The situation at LastPass may be worse than they are letting on

Post by kaoD » Sat, Dec 24, 2022, 8:57 AM UTC

fsckboy wrote: post #197

ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

> safe and secure with end-to-end encryption for all Vault data, including website URLs end-to-end encryption means something like https, it's a communication quality between trusted parties https://www.ibm.com/topics/end-to-end-encryption

Post by pch00 » Sat, Dec 24, 2022, 9:01 AM UTC

hoistbypetard wrote: post #211

bee_rider wrote: post #183

Earlier quoted context omitted.

I see a lot of people mentioning bitwarden around here; is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). There’s very little room for failure and learning in the online password safe field, so I generally assume these companies are in one of two states: * has unknown bugs waiting to be revealed * out of business

> is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). You can see their server and client code here: https://github.com/bitwarden I choose to use their clients unmodified, along with an instance of the server formerly known as "bitwarden_rs" running in my basement as the sync backend. https://github.com/dani-garcia/v…

Post by _cenw » Sat, Dec 24, 2022, 9:09 AM UTC

darawk wrote: post #270

_cenw wrote: post #265

Earlier quoted context omitted.

> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence

Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.

Post by [deleted] » Sat, Dec 24, 2022, 9:13 AM UTC

darawk wrote: post #270

_cenw wrote: post #265

Earlier quoted context omitted.

> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence

Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.

Post by ytygg775 » Sat, Dec 24, 2022, 9:15 AM UTC