Hacker News Reader

Comment by dzhiurgis | Hacker News Reader

LastPass have a horrible security track record.

I’ve even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.

Not-so-happy LastPass user here: I evaluated alternatives, but LastPass is the only one which somehow works on Linux/Firefox. I have even tried to make pressure to 1password about that, without much success: https://discussions.agilebits.com/discussion/comment/410603/...

I’m using Bitwarden on budgie / Firefox. Works great.

Thank you! I'll evaluate it

BitWarden works fine. I'm using Linux/Firefox as well, the rest of the time is on Windows/Chrome. It's 100% open source: https://bitwarden.com/

I stopped using browser based password managers and switched to KeePass. It's a bit more work to pull passwords and back them up, but for me it beats trusting cloud services with security critical data.

This! I love my setup. I use KeePassXC and sync my password db with NextCloud. I love having an open source password manager that is useful across all of my devices, be it Android, Linux, Mac or Windows.

KeepassXC, syncthing, and keepass2android here.

I stopped as well, but went for a different setup: Tomb [1] and Pass [2]. There's even a combination of the two: pass-tomb [3], but I don't use it.

No cloud, only USB keys. The thing is, I lost two of these USB keys! Had to rotate my passwords ;)

[1]: https://github.com/dyne/Tomb [2]: https://github.com/zx2c4/password-store [3]: https://github.com/roddhjav/pass-tomb

Sure but good luck using KeePass across a team on multiple devices.

And you can self host it, which was what convinced me to switch from lastpass.

https://github.com/mprasil/bitwarden_rs

This is a 3rd party implementation of the bitwarden api, which gives me more confidence in the 1st party product.

1Password X works on Firefox now as well. Source: I am using it with Firefox on Linux.

I couldn't make it work (see the link above)

That link refers to forum posts for January. Firefox has only been supported officially on stable versions since May.

https://addons.mozilla.org/en-US/firefox/addon/1password-x-p...

It's now as easy as adding the extension and logging in.

It used to be horrendously broken, but it works now.

Have you tried Enpass? It works on Linux and has plugins for Firefox and Chrome. https://www.enpass.io

+1 for enpass, using it to manage and sync passwords between android/iphone/ipad/mac/linux (via dropbox). The single wart is it doesnt autofill firefox on android, you have to switch to a custom secure keyboard where you can manually fill on a field-by-field basis once you've authenticated with master pass or fingerprint. Another thing I appreciate is that there is an npm module to decrypt your own wallet; this gives me confidence that I can access my secrets if there is some problem with the app or company.

Not that it's the greatest solution, but 1Password does work on Linux using Wine.

Have you tried Pain-free Passwords?

I haven't used it myself, but it was created by Wladimir Palant (creator of AdBlock Plus extension), I believe after they examined the LastPass extension and were rather unimpressed with its security practices.

https://pfp.works/

1Password does in fact work on Linux and Firefox -- although it's not prominently advertised for some reason; I usually have to search for the page.

We have a team of developers using macOS and Linux, and we use the team functionality to manage both personal and company passwords. We made the switch to 1Password specifically because of Linux support [1].

[1] See 1Password X: https://support.1password.com/getting-started-1password-x/

I couldn't make it work 6 months ago, they answered to the issue I referenced above that it wasn't officially supported and they never sent any updates about that on that issue, so I supposed that the situation stayed the same. I wonder why they don't update their issues anyway

Yeah, by no means I am an ambassador of them. For me, it was so-so vs bad really.

They don't have a 'horrible track record'. LastPass has always had some of the fastest response times to security issues. They've had certain breaches in the past, but nothing that has exposed any users' passwords.

Might I suggest reading the following articles:

https://palant.de/2016/09/16/more-last-pass-security-vulnera...

https://palant.de/2017/03/23/lastpass-security-done-wrong

Reply on news.ycombinator.com