Hacker News Reader

Comment by jzast2 | Hacker News Reader

https://www.lastpass.com

Free to use, auto password generation, has an iOS app with thumb print unlock (saves you from typing in a long master password).

I personally really enjoy it.

View on HN

My company uses it and I really despise it.

Basically their web add-ons are extremely buggy. I was using Firefox and after many issues tried Chrome version, that one looks nicer but is similar POS and similarly had its own set of issues. Perhaps I would be happier if there was just a standalone app that I would only fire up when I need it.

I agree. The browser plugins used to be much cleaner and snappier when I first started using LastPass a few years ago, but it has progressively gotten worse to the point of making the whole thing nearly unusable. It feels like some 4th grader tried to reimplement drop-down menus using a crappy home-made JS framework.

I stayed with LastPass through the various security incidents they've suffered, but recent UI updates finally made me cancel my paid subscription and switch to 1Password -- a standalone app that integrates with the browser through a very lightweight plugin.

I don't understand the hate against Lastpass. Why would I trade it's awfully simple features (autofill on Android, automatically save/update passwords from website forms in browser, cheap etc.) for something like Keepass, even if the latter is purportedly a bit more secure? Some people also say that Lastpass's UI isn't great, but who cares about a password manager's UI as long as it does the job?

I use it but as others have mentioned it seems the browser extensions are getting slower and buggier

>purportedly a bit more secure?

The worst bugs in LastPass are:

1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2]

2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3]

3. Last year a software engineer who wasn't a security researcher found a bug[4], which again, gives all your passwords.

4. The bug in (3) wasn't fixed properly, which lead to this [5]

Other bugs, but not as terrible as the ones I listed above

Jul 27 2016 [6]

Mar 25 2017 [7]

Jun 17, 2015 [8]

Nov 17, 2015 [9]

You are also forgetting a whole another class of attacks - Phishing [10]

[1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[2]: https://news.ycombinator.com/item?id=13924737

[3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[4]: https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...

[5]: https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

[6]: https://bugs.chromium.org/p/project-zero/issues/detail?id=88...

[7]: https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[8]: http://www.businessinsider.com/security-expert-describes-las...

[9]: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...

[10]: https://www.seancassidy.me/lostpass.html

Oh my. Thanks for taking the time to list these down. Will work right away to get off Lastpass. No, seriously!

What ever password manager you move to, chose something that will stay far away from your browser. And don't use anything that autofills your passwords. This includes KeePassHTTP.

>I don't want a subscription service, I want something that keeps an encrypted file that I can put in dropbox.

Android version also the first thing I set up on a fresh phone. Fingerprint unlock, can input passwords directly into most apps (it matches sites to apps automatically) as well as Chrome.

Keep in mind that enabling the LastPass Accessibility service in Android disables device protection features (like storage encryption).

Reply on news.ycombinator.com