Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

211–220 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#211

Post by hoistbypetard »

bee_rider wrote: post #183
sacnoradhq wrote: post #133

Earlier quoted context omitted.

Bitwarden, Keeper ($ but trusted at megacorps), and good ol' PasswordSafe are the safest solutions. I run BW with Yubikey 2FA and a local hosted sync server. KeePassX/C perhaps. Vault for secrets management. Never touched LastPass, 1Password or any of these other mickey-mouse commercial apps that invariably claim "military-grade encryption" or "unhackable" when their fundamental constructions are crap.

I see a lot of people mentioning bitwarden around here; is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). There’s very little room for failure and learning in the online password safe field, so I generally assume these companies are in one of two states: * has unknown bugs waiting to be revealed * out of business

> is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?).

You can see their server and client code here: https://github.com/bitwarden

I choose to use their clients unmodified, along with an instance of the server formerly known as "bitwarden_rs" running in my basement as the sync backend. https://github.com/dani-garcia/vaultwarden

I still pay them annually for their "freemium" features even though I prefer not to let them host my data.

Re: The situation at LastPass may be worse than they are letting on

#212

Post by wlesieutre »

wepple wrote: post #190
technion wrote: post #121

Earlier quoted context omitted.

I definitely feel the opposing law works. When I see a project with a massive disclaimer about "this crypto is not audited, I'm a noob never deploy this anywhere" I'm likely to see better crypto than most of the commercial products I work with, including ones with sales people that talk about unbreakable crypto.

And likewise “military grade encryption” usually means “win2k Visual Basic backend”

Your data is automatically translated into Navajo

Re: The situation at LastPass may be worse than they are letting on

#213

Post by hoistbypetard »

cmsj wrote: post #125
_-____-_ wrote: post #50

Earlier quoted context omitted.

Additionally, 1Password makes the extra effort to never even send the URLs of your accounts to their servers. Even with their Watchtower service, which notifies you of breached accounts and websites that support 2-factor authentication, your passwords and website URLs are never sent to 1Password servers. https://support.1password.com/watchtower-privacy/

They still require that your vault be hosted by them though. Terrible policy.

I had been a very happy customer for years before they started moving to that policy. It's what finally made me set up a vaultwarden instance and migrate all my stuff over.

I didn't like the move to a subscription model, but I'd have sucked that up if I could've continued to bring my own sync.

Re: The situation at LastPass may be worse than they are letting on

#214

Post by heywoodlh »

user3939382 wrote: post #189
heywoodlh wrote: post #170

Earlier quoted context omitted.

I have and it's fantastic: https://apps.apple.com/us/app/pass-password-store/id12058205...

Does that work as a password manager provider that you can enable for iOS auto fill?

Yes!

Re: The situation at LastPass may be worse than they are letting on

#215

Post by heywoodlh »

gleenn wrote: post #186
heywoodlh wrote: post #170

Earlier quoted context omitted.

I have and it's fantastic: https://apps.apple.com/us/app/pass-password-store/id12058205...

Maybe this is terrible logic but I would never trust an app that had 120 reviews and what appears to be a single person as the app owner with all my passwords.

No, I think that logic is completely fair. From my experience it is dead simple and works extremely well, however, I think it's definitely good to vet apps in your own way.

Re: The situation at LastPass may be worse than they are letting on

#216

Post by snowwrestler »

xwowsersx wrote: post #54

I've been using LastPass for years. Looks like I'm going to have to export everything from my LP vault and import it into Bitwarden. Any downsides to Bitwarden that anyone knows of? I'm asking more about convenience, i.e. how well the browser extensions and Android app work and less about security.

If you want to improve your security, don't export from LastPass. Instead, authenticate into each service with the creds in LastPass, change your password in the service, then save the new password into Bitwarden.

In general, one should avoid exporting/importing credentials. Instead reset them and save the new creds into the new place.

Re: The situation at LastPass may be worse than they are letting on

#217

Post by snowwrestler »

wlonkly wrote: post #154
aborsy wrote: post #124

This claim looks strange. A 16 characters password from all character types can’t be broken. How could hackers break the vault, with end to end encryption and such password?

