Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

11–20 of 587 posts

Re: Lastpass Security Incident

#11

Post by archi42 »

snailmailman wrote: post #4
celestialcheese wrote: post #2

> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.

How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.

Moving to vaultwarden (the open bitwarden server implementation) was also really easy. Just installed the package in Arch, setup the vhost in nginx, put the vhost into my local DNS and slightly adjusted the vaultwarden config file. Now I use bitwarden clients everywhere and point them to my server.

Since I don't feel 100% comfortable having my self hosted things on a public IP, I put it only on my LAN. For remote access (e.g. phone) I use wireguard.

Re: Lastpass Security Incident

#12

Post by rkagerer »

skittleson wrote: post #9
celestialcheese wrote: post #2

> was able to gain access to certain elements of our customers’ information This is frustratingly vague. This incident started 4 months ago, and you can't provide any details? If it wasn't such a PITA to move off LastPass, I would do so. They got me.

I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.

How smooth is the hotkey autofill experience? Does it identify websites and fill out login forms properly? (I prefer not to rely on sites' "remember me" boxes or ephemeral cookies).

Any compatible Android app?

Re: Lastpass Security Incident

#13

Post by rd07 »

rkagerer wrote: post #12
skittleson wrote: post #9

Earlier quoted context omitted.

I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.

How smooth is the hotkey autofill experience? Does it identify websites and fill out login forms properly? (I prefer not to rely on sites' "remember me" boxes or ephemeral cookies). Any compatible Android app?

In Android, I use Keepass2Android Password Safe app by Philip Crocol. As far as my experience goes, it is quite smooth and for the most part it is able to fill out the login form properly.

Re: Lastpass Security Incident

#15

Post by theaudacityofyw »

rkagerer wrote: post #12
skittleson wrote: post #9

Earlier quoted context omitted.

I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.

How smooth is the hotkey autofill experience? Does it identify websites and fill out login forms properly? (I prefer not to rely on sites' "remember me" boxes or ephemeral cookies). Any compatible Android app?

I can't speak for any browser integration but I use the app's autofill and it works great.

Several, I personally like KeePassDX but Keepass2android is also there, possibly others I don't know about.

Re: Lastpass Security Incident

#16

Post by KyleBerezin »

ocdtrekkie wrote: post #14

Password managers are a huge security antipattern and this will probably have to happen a couple dozen more times before infosec bloggers with affiliate marketing deals stop promoting them.

No one who uses unique passwords can remember them forever. It's a compromise of post-it notes vs managers. Either that or do account recovery every time you need to do your taxes (SOL for encrypted files though).

I sadly write passwords down, but dream of a better option.

Re: Lastpass Security Incident

#17

Post by brokenmachine »

rkagerer wrote: post #12
skittleson wrote: post #9

Earlier quoted context omitted.

I did it over the course of a few months. My choice was keepass since is opensource, battled test, and works everywhere as if it was lastpass.

How smooth is the hotkey autofill experience? Does it identify websites and fill out login forms properly? (I prefer not to rely on sites' "remember me" boxes or ephemeral cookies). Any compatible Android app?

I'm using keepass2android offline on Android, with the password file synced using syncthing. Works great.

It also has autofill that comes up in any supported app when it recognizes a password field that it can autofill. Quite seamless.

It also took a little mucking around to install it's custom keyboard and I had to run some adb command to give it permission to auto-switch keyboards, but now it's setup it's pretty good.

You can open an entry in keepass2android, then it will auto-activate the keyboard and you get buttons so you can auto-type any field from that entry into anything.

On Windows I'm using KeepassXC and the KeepassXC browser extension. It hasn't been perfect, I had to manually enable simple http auth for that to work, and sometimes it seems to miss login fields.

Also I had to manually add the URL for some existing sites (I was using KeePassDroid only on Android before so the URL entries weren't filled).

There's no way I could find to go to a site, then I would like to just click a button and choose an existing entry to fill into it.

But once I've manually added the URL entries, it's pretty seamless and auto-recognizes that there are entries that it can fill.

Overall I'm very happy with the whole setup.

Re: Lastpass Security Incident

#18

Post by ocdtrekkie »

KyleBerezin wrote: post #16
ocdtrekkie wrote: post #14

Password managers are a huge security antipattern and this will probably have to happen a couple dozen more times before infosec bloggers with affiliate marketing deals stop promoting them.

No one who uses unique passwords can remember them forever. It's a compromise of post-it notes vs managers. Either that or do account recovery every time you need to do your taxes (SOL for encrypted files though). I sadly write passwords down, but dream of a better option.

Post-It notes are a safer option than password managers. And it's absolutely outrageous to say this: But not every single account you have needs a unique password. Just ones which can actually allow someone to impersonate you meaningfully, cost you money, or gather sensitive data about you.

Response to @palata because of rate-limiting: The problem is people tend not to only put unimportant accounts in their password managers. They also put their bank and email passwords in there, and to my true horror: People have started storing their TOTP tokens in their password managers, which effectively reimplements single-factor authentication!

Re: Lastpass Security Incident

#19

Post by KyleBerezin »

ocdtrekkie wrote: post #18
KyleBerezin wrote: post #16

Earlier quoted context omitted.

No one who uses unique passwords can remember them forever. It's a compromise of post-it notes vs managers. Either that or do account recovery every time you need to do your taxes (SOL for encrypted files though). I sadly write passwords down, but dream of a better option.

Post-It notes are a safer option than password managers. And it's absolutely outrageous to say this: But not every single account you have needs a unique password. Just ones which can actually allow someone to impersonate you meaningfully, cost you money, or gather sensitive data about you. Response to @palata because of rate-limiting: The problem is people tend not to only put unimportant accounts in their password…

I do post-it notes and a couple of master passwords for things I don't care about, so I don't disagree. I need to make 2 points though. 1, enough 'non-sensitive' data can eventually become sensitive when taken as a whole, and 2 post-it notes are less secure if they are at a place of employment, think teachers.

Maybe the best option is one of those physical access password managers like KeePass

Post reply on HN