Hacker News Reader

Comment by Flimm | Hacker News Reader

LastPass is so buggy, I have a draft blog post that I'm going to publish some day listing the dozens of bugs I've found. It's still the least worse cross-platform password manager (with sharing and sync features) that I've tried.

Bitwarden looks interesting, but it doesn't seem to support team features, nor does it seem to have any documentation, or even an "about us" page.

View on HN

I'd either need Bitwarden to take some money or be fully open source and I have to provide the cloud storage. Being "free" but still clearly costing them real operational money (even if not much) is not something I will plan on being there in 5 years.

I don't necessarily need LastPass to be there in 5 years, since I can export and recover what I need into another manager if I need to, but I personally don't want to go into something that is set up right now to not be there in 5 years.

This is not a permanent objection forever and ever, amen. If my objections go out of date, I'd consider at least trying it.

Hi there. I'm the lead developer of bitwarden. bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future which will allow us to monetize. For now though, everything is free for users.

Thank you for your reply. That does help out some.

I hope you appreciate the joy of customers demanding to give you money, and what it means to your business. :)

Can I suggest that you explain this on the website? I visited, could see that you had a cloud sync but couldn't see how you make money and left because it didn't add up.

Of course, that BizSpark money has an expiration date and, in the meantime, you're trying to figure out a business model. I think the concern is that you don't have one today, so who knows if you'll come up with something that pays the bills down the road.

So I decided to email them about how they are funded and this was the response :

Hi there, bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future which will allow us to monetize. For now though, everything is free for users.

Let me know if you have any other questions.

It's like some kind of broken record...

Tell LastPass about the bugs you find. They seem to fix bugs pretty quickly once they find out about them.

he doesn't really have any, just a "draft blog post" that will be published "some day".

Here's the draft, which as you can see, isn't very polished (without the screenshots). I think you can see why I've procrastinated on it. Also, I have reported a couple of the issues to LastPass, and they've acknowledged one and fixed none.

- Clicking "Export CSV" does absolutely nothing

- If you have more than one two-factor device, it forces you to use the Yubikey, you can't log in with an alternative second factor

- Asked me to log in, and then when I logged in, it complained that I was already logged in, and forced me to log in again

- You can't have individually shared items within a shared folder

- The UI for permissions is confusing, checkboxes should grant permissions, not take them away

- Moving an item gives this error: "Sorry, this request is taking longer than normal", but the edit dialog stays as it is

- Just because you've added someone to a shared folder doesn't mean they have access to all the items, they may only have access to a whitelist or a blacklist, it's not clear which until you click through

- There's a "(none)" folder, which is confusing, as you can still select the parent folder.

- The free trial of Teams expired, but no visible effect on anything

- On Dec 21, 2016, I get this message: [screenshot]

- When you convert a folder to a shared folder, you get this message, which is not true: [screenshot]

- I get this error after sharing, even though "Shared-Email" does not exist, as I just deleted it! [screenshot]

- LastPass Android doesn't let you edit stuff offline

- LastPass browser extension prompts me for Yubikey more frequently then every 30 days, despite ticking "30 days"

- Keyboard shortcuts just don't seem to work on Firefox on macOS. Also, the help documentation doesn't mention that the defaults seem to be different.

- "Find duplicates" didn't find duplicates, one when one was in a shared folder and the other wasn't.

- This error message when I try to share something: [screenshot]

- When a user in the team forgets their password, they get removed from the team for some reason, without notifying admins.

- When trying to use LastPass on Safari, I get this error: "Something blocked LastPass"

- After creating a shared folder, I get this error. It's very unclear what cancel is meant to do. What is actually does is cause a spinner to appear for ages, then for an error message to appear saying the "request timed out", then a folder called "Shared-Email" to be created which is empty.

- Searching for an email address simply doesn't work

- This is so confusing. My trial has ended... [screenshot]

- I changed a permission, and I got this email. What is "Super Admin Shared Folders"? [screenshot]

- When I tried to add a user to LastPass Teams, I got this error message: "error: undefined" [screenshot]

- The users have a circle next to them with a letter in the middle, representing the first letter of the email address (not the first letter of the first name!)

