this sort of thing is why I append the name of the website + a unique identifier + password, so that I don't have to bother changing my password during such nonsense, ugh.
Do this instead https://spectre.app/
The situation at LastPass may be worse than they are letting on
51–60 of 436 posts
Re: The situation at LastPass may be worse than they are letting on
#52Earlier quoted context omitted.
That’s not secure at all. Eventually, some website you use is going to get hacked. They’ll have stored passwords as plaintext. From there, anyone who wants to hack any of your accounts knows your password format. It’s going to be obvious to them that they just need to replace the domain.
how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information. of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy s…
It does reduce the search space for a brute force attempt. Depending on how short your identifier is. Also if two sites passwords are leaked it could make someone’s job a lot easier.
Re: The situation at LastPass may be worse than they are letting on
#53Earlier quoted context omitted.
Append it where?
e.g. password to facebook would be: facebook.com$293MyPasswordYouKnowIt!!123 password to gmail would be mail.google.com$113MyPasswordYouKnowIt!!123 only annoying thing is that the passwords are long. I guess it's secure, though. edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.
This means that if a breach reveals more than one of your passwords, the pattern is easily recognized and you just made ALL your passwords extremely weak. Not a great idea.
Re: The situation at LastPass may be worse than they are letting on
#54I've been using LastPass for years. Looks like I'm going to have to export everything from my LP vault and import it into Bitwarden. Any downsides to Bitwarden that anyone knows of? I'm asking more about convenience, i.e. how well the browser extensions and Android app work and less about security.
Re: The situation at LastPass may be worse than they are letting on
#55I’m skeptical of this. Seems like if it were true, we would be hearing the same thing from several other independent and credible sources.
I agree: LastPass has been hot garbage for many years but it still has a significant presence, some guy’s low-value crypto wallets would not be the first we hear about a compromise of LastPass vaults. There are entire companies using LastPass for critical systems. I absolutely believe it’s possible that LastPass has been compromised more than they’ve let on and I won’t be surprised if we eventually find out vaults ar…
But if you had a ton of credentials from people, scanning for crypto credentials and trying to use those may be easier/faster/safer to turn into money than system credentials to some random company network.
Re: The situation at LastPass may be worse than they are letting on
#56Earlier quoted context omitted.
e.g. password to facebook would be: facebook.com$293MyPasswordYouKnowIt!!123 password to gmail would be mail.google.com$113MyPasswordYouKnowIt!!123 only annoying thing is that the passwords are long. I guess it's secure, though. edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.
This means that if a breach reveals more than one of your passwords, the pattern is easily recognized and you just made ALL your passwords extremely weak. Not a great idea.
this is true, yes. fwiw what I do is more complicated than an append. I'll edit it to say "include", which is more accurate.
Re: The situation at LastPass may be worse than they are letting on
#57Earlier quoted context omitted.
I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.
PigSty's Razor
I suppose this is how such things start.
Re: The situation at LastPass may be worse than they are letting on
#58If this is true there really is such low hope for cryptocurrency. If you can’t store your keys in a service like LP hardened via physical 2FAA. What’s left? Air gapped setups?
Passwordless might be the way to go. We (as a society) have been trying to do 2FA now wherever we can. 2FA can involve an authenticator app but it is easier with a physical key. That physical key by itself can obsolete the password for many uses.
The more numerous the places where we can abandon passwords, the fewer the secrets that we need to keep.
Re: The situation at LastPass may be worse than they are letting on
#59Re: The situation at LastPass may be worse than they are letting on
#60I've been using LastPass for years. Looks like I'm going to have to export everything from my LP vault and import it into Bitwarden. Any downsides to Bitwarden that anyone knows of? I'm asking more about convenience, i.e. how well the browser extensions and Android app work and less about security.
Switched from LastPass to Bitwarden some time ago. The only issue I had thus far was exporting the contents out of LastPass. Some of the special characters in some passwords did not export properly. I had to add those items by hand.
As for Bitwarden, I like the UI (iPad, Mac, iPhone) but routinely forget how to generate a new password - the function is buried inside one of the menu options. Other than that, I really like it. And, there is option to host your own vault.