Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: Security done wrong

palant.de

Post reply on HN
Print view View original

81–90 of 221 posts

Re: LastPass: Security done wrong

#81

Post by fitzroy »

Sealy wrote: post #3

Interested to hear what the HN community thinks about 1Password

I've used 1Password on Mac / iPhone / iPad for years and it's one of my few must have apps. It's been great, other than a few annoyances with mobile app and upgrade pricing (sorted now, in a logical way). Syncing has always been solid and I've never had any corruption issues.

I've been tempted to do away with the extra clicks and just use iCloud Keychain and encrypted Notes, but 1Password feels like less of a black box at this point (maybe just because I've been using it longer). It also seems smarter about filling out forms than the browser-native options in Chrome and Safari — not perfect, but better. I don't use their subscription service, just the desktop and mobile app.

Re: LastPass: Security done wrong

#82

Post by zaneyard »

Blackthorn wrote: post #33

Sigh. I can't ignore the red flags anymore. Time to switch off. Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I need something like lastpass. Don't suppose there's anything out there that can import the lastpass db?

See the beauty of using program + cloud-provider is that all the cloud provider sees is an encrypted file. If one were to gain access to my Google Drive they would still have to crack an encrypted file which will take a while.

I feel like with lastpass the attack vector is bigger with all the fancy features.

Re: LastPass: Security done wrong

#83

Post by tscs37 »

ac29 wrote: post #69
icc97 wrote: post #50

Earlier quoted context omitted.

Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me. Autofills my logins and fully integrates with Firefoxes password manager so that you don't get conflicts between the browser and your password manager trying to save the same password. Also doesn't add the stupid CSS hacking that LastPass does to add their logo into the passwo…

Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox. Sounds like a huge pain compared to LastPass, as well as increasing attack surface.

It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.

Re: LastPass: Security done wrong

#84

Post by ek750 »

izacus wrote: post #29
pseudobry wrote: post #9

Earlier quoted context omitted.

I signed my family up for 1Password a month ago and love it so far. Here's the 1Password Security Design Whitepaper: https://1password.com/files/1Password%20for%20Teams%20White%...

1Password has no Linux support so it's not really a drop in replacement. Android autofill functionality is also significantly worse.

That's too bad. I'm using LastPass because I need multi platform (Linux, iOS, macOS, etc) and multi browser support. And it has very useful features such as sharing and emergency access.

Re: LastPass: Security done wrong

#85

Post by Bluestrike2 »

baldfat wrote: post #58
bigtunacan wrote: post #45

Earlier quoted context omitted.

Usability is great, but we're talking about our passwords. Security needs to be put ahead of usability in this case. If you can get both that's great, but poor usability beats having your banking and systems owned.

Why would people put their bank and other important passwords like this in a password manager? I use lastpass for over 5 years and I memorize my lastpass and my bank account passwords.

Why wouldn't the average user? The entire idea is that you'll just have to remember two passwords: your computer account, and your password manager. At least for most users, the idea that some password shouldn't be stored just opens the door to bad practices and password reuse.

For someone working on a password manager, I think the default assumption has to be that a screwup on your part will--literally--impact pretty much every aspect of a user's life. You can't assume that some passwords won't be stored.

Re: LastPass: Security done wrong

#86

Post by SubiculumCode »

dahart wrote: post #79

It must be noted that the author of this article has a competing project, and in an article so deeply critical of LastPass, it seems like a disclaimer should be prominent. Wladimir does disclose this on the previous article: https://palant.de/2016/09/16/more-last-pass-security-vulnera... As a fairly happy LastPass user, I would certainly like to know what ongoing threats there are here, and what the real-world likeli…

+1 Agree. Lastpass has great functionality imo, and I want a level headed analysis before I jump ship to a competitor.

I do wonder though if the change in ownership last year has led to a decline in quality.

Re: LastPass: Security done wrong

#87

Post by duskwuff »

rahulrav wrote: post #27
abalone wrote: post #12

Earlier quoted context omitted.

How about Enpass?

Uses SQL Cipher, which uses "Algorithms provided by the peer reviewed OpenSSL crypto library". Given all the problems with OpenSSL, I really wished they used something like BoringSSL.

> Given all the problems with OpenSSL, I really wished they used something like BoringSSL.

For basic crypto algorithms, there's little to no difference. Most of the changes in BoringSSL are in higher-level code, like TLS and certificate management.

Re: LastPass: Security done wrong

#88

Post by alexmat »

I use passwords.google.com

It works well with chromium on linux and on my android phone. It's free, has all the security of a google account including u2f, chromium integration is flawless on linux, and works well with chrome on Android.

Re: LastPass: Security done wrong

#89

Post by m3Lith »

icc97 wrote: post #50
Blackthorn wrote: post #33

Sigh. I can't ignore the red flags anymore. Time to switch off. Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I need something like lastpass. Don't suppose there's anything out there that can import the lastpass db?

Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me. Autofills my logins and fully integrates with Firefoxes password manager so that you don't get conflicts between the browser and your password manager trying to save the same password. Also doesn't add the stupid CSS hacking that LastPass does to add their logo into the passwo…

For using with FF, I'd recommend KeeFox.

Re: LastPass: Security done wrong

#90

Post by danjoc »

Blackthorn wrote: post #33

Sigh. I can't ignore the red flags anymore. Time to switch off. Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I need something like lastpass. Don't suppose there's anything out there that can import the lastpass db?

passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to use a Yubikey Neo with Android Password Store. PassFF is the Firefox plugin.

Usage: It's a git repo with passwords stored in encrypted text files. Syncing is done by push/pull the git repo. Since it is git, you have a record of every password you ever generated. Unlocking a password with a Yubikey requires a pin entry and a physical touch. Once entered, the key is available for further passwords without pin, but a Yubikey 4 can be configured to require a touch every time if you're worried about compromised hardware stealing your entire password database.

There's no import from other managers that I'm aware of, but it might exist. Googling stuff about 'pass' is tedious. Google for 'zx2c4 pass' and you'll have better results.

Post reply on HN