Which is your preferred password manager software? 2nd Edition. New and improved

OAT said:

Good little survey you have going @kelper.
Multiple choice answers for your next release?

I use the browsers backed up by Keepass.

Click to expand...

No, you can't have more than one 'preferred' password manager!

I am trialling Bitwarden and Roboform, but I will end up with the cheaper one.

No, you can't have more than one 'preferred' password manager!

Click to expand...

He rejected me...
Just as I was yesterday for Valentine's day...
What a life !

@ OAT

Please create a poll and you will see that you can't please everyone! San Diego looks great from a cruise ship - especially at night, on sailaway!

TraderGary said:

The forum members have certainly put a different slant on the poll after the LastPass breach. LastPass is currently down to only four votes, including mine. I wonder what effect the breach is going to have on the 33 million subscribers to LastPass? I mentioned it to a friend and the response was "what breach?".

Click to expand...

I have a sticky note by my PC that says Last Pass 3-17-23....which is the day that my subscription renews. I've been doing some testing on the side of 1password, bitwarden, and keeper. Bitwarden has been a little too finicky for me in it's ability to capture the password and save to the vault automatically. While I can technically do it on my own, I'm afraid my other less technical family members won't and therefore would resort to reusing passwords. Keeper looked good, but it gets pricey. Not sure I need it's extra functionality. I'm still considering 1Password.

Honestly though, because of my password complexity with LastPass, I am personally not too worried about anybody getting into it. And I think any of the others could be targets as well and we end up back in a similar boat. So, I'm still leaning towards staying with Last Pass.

Yes, I agree. I emailed LastPass to see if I could resurrect my account as it would have expired in April. I know they can't restore my vault, but I had downloaded it. I just wanted not to have to take out a new subscription. They never replied.

kelper said:

Go to Steve Gibson's website to see which passwords are hardest to crack, you'd be surprised.

Click to expand...

Pleasantly surprised. This was a password contructed the same way as my email password.......

kelper said:

Yes, I agree. I emailed LastPass to see if I could resurrect my account as it would have expired in April. I know they can't restore my vault, but I had downloaded it. I just wanted not to have to take out a new subscription. They never replied.

Click to expand...

You can just imagine the number of questions and requests that LastPass must be getting.

Did you try logging in to LastPass with your Master Password to see if it still worked?

TraderGary said:

You can just imagine the number of questions and requests that LastPass must be getting.

Did you try logging in to LastPass with your Master Password to see if it still worked?

Click to expand...

Yes

And did it work? Do you still have LastPass?

no

Well, pshaw! I'll bet when you were pissed with LastPass you asked them to delete your account?

kelper said:

I'm trying to remember why I abandoned Roboform, maybe when I had to pay, reviews say it is still the best at filling webforms.

I am using Bitdefender at present, but am sorely tempted to try Dashlane and 1Password. My vault data cannot be decrypted UNLESS someone discovers my Master Password. I now believe that all password managers are secure and it is our web browsers that might leak our master passwords.

LastPass is just as secure as any competitor, in that it uses open-source, AES-256 encryption.

I checked my password on Steve Gibson's site and it would take hackers billions of years to guess, so that is not the vulnerability that bothers me.

GRC's | Password Haystacks: How Well Hidden is Your Needle?

Password Haystacks: How Well Hidden is Your Needle?

www.grc.com

CONCLUSION stay with LastPass

Click to expand...

Roboform...lololol. Wow thats so 20 years ago..lol. I used to use it as well.

This is based on what my Lastpass password was before I changed it around Christmas 2022 and a few days later deleted the account.

Do I feel confident my data is safe? For the moment, yes. Fingers crossed.

Post deletion, the >1 decade old account was restored by LP support at my request but without the data. So I am not sure whether these guys can really restore a deleted account + data. Not going back to LP though.

I have since moved on to BW and 1Password with Dashlane and Keepass(XC) as backups.

I first tried Bitwarden and then 1Password. I'm staying with LastPass. I have full confidence in the security of my Master Password 26 character passphrase. They're all using the same Zero Knowledge Architecture and the same 256-bit AES encryption anyway and I now have confidence in how it works if there is an actual breach!

