LastPass: Security done wrong

I use bitwarden. It's open source and works in browser and on phone. I haven't done any auditing myself, so I guess it's a leap of faith in that regard, but it's working great thus far.

It can import from a lastpass file.

Even though it's open source, there is a hosted instance (so the experience is much like lastpass). There was a kickstarter a while back that failed though, so I'm unsure how it's funded.

I just noted that my lastpass extension was updated by Firefox. Is this fixed?

I've struggled with this too.

I love how I can share passwords with a team using LastPass (share just access, share ability to view, share ability to edit). For me... it's more about getting the team using the right tool than individuals. There are probably better individual solutions than LastPass, but I don't know of any that are better for teams. I know that having a tool that lets you share passwords is inherently risky... but I still think LastPass is less risky than people sharing via PostIt, or sharing via emails... or less risky than not sharing passwords in that "hit by a bus" scenario we always talk about.

I tried Enpass, 1Password, and KeePass for individual use... none of them were horrible (I liked 1Password the most). Enpass let you sync your vault with the storage option of your choice... so you could sort of do team passwords that way. Typically I don't want to share all my passwords, just a few... and like I would want to share different subsets with different people... so that "share your vault" option wasn't ideal for me.

Usability-wise, I love how LastPass fills in my credit card info and address on forms I tell it to. And how LastPass can automatically update passwords for many common sites. And gives me a report of passwords that are weak, old, and duplicate -- the "global rank" on LastPass is a game and I want to get a high score. Ha. (Full disclosure, I tried each casually for less than a week... there may have been things I missed.)

Been on LastPass for a long time, generally happy with them and haven't found anything that better fit my needs, but clearly these reports that they aren't taking security as seriously as they should be are troubling.

EDIT: Going to look at https://1password.com/teams/ in the next week or so. I don't think this option existed last time I looked at 1Password.

I've been using LastPass for a few months and have loved it, but maybe I'll consider switching to 1Password.

However, can I just rant for a second about how these security assessments and blog posts fold out? The beginning of my career was spent thinking I was going to go into this field (one of my degrees is in Information Assurance) and the #1 thing that persuaded me to switch to building software instead was the attitude and approach of the security field.

If it's not 100% secure and we all agree that it's the 100% best way to do something, it's the end of the world and anyone using LastPass is an idiot who will have all of their passwords hacked and their life ruined. (Remember when the draft for client side storage was announced? You would have thought armageddon was upon us based on the reaction of the security industry.)

Big picture here -- most people re-use a short, simple password on all of their sites. Using a password manager, even one with a few things that it can and should improve, is a HUGE step in consumer behavior. Bickering amongst ourselves and boasting for crapping on someone's company is not the right approach to increasing our entire society's security stance.

Want to actually help?

1. Create more resources to help consumers pick, use, and adopt a password manager with super simple setup process. Even the current methods that all password managers use of generating, saving, and autofilling passwords are too complex and cumbersome for the average consumer. Heck, even MFA is seen as a huge waste of time and barrier to logging into people's accounts by the majority of people right now.

2. Create more resource to educate developers of these services, helping them to see what they should do and how they should do it, not bragging about your ability to tear down a service they spent hours slaving over. Get over yourself and actually help society. (https://www.owasp.org/index.php/OWASP_Guide_Project is a great example of this)

Looking for an example? Apple's iTouch. Yes -- it's not the most secure option. People leave their fingerprints all over the place and they can be lifted and used to unlock a phone. But look at the other option -- using no passcode, or a 4 digit passcode that's easy to guess or look over a shoulder. Is it the most secure option? No. Does it raise the level of security for our society as a whole by providing a realistic security barrier that the average consumer can use? Yes.

It's encrypted on the lastpass "cloud" too. The point of it being integrated is the user doesn't have to take action to download the encrypted DB; the software does it for you.