A _random_ 16-character password from all character types can't be brute-forced. A password made from common dictionary words, with numbers substituted in with l33tsp3ak, and an exclamation mark on the end, is a different story. Passwords like that would be sitting in precomputed hash lists already.

The hash would only be sitting in precomputed lists if LastPass did not salt the passwords first. It's my understanding that they did.

Re: The situation at LastPass may be worse than they are letting on

#218

Post by nerdawson »

nicolas_t wrote: post #84

And when I say that I will stop using 1password when the local vault no longer works, people look at me like I'm paranoid and crazy. I've looked at the white paper https://1passwordstatic.com/files/security/1password-white-p... , I think 1password has a decent security posture for their cloud offering but then there's always the risk of a breach where the attacker controls the site and can intercept your master passw…

Is that same risk present if you use the app?

My understanding is the app decrypts the vault locally. I guess they could put out a malicious update but then you’d be impacted whether there was a cloud-free option or not.

Re: The situation at LastPass may be worse than they are letting on

#219

Post by toleda »

int_19h wrote: post #184
sacnoradhq wrote: post #133

Earlier quoted context omitted.

Bitwarden, Keeper ($ but trusted at megacorps), and good ol' PasswordSafe are the safest solutions. I run BW with Yubikey 2FA and a local hosted sync server. KeePassX/C perhaps. Vault for secrets management. Never touched LastPass, 1Password or any of these other mickey-mouse commercial apps that invariably claim "military-grade encryption" or "unhackable" when their fundamental constructions are crap.

When it comes to password management, trust should not even be a thing. https://www.lesspass.com/

I may be wrong, the idea is interesting but looks more like a password generator and a terrible password manager to me.

You still need to store somewhere informations like url, username, counter, etc. right ? Can you change the master password without changing all your accounts password ? If one happens to find your master password, he's basically able to get/generate all your passwords just like a normal pw manager with no 2FA, correct ?

Re: The situation at LastPass may be worse than they are letting on

#220

Post by StanislavPetrov »

five82 wrote: post #205
StanislavPetrov wrote: post #147

Earlier quoted context omitted.

>And so does sending your passwords to a phone or a home/work pc via chats or email, or using a single password everywhere, or maybe a couple of them with trivial variations. Cloud password managers wouldn’t even exist if people didn’t do much more stupid things to enter their passwords on a different device than the cloud could ever think of. "You should do something stupid because most people do things that are eve…

May I ask how you accomplish this without any sort of burden? Because from my perspective, managing strong unique passwords for hundreds of accounts across desktop, mobile, servers, and other devices is a major pain and I’m tired of dealing with it. It’s human nature to take shortcuts and develop bad habits when you’re dealing with a flawed system and poor tools that puts the burden on the end user to manage everythi…

>managing strong unique passwords for hundreds of accounts across desktop, mobile, servers,

I have a couple of dozen unique passwords. The ones I use most frequently are easily remember with pass phrases and all are written down on a couple of sheets of paper.

>and other devices is a major pain and I’m tired of dealing with it.

You are free to sacrifice security for convenience, but don't cry about it when your security is compromised because you consider maintaining your security too much of a hassle.

>It’s human nature to take shortcuts and develop bad habits when you’re dealing with a flawed system and poor tools that puts the burden on the end user to manage this.

I would argue that outsourcing your "security" to a third party is a shortcut and a bad habit that compromises your security. If you can't be bothered to worry about your own security because you find it too much of a hassle, then you have nobody to blame but yourself when your security is compromised.

>And if I’m struggling with four decades of experience, how is the average non tech user expected to do it?

Most non-tech users don't have hundreds of accounts to manage. I would hope and expect that even non-tech users have the ability to use a paper and pencil, and write down their passwords. At what point are responsible, sentient adults expected to take responsibility for themselves and their own security?

>May I ask how you accomplish this without any sort of burden?

Being an adult who is responsible for yourself is a necessary burden. This is also true for your own security.

Post reply on HN