Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s in a PR statement: LastPass breach explained

palant.info

Post reply on HN
Print view View original

31–40 of 292 posts

Re: What’s in a PR statement: LastPass breach explained

#31

Post by A4ET8a8uTh0 »

linuxlizard wrote: post #7
prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

Thank you for this work! Could you add Bruce Schneier's PWSafe? https://pwsafe.org/

Simple. Portable. Works across platforms. Local. If that is a selling point for you, password safe just works. I apologize if it sounds like an ad, but I am a very happy user.

Re: What’s in a PR statement: LastPass breach explained

#32

Post by bikeformind »

Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality.

not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastPass should shut down the businesses, refund customers, and help them migrate to a new service? You are just not the organization for this job.

Re: What’s in a PR statement: LastPass breach explained

#34

Post by linuxlizard »

A4ET8a8uTh0 wrote: post #31
linuxlizard wrote: post #7

Earlier quoted context omitted.

Thank you for this work! Could you add Bruce Schneier's PWSafe? https://pwsafe.org/

Simple. Portable. Works across platforms. Local. If that is a selling point for you, password safe just works. I apologize if it sounds like an ad, but I am a very happy user.

Those are all good selling points for me. Thank you! I'm building the Linux version now.

Re: What’s in a PR statement: LastPass breach explained

#35

Post by tex0 »

dariusm5 wrote: post #15
prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

I don't see any mention of local vaults on the page. Is there any password manager out there besides keepass that isn't cloud based?

KeePass(X), Password Store/Gopass, pwSafe, ...

Plenty of good choices.

Re: What’s in a PR statement: LastPass breach explained

#36

Post by poopypoopington »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

you should add apple keychain

Re: What’s in a PR statement: LastPass breach explained

#37

Post by linuxlizard »

rietta wrote: post #29
dgrin91 wrote: post #19

Earlier quoted context omitted.

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

Have to plan ahead and have the keypass password in an envelope in the safe deposit box.

Yes. I do this. I have all my financial account numbers and passwords written on a piece of paper stored in my safe deposit box. If anything happens to me (knocks wood), my family will still be ok.

Re: What’s in a PR statement: LastPass breach explained

#39

Post by mrstone »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

Seems like a great product, but something about the URL is reminiscent of those scammy websites that try to trick you into downloading scamware.

Re: What’s in a PR statement: LastPass breach explained

#40

Post by simoncion »

dgrin91 wrote: post #19
40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

> How would KeyPass deal with the same type of situation?

You give someone a copy of your password, your key file (that is, your long-ass password), or both, if both are required.

If you want to duplicate the "Give people time to refuse the request for access" part of LastPass's feature, then retain a lawyer to hold the copies for you and -after receiving a request for them- release them after an agreed-upon period of time (or if they get a proper death certificate or whatever).

Post reply on HN