Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Issues with LastPass on Android

abhyudaya.dev

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Security Issues with LastPass on Android

#31

Post by falcor84 »

mlloyd wrote: post #28
falcor84 wrote: post #13

Earlier quoted context omitted.

>Your consideration doesn't pay for dev time. But rather than asking users to pay for newly developed premium functionality, they asked long term users to pay for things that they already had and had always been provided for free. >Shit or get off the pot. In this metaphor, they started charging people for using a previously freely accessible pot while they were in mid-shit.

Economics change and companies change. IIRC the company has been sold twice and maybe the new company can't underwrite the ongoing maintenance or just refuses to? Do users have a right to exist under legacy covenants when things at the company have changed? Again, this is why I advocate for shopping at monetization time. The company has altered the deal, maybe you should alter it further?

Yeah, I absolutely agree with that. I personally moved my family to Bitwarden and am very happy so far.

Re: Security Issues with LastPass on Android

#32

Post by Tarq0n »

batch12 wrote: post #18
mlloyd wrote: post #12

Earlier quoted context omitted.

> I had been considering paying for a family account Your consideration doesn't pay for dev time. No one cares about pushing free users or 'considering' users off the platform at monetization time. Shit or get off the pot. That said, no one blames you for doing comparison shopping at monetization time either.

Removing features to force conversion is a shady practice and I want no part in a company that finds this acceptable. If they find this acceptable, there is nothing preventing them from doing this again when I am not premium enough. I would rather shit in a pot that won't disable my ability to clean up after I have started.

I think it actually is fine within a product category like password managers where data is highly portable and switching costs are low. Platforms with lock-in doing this however...

Re: Security Issues with LastPass on Android

#33

Post by 1cvmask »

scrollaway wrote: post #22
Normal_gaussian wrote: post #5

Earlier quoted context omitted.

Thats right, we should blame the victim for trusting the tool. Password managers are increasingly mandated by organisations, and Lastpass is a very common recommendation. Even in the minority of technical users that use this kind of tool I expect small mistakes - like accidentally pasting a password in a URL. A good tool doesn't let you shoot yourself in the foot by escalting that to a non-obvious leak. The password…

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

Have you taken a look at saas pass that has 2fa as the default and the password manager identifies sites with 2fa?

disclaimer: was involved on the 2fa part of it.

Re: Security Issues with LastPass on Android

#34

Post by 1cvmask »

AbhyudayaSharma wrote: post #10
aneutron wrote: post #2

That's very interesting. I would love to read this student's paper once it comes out.

Hi! I am the author of this post. Thanks a lot for your feedback! I hope to make it public very soon.

What are the other two popular password managers you are looking at?

Re: Security Issues with LastPass on Android

#36

Post by Chilinot »

GavinMcG wrote: post #26
ahelwer wrote: post #25

After lastpass's recent policy changes around free multi-device use, I finally decided to switch password management services. I don't really mind spending like $10/year for password management but lastpass was slow/buggy/frustrating enough that I didn't want to pay for it. The whole process took probably three minutes front-to-back. Lastpass lets you export your passwords in a CSV, which you then upload to any other…

I also switched from LastPass to Bitwarden, and over the past couple years of using it I have had zero criticisms.

Bitwarden has worked great for me. Use it for personal stuff. At work we are stuck with lastpass, and it's such a pain to use.

My only complaint about bitwarden is that folder management in the macos app is not great. Adding passwords to new folders requires writing in the entire directory path. And i have to memorize the entirety of it, writing it incorrectly leads it to create new directories with those badly spelled names.

Re: Security Issues with LastPass on Android

#37

Post by umvi »

I use algorithmic passwords. I have an algorithm that takes in several parameters and generates a unique password per service. For example, my algorithm `f` might be:

f(domain, secret_word, secret_sentence, rules)

= UPPER(KEY_TO_RIGHT(domain[0:3])) + secret_word + secret_sentence[LENGTH(domain)] + LENGTH(domain) + PAD_TO_20("X")

So if my secret word were "bottleneck" and my secret sentence were "It is a truth universally acknowledged, that a single man in possession of a good fortune, must be in want of a wife." my algorithm generates the following passwords:

google.com:

f("google", "bottleneck", "It is a truth universally acknowledged, that a single man in possession of a good fortune, must be in want of a wife." , rules)

password = "HPPbottleneckacknowledged,6"

(note that "HPP" are the letters on the keyboard shifted right from "GOO")

microsoft.com:

f("microsoft", "bottleneck", "It is a truth universally acknowledged, that a single man in possession of a good fortune, must be in want of a wife." , rules)

password = "ZOVbottlenecksingle9"

The "rules" parameter is because some sites have length restrictions, symbol restrictions, and you may have to truncate the password or replace symbols. Also in "rules" is how many times you've changed a given password. I store the "rules" in a google doc.

Anyway, the nice thing about this system is that the algorithm is in your brain and you can use it to generate the password for a given service without relying on a password manager. So theoretically if I got stranded in Europe as a tourist and my phone got stolen, I'd still be able to get into my accounts (assuming 2FA isn't enabled...).

Password managers definitely generate more secure passwords, but my goal isn't to be the most secure, it's to strike a balance between the things I care about (and I care about being able to get into my accounts if I somehow lose access to my password manager).

Re: Security Issues with LastPass on Android

#38

Post by sour-taste »

scrollaway wrote: post #22
Normal_gaussian wrote: post #5

Earlier quoted context omitted.

Thats right, we should blame the victim for trusting the tool. Password managers are increasingly mandated by organisations, and Lastpass is a very common recommendation. Even in the minority of technical users that use this kind of tool I expect small mistakes - like accidentally pasting a password in a URL. A good tool doesn't let you shoot yourself in the foot by escalting that to a non-obvious leak. The password…

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

And how did you come up with this list of 'correct' password managers?

Re: Security Issues with LastPass on Android

#39

Post by CapriciousCptl »

umvi wrote: post #37

I use algorithmic passwords. I have an algorithm that takes in several parameters and generates a unique password per service. For example, my algorithm `f` might be: f(domain, secret_word, secret_sentence, rules) = UPPER(KEY_TO_RIGHT(domain[0:3])) + secret_word + secret_sentence[LENGTH(domain)] + LENGTH(domain) + PAD_TO_20("X") So if my secret word were "bottleneck" and my secret sentence were "It is a truth univers…

Better not sign up for services at ycombinator.xyz.

Re: Security Issues with LastPass on Android

#40

Post by m-p-3 »

Chilinot wrote: post #36
GavinMcG wrote: post #26

Earlier quoted context omitted.

I also switched from LastPass to Bitwarden, and over the past couple years of using it I have had zero criticisms.

Bitwarden has worked great for me. Use it for personal stuff. At work we are stuck with lastpass, and it's such a pain to use. My only complaint about bitwarden is that folder management in the macos app is not great. Adding passwords to new folders requires writing in the entire directory path. And i have to memorize the entirety of it, writing it incorrectly leads it to create new directories with those badly spell…

One thing I wish Bitwarden would add is the ability to make templates, and also the ability to add barcode-type fields, which would generate the actual barcode when viewed.
Post reply on HN