I've migrated to Bitwarden. LastPass has been lacking in quality for a while and this outage was the last straw.
LastPass stores passwords so securely, not even its users can access them
211–220 of 266 posts
Re: LastPass stores passwords so securely, not even its users can access them
#212So in response to this story I decided to delete my (premium) account with them. After confirming multiple times (good thing), I was shown this error: https://i.imgur.com/4dpn6d5.png How does error handling like this even make it to production? I got an email as well confirming my account deletion and I can no longer log in. But all in all this clearly does increase my trust in Lastpass's security competence.
Yup, I switched after the company was sold recently. I got that error as well. I moved to 1password
Re: LastPass stores passwords so securely, not even its users can access them
#213The reactionary nature of the typical HN poster is on full display here. Lastpass had a bug that affected a small percentage of users. They identified and fixed the bug within several days. What more do you want? Is there really a competing product out there that guarantees NO BUGS? So, then, why the extreme nod to #CancelCulture for what appeared to be just a temporary issue?
They've been circling the toilet for a while now. Quality matters.
Re: LastPass stores passwords so securely, not even its users can access them
#214Earlier quoted context omitted.
> it seems to be three days for a fix, not half an hour. You are trying to conflate 2 different metrics. The first assertion, is from the time the ticket was investigated, not submitted. It might be useful to talk about expectation of service, since that's what you are getting at. 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate.
> 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate. For most services, I'd expect free tiers to be strict subsets of paid tiers. I'd expect them to be running the same code, often on the same servers, as paid tiers. Free tier accounts would for the most part just have different per account settings. If that is the case, and I was a paid tier user…
It’s common to use free tier as a canary deploy. Cloudflare, for instance, is quite public about this.
Re: LastPass stores passwords so securely, not even its users can access them
#215Earlier quoted context omitted.
I really want pass or something like it, but the two times I've tried, I got stuck trying to figure out the gpg part. I suppose I should go and learn that properly anyways, since in spite of its UX it's still an extremely widely used and powerful tool, but it's a lot higher barrier to entry compared to "type in password, unlock vault".
The gist of it is that you need a keypair (a public and private key), which GPG can generate for you. Then whenever you insert something into the `pass` database (which is just a directory tree full of encrypted plaintext files) the tool uses the public key to encrypt the password (or anything else): pass generate --no-symbols shopping/ebay 16 Later, when you want to read a password, you ask pass to decrypt the file…
Thank you:) That gist does look like what I need; I'll have to try it out!
Re: LastPass stores passwords so securely, not even its users can access them
#216Earlier quoted context omitted.
If you have a Raspberry Pi lying around, there's a docker image for the excellent bitwarden_rs server available that makes it a snap to get up and running: https://github.com/dani-garcia/bitwarden_rs/wiki/Which-conta...
The cost of electricity and my time is probably more than $10 a year.
The argument for self-hosting Bitwarden is about privacy and security, not cost.
Re: LastPass stores passwords so securely, not even its users can access them
#217On a side, am I the only person that doesn't like The Register write style, especially the headings? Yeah, irony and fun all that you want, but it ends up looking like a gossip/tabloid magazine
>The Register write style, especially the headings Basically all mainstream journalism coming out of the UK is garbage (FT & economist excluded I guess). Even the BBC has been showing some partisan leanings lately
With that sort of bar, pretty much all journalism would be classed as “garbage”, UK or not. Which might well be true, I’m just saying it’s hardly a British phenomenon.
Re: LastPass stores passwords so securely, not even its users can access them
#218So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/
BitWarden
Re: LastPass stores passwords so securely, not even its users can access them
#219So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/
I was a longtime LastPass customer, but the service just kept getting worse and worse, to the point where a year ago I realized I was spending more time fighting the user interface than it was saving me. And their support was absolutely useless. So I also switched over to 1Password, and never looked back. It is such a refreshing and trouble free experience compared to LP, and the few times I needed to ask a question,…
LastPass was also acquired by LogMeIn, which is notorious for really bad software (I'm looking at you GoToWhatever). I switched over to 1P two years ago and haven't looked back. I don't trust LastPass/LogMeIn for as far as I can throw.
That being said, having A password manager is better than having none at all.
Re: LastPass stores passwords so securely, not even its users can access them
#220Earlier quoted context omitted.
Bitwarden is also very good
LP to Bitwarden as well here. The only issue I've found so far is MFA doesn't seem to be working on the (Linux) Firefox plugin, this could be a user error issue as I've not had time to look into it yet (only noticed it this morning).
MFA is working fine for me with Firefox on both Ubuntu and Fedora.