's a legend.
Re: LastPass: Notice of Security Incident
#16Earlier quoted context omitted.
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
> Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading…
Copying files has the disadvantage of requiring some merge mechanism, or not permitting parallel modification.
I found vaultwarden to be a nice alternative. It runs on my server at home, to which I connect the relevant devices by VPN. It still requires the server to be online for modification (& the VPN connected), which I find to be a bit annoying, but it solves the concurrent modification issue. Plus, passwords are encrypted at rest and the browser extension verifies I'm using the password on a legitimate website (anti-phishing).
But if you're happy with your variant, I guess that's fine as well :)
Re: LastPass: Notice of Security Incident
#17Suppose that LastPass is compromised. What can an attacker do? Passwords are encrypted, with keys on users’ side. Short of serving customers malicious JS code or an app to steal passwords, the production environment referred in the article can be made totally public, without secrets in vaults bring revealed, no?
I suppose you could phish people into leaking the master password
Re: LastPass: Notice of Security Incident
#18I switched providers the last time this happened, or was it the one before that.
Not a good look for an online password storage service.
Re: LastPass: Notice of Security Incident
#19Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
>One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all.
If your passwords are encrypted you can put that file on a Times Square billboard and it doesn't matter. That is the entire point of encryption, moving sensitive data across adversarial channels. If you don't trust the encryption of the software you're using, well that's a good indication to not use it at all. But if you do there's literally zero point to not use a cloud provider.
Re: LastPass: Notice of Security Incident
#20Earlier quoted context omitted.
> Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading…
Yeah, again: all of this is great for you, but it doesn't change the fact that you are a very, very niche case. You can't just dismiss cloud syncing of passwords because you are the edge case who doesn't need it. > I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. That doesn't work for…
You've picked a strange subset of 'most' for the people you're imagining. They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Are you sure its not just a few people like you?