- It added person X, but then forgot her after she attempted to add a personal account, and none of the passwords showed up

- It forget X's full name

- If you invite someone by accident to a LastPass team, there is no way to uninvite them, until they have accepted the invitation

- If you invite someone to join LastPass Team and they already have an account, the only way to join is by clicking on the link in the email. If the email ends up in Spam (which it did for us), you are not notified in any other way (for instance, when logging in to lastpass.com)

- If one of the admins make another user an admin, none of the existing admins are notified

Clicking "Export CSV" does absolutely nothing

Works for me. Guess that draft is really not ready for prime time and your musings are at least partially FUD.

"It works for me, therefore it can possibly be broken for any other user, despite them potentially using a different OS/revision/etc" /sarcasm

To be fair though, he was replying to somebody who essentially said "it's broken for me".

I was being sarcastic. Post edited to reflect that

I can answer at least one of these with a link:

Super Admin - Shared Folder: https://lastpass.com/support.php?cmd=showfaq&id=8096

While I haven't used 1Password on Windows, it's come a long way in the last year or so, so that it's now a first-class cloud-based password manager with sharing, sync, and cross-platform clients, as well as the ability to belong to multiple organization-level accounts at a time (great for us serial entrepreneurs!). 1Password's Mac browser plugins actually communicate with the native client running in the background and doing the heavy lifting, which I think is a better security model as the plugins only need to worry about securing the localhost communications channel, rather than securing any data caches or doing any cryptography themselves. I've left LastPass entirely, and good riddance.

Do they have a Linux client now? I recently switch from 1Password TO Lastpass due to lack of a Linux client.

It functions well enough under wine. A native client would be lovely, but I gather they don't see it as a priority.

There is a somewhat limited functionality Lua script [0] that will decide the vault, limited but works.

Wine works too.

[0]: http://www.lucianofiandesio.com/1password-in-linux

Not yet which is a shame. I want to use the chrome extension when on my dev machine.

Wine is not an acceptable workaround for using 1Password. Either they write and release a Linux client, or I don't pay for their service.

Then continue to enjoy a sub-standard password manager.

Edit: When the 1Password app under Wine functions better than the native LastPass app on Linux, I think it's time to rethink some priorities.

Good for you.

Unfortunately as of October it's not a priority for them: https://discussions.agilebits.com/discussion/66916/1password...

I really want to love LastPass, I think all the pieces are in place, the UX is underwhelming though. We have been using it at the company for years, and I agree that it feels very rickety.

Can't even begin to count the # of times it lost a newly generated password, or it failed to swap the password for a website, or didn't immediately show a password I just created until I did a full refresh, or it has opaque rules about what can be shared with teammates. Would be great if they put more focus on getting the fundamentals right before expanding the feature set.

Just to clarify: You're talking about Lastpass here? For myself, Lastpass has just been an absolutely terrible user experience, with many of the issues you're talking about. I have this obscure ritual I have to go through when generating new site passwords -- like generate one in a new tab, then go manually "add site" and input the information -- because Lastpass can't get it together.

Thats exactly what I do for generating a new password.

LastPass always thinks I want to replace credentials for subdomain sites. all the time.

When I have a password saved for foo.com And then I try to save a password for bar.foo.com. LastPass, for all that is holy and good in the world, stop assuming I want to replace my password for foo.com damnit.

maybe the ui is not great, but as far as I know you are asked every time (in a not very visible way that probably defaults on replacing the previous): if I'm not mistaken if you look at the very bottom of the save dialog/page there should be a dropdown that allows you to create a new entry

Yeah, LastPass. I sometimes copy and paste the auto-generated password just in case it loses it. I've had many occasions where it would flat out drop it after I save the site and now I have to immediately password reset because the password is nowhere to be found.

Yeah, I have had the same experience. I always end up copying the generated password.

This and the respondents' experiences below have been my experience too. If they can't get the basic UX right, I doubt they got the security right (they didn't: http://lifehacker.com/lastpass-hacked-time-to-change-your-ma...) and I'm not sticking around to find out. I switched to Enpass instead.

Would love to find an alternative that works for larger teams vs being meant for one individual at a time. LastPass has that functionality, big part of why we use it.

Least worst? What are the issues with 1Password?

Is there a Linux client now?

Pricing model

Lack of linux client (which I suspect are more likely to pay for a password management system)

man, try 1password or enpass. The user experience across windows/osx/android/ios is so much better than last pass ever was for me, and they don't host my data. Linux support is iffy and unofficial at best though.

Reply on news.ycombinator.com