Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: Security done wrong

palant.de

Post reply on HN
Print view View original

161–170 of 221 posts

Re: LastPass: Security done wrong

#161

Post by fencepost »

johnjuuljensen wrote: post #23

http://keepass.info/ is awesome. Put your keyfile on Dropbox/OneDrive/whatever so it syncs to all your computers. Keepass2Android works great and can read from most cloud storage solutions. Don't know about iPhone. Edit: It also has a lot of neat plugins. I use one for storing ssl certificates, which also supports key forwarding to putty.

I may be misremembering, but I thought this was the method used by at least one other app. 1password comes to mind but I can't check it right now.

I ran into this when checking unexpected files on a client's system.

Re: LastPass: Security done wrong

#162

Post by ricardobeat »

danjoc wrote: post #90
Blackthorn wrote: post #33

Sigh. I can't ignore the red flags anymore. Time to switch off. Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I need something like lastpass. Don't suppose there's anything out there that can import the lastpass db?

passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to…

Does using PGP make it any safer than, say, simple password-based SHA-512 encryption?

Re: LastPass: Security done wrong

#163

Post by iamatworknow »

jawon wrote: post #149
iamatworknow wrote: post #128

Earlier quoted context omitted.

Anecdotal and personal opinion, but I believe that it has. I've been a LastPass user since February 2014. I used to pay for the annual subscription because it was required to use their phone apps, but now that it isn't I find no benefit to the paid subscription, especially given how poorly some thing seem to be working. The user experience with extensions for different browsers (Chrome, Firefox, Safari) is inconsiste…

I've been using the iOS app since it came out and have never had a problem with it. TouchID integration has been a godsend.

Not sure what would be causing my issues then. It's only been happening for the past two or three months on my 6S Plus.

Re: LastPass: Security done wrong

#164

Post by wefarrell »

mnm1 wrote: post #77

"Altogether it looks like LastPass is a lot better at PR than they are at security. Yes, that’s harsh but this is what I’ve seen so far." No, it's not harsh enough for a program that knows the right password, shows it to you, but then inputs the wrong one in the password field. Of course, compared to these security issues, such UI issues are almost irrelevant. With such a simple UI to program, you'd think they'd at l…

Is there a better alternative? Certainly not reusing passwords and if you aren't reusing passwords you'll have to manage them all somehow. I can't see a better solution.

Re: LastPass: Security done wrong

#165

Post by tcpekin »

ryankask wrote: post #158
pwenzel wrote: post #56

Earlier quoted context omitted.

If you're open to a paid option, 1Password for Teams/Families a good one. You can transfer from LastPass via CSV ( https://support.1password.com/import-lastpass/ ).

Are you using 1Password's cloud sync or the older Dropbox/iCloud/other method? (Really curious about all 1Password users in this thread) I've read a lot of reviews but many predate 1Password's cloud option.

I use their cloud sync and love it. One of the few subscription services I pay for. I also use the browser extension, which others have pointed out might not be the best, but I think it's better than one to five universal easy to guess passwords I was using before. I have it on Windows, Mac and Android and it syncs seamlessly.

Re: LastPass: Security done wrong

#166

Post by danjoc »

ricardobeat wrote: post #162
danjoc wrote: post #90

Earlier quoted context omitted.

passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to…

Does using PGP make it any safer than, say, simple password-based SHA-512 encryption?

It does. Using PGP in conjunction with a Yubikey means even if someone obtains your password repo, they still can't get in without your physical private key. Without using a Yubikey, an attacker would still need to obtain the private key. They couldn't just grab the vault from the cloud store and start running offline password cracking on it.

Re: LastPass: Security done wrong

#167

Post by icc97 »

compuguy wrote: post #113
icc97 wrote: post #55

Earlier quoted context omitted.

You can also add in KeepassHttp + PassIFox. But I wonder if these might have similar vulnerabilities as they too would be handling decrypted passwords.

True, but there are a slew of security issues (and unknowns) with KeePassHttp: https://github.com/pfn/keepasshttp/issues/258 https://github.com/keepassxreboot/keepassxc/issues/147 I've been looking for a alternative with somewhat parity with lastpass with a better security policy.

That #258 issue is for if you use it remotely - which by default it isn't and I don't. The other issue you raise is based on top of that. So as long as you're using KeepassHttp with localhost then you should be ok.

So a slew is not necessarily accurate. But I take you're point, it's definitely a similar weak point that LastPass has.

Re: LastPass: Security done wrong

#168

Post by Johnny_Brahms »

avoutthere wrote: post #108
johnjuuljensen wrote: post #23

http://keepass.info/ is awesome. Put your keyfile on Dropbox/OneDrive/whatever so it syncs to all your computers. Keepass2Android works great and can read from most cloud storage solutions. Don't know about iPhone. Edit: It also has a lot of neat plugins. I use one for storing ssl certificates, which also supports key forwarding to putty.

Putting one's keyfile in the cloud just seems to me to be asking for it. You're essentially trusting a 3rd party with the keys to your kingdom.

I don't trust dropbox, but I do trust the encryption of my password manager. Depending on how you measure, my key is somewhere between 100-150 bits, and even if that was feasible to brute force, I am not that important.

Re: LastPass: Security done wrong

#169

Post by dublinben »

svenfaw wrote: post #130
dublinben wrote: post #68

Earlier quoted context omitted.

Dashlane isn't open source, nor is it available on Linux. That is going to prevent a lot of people from even considering it.

Lastpass / 1Password are not open source either.

Great reason to not recommend them either!
Post reply on HN