Which is your preferred password manager software? 2nd Edition. New and improved

pparks1 said:

I'm not happy with the way LastPass really handled the disclosure. But I don't think this makes them any less safe than anybody else. I dont' really care for bitwarden and 1password and Keeper will cost me a fair bit more than LastPass. Like @TraderGary, I think I am staying put with LastPass. I like how it works and my family all uses it.

Click to expand...

Agreed. I downloaded and tried using Bitwarden and 1Password. I didn't like the way either of them worked, particularly in the way they handled family accounts, which is very important for Kate and me.

It appears that the handling of the disclosure was because they were learning what happened in an ongoing basis. They apparently did as well as they could. From reading their security blog, they've already made security changes. I like that they are operating under heightened awareness.

Zero Knowledge Architecture worked exactly as it should. The bad guys got nothing from me. I have a secure 26 character Master Password and I'm very comfortable with LastPass.

How do we know all the other password managers haven't been 'hacked'? We don't.

Well I have bitten the bullet. I have subscribed to RoboForm. It tells me I have 50 compromised and 126 weak passwords. I have a secure backup and decided to delete all my vaults, identities - every thing and start over.

Deleting everything in RoboForm is oddly slow

Yesterday, in preparation for changing every password, I logged into Roboform's website and changed my master password. Later, I deleted all password, identities and safenotes. Later again I clicked on the extension in Brave and it would not accept my new password, but it did accept my old one! Lo and behold, all my passwords, identities and safe notes were still there. They must be cached locally.

I would have thought the extension would at least test my master password for currency.

This could be a big risk if the phone was lost, as the old master password was poor. (I was only testing Roboform until then)

The samething happened in Edge extension. It wasn't until synching had been initiated by me that all was well.

Each time I log in to a site now I either take the password from my spreadsheet if it's long and random or I log in and change it.

This is better than trying to update 162 in one day.

Can this get any more ridiculous for LastPass? 🤣
Are they running this business from their bedrooms?

Yeah I used Dashlane when I started to use a dedicated password manager. At the time I was using it I wasn't 100% happy with some of it. Like auto fill not always working. Or it just didn't align correct to the cells. And if I remember correctly the UI at the time wasn't the greatest. I then saw a review of Roboform and tried that out for a few days. It worked way better. Smoother. Seemed better integrated with both iphone and Windows. Auto fill actually worked most of the time. And I liked the UI way more. So I switched over to Roboform paying for a 3 yrs upfront. Cut to 2 yrs later I'm still happy with it.

Stigg said:

Can this get any more ridiculous for LastPass? 🤣
Are they running this business from their bedrooms?

Click to expand...

LOLing that the entry point was another piece of software I consider garbage, namely, Plex. I regretted purchasing the iOS and Android apps years ago because they never worked worth a damn for their intended purpose. If someone ran a poll on media software to use, my vote would go to Kodi, and I'd further recommend staying with the default skins, addons, and using it for playback of local files only. My password manager recommendation is KeePass all the way.

Again, I don't think the new articles show or prove anything as far as LastPass being any more susceptible to attack than any other password manager. If you allowed or were not diligent to protect your computer from a malware attack that inserted a hidden keylogger then you cannot blame LastPass for that.

However, that sure paints yet another ugly picture in public for the company that most people will not care to check into the details and realize that same scenario could happen to any other similar program.

But as I said before, trying to sell a new user on LastPass with so much negative news articles would be very difficult.

I'm also with barreleye on KeePass - it has stood the test of time for me. I don't recall the exact year I started using it, but it was probably around 2004 or so. I don't share or save anything in the Cloud or online which may not work for others but it suites my needs just fine.

Stigg said:

Can this get any more ridiculous for LastPass? 🤣
Are they running this business from their bedrooms?

Click to expand...

The guy writing the article for arstechnica claims an anonymous LastPass employee as his "information" source.

I was waiting for years to study the question of password managers, waiting to do later, one day, etc. "because it's complicated", like many people.
About three months ago I looked at Bitwarden. I saw that everybody was praising it on the web.
It has been an Internet life changing turn for me.
A fantastic and indispensable tool that made my internet life lighter, faster, nicer.
it's just amazing :)
I talked about it to my close friends, but... they don t take the step. "It's complicated... I will study that may be later, one day.. " :) :) :)
I wish I did it years ago.

A short article on LastPass' latest statement on their security (and more importantly, disclosure) failures: https://www.ghacks.net/2023/02/28/l...nalysis-of-hack-into-password-infrastructure/

and now this: The latest LastPass fail came from an employee's home PC

Covid-19 had literally everyone working from home.

So I'm using Bitwarden and, I have been for a few months now. When Cyber Security started getting more serious, meaning that people started working from home AND you had to get more serious with Passwords and such, I decided to finally bite the bullet and go with a password manager. The 1 thing that I like about BitWarden is first off its cross platform. Also, the password manager in iOS is easy to use as long as you associate that as being your main password manager and not the one that comes with iOS. Also, you can put it on any browser and for $10 a year, who can complain?

safron said:

and now this: The latest LastPass fail came from an employee's home PC

Click to expand...

Yeah, i work from home 3 out of 5 days a week nowadays. At my job, i have to carry my laptop back and forth to the office and it's provided by my employer. They control the security on that machine, and i use it for work purposes. I'm not allowed to install any software on the machine that doesn't come from our own software system at work. It's for reasons just like this. That's also the reason I have not tried whatsoever to get VPN capabilities to the office from any of my home machines.

Honestly, a breach of this nature actually makes me feel more comfortable with LastPass. It wasn't a hack directly onto their network that went undetected. Having a backdoor from a third party software used to install a keylogger and gain access via an employees home machine is something that can just happen to really anyone.

What makes me comfortable is the industry standard "Zero Knowledge Architecture" and AES 256-bit encryption that all password managers use. As long as I have a secure Master Password, the bad guys have nothing from me.

Well, they have all your urls and email addresses! Could help them with social engineering.

kelper said:

Well, they have all your urls and email addresses! Could help them with social engineering.

Click to expand...

Their knowing a few URL's does nothing for them. All passwords have now been updated to 20 characters. LastPass are now doing end-to-end encryption of vaults. I'm quite comfortable going forward.

Are your passwords machine generated? My master password is made up of dictionary words but as they are merged, a dictionary-based attack won't work.

Yes, my passwords are all machine generated. My current Master Password is a very secure 26 character passphrase.