In general I agree with you TraderGary however, in many attacks it's not always the data or the program that is attacked. In some cases there are attacks on other components. BlackIce from decades ago had an exploit that allowed access through their encryption remotely. Many systems were compromised due to that attack.

My concern is what is going on over at LastPass. This is now something like the fourth breach in the past few years. If this was there first time one could easily overlook it, but when you're in the news for the fourth time and you have reports of embedded trackers in the LastPass Android app, that does does not build confidence in the product for anyone. It just makes it seem like they're not paying enough attention to keeping their own house in order so to speak to make things comfortable for their customers. What if the programmers make a mistake that opens your data vault wide open to exploit simply because they were not doing good enough security, testing and quality control on their programmers.

Obviously it is your choice and I'm sure you know what you're doing but if I were a salesman it would be quite difficult to sell LastPass over some of the others that so far have not had these issues.

Due to the approaching lower cost of quantum computing and an article that recently shows that even though quantum computers are not designed to really run x86 code that they can now emulate at least some of it, there may be a time in the near future where cost allows those with large resources to use that technology to decrypt many passwords. I think your 26 character Master Password should be okay, but I've recently updated mine to 35 character +

I've not needed to share passwords online in the past so I've used Keepass now for over twenty years. I unzip and use the program, I don't install it. Recently the wife has wanted some passwords so I've gone with 1Password for the few to share with her. The vast majority of other passwords I keep in Keepass

I don't use the Steve Gibson site but I have used this link in the past for review and testing.

kelper said:

I'm trying to remember why I abandoned Roboform, maybe when I had to pay, reviews say it is still the best at filling webforms.

I am using Bitdefender at present, but am sorely tempted to try Dashlane and 1Password. My vault data cannot be decrypted UNLESS someone discovers my Master Password. I now believe that all password managers are secure and it is our web browsers that might leak our master passwords.

LastPass is just as secure as any competitor, in that it uses open-source, AES-256 encryption.

I checked my password on Steve Gibson's site and it would take hackers billions of years to guess, so that is not the vulnerability that bothers me.

GRC's | Password Haystacks: How Well Hidden is Your Needle?

Password Haystacks: How Well Hidden is Your Needle?

www.grc.com

CONCLUSION stay with LastPass

Click to expand...

I am using BItwarden which is what I think you meant when you said Bitdefender. It's free and it does a great job and I ditched Lastpass when they started putting restrictions on their free version for multiple devices and then they were hacked.

Sorry it's still not safe to use

The honest answer is no, LastPass is no longer safe to use after the most recent breach.

Click to expand...

If you are using a password manager, you must understand what "Zero Knowledge Architecture" is. Once you understand what it is and how it is used you will understand that the media hysteria over LastPass being unsafe is actually nonsense. If LastPass isn't safe, then no password manager is safe, because they all use industry standard "Zero Knowledge Architecture".

TraderGary said:

Zero Knowledge Architecture

Click to expand...

If the company is lying to their customers , why would anyone still trust them? They have betrayed our trust, that's a deal breaker for me.

“LastPass’s claim of ‘zero knowledge’ is a bald-faced lie,” he says, alleging that the company has “about as much knowledge as a password manager can possibly get away with.

Click to expand...

“I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no — with LastPass, your vault is a plaintext file and only a few select fields are encrypted.”

Click to expand...

LastPass’ December 22nd statement was “full of omissions, half-truths and outright lies,”

Click to expand...

And from the comments section in this article by users, one popped out at me and I spilt my coffee !!

I moved on from Lastpass in 2018 and deleted my vault (but kept my account).

After the hack I thought I’d check in on my account and delete that too. I logged in and there’s my empty vault…good.

Underneath is the “deleted items” vault replete with text up the top saying “Items in theis vault are permanently deleted after 30 days”.

And what do I find in this vault?

All of my passwords. Deleted in 2018. All of them.

Click to expand...

You're quite free to believe what you like. Quite frankly, I don't really care. I'll continue to use my LastPass as I have for the past 10 years.

I'm not happy with the way LastPass really handled the disclosure. But I don't think this makes them any less safe than anybody else. I dont' really care for bitwarden and 1password and Keeper will cost me a fair bit more than LastPass. Like @TraderGary, I think I am staying put with LastPass. I like how it works and my family all uses it.