Hacker News Reader

Comment by thecopy | Hacker News Reader

I just moved from LastPass to 1Password7, and this sentence will make me consider moving back:

> Surprisingly, we found that it is less secure in the running state compared to 1Password4. 1Password7 decrypted all individual passwords in our test database as soon as it is unlocked and caches them in memory, unlike 1Password4 which kept only one entry at a time in memory. Compounding this, we found that 1Password7 scrubs neither the individual passwords, the master password, nor the secret key (an extra field introduced in 1Password6 that combines with the master password to derive the encryption key) from memory when transitioning from unlocked to locked.

That is unacceptable, what type of developers do they have?

View on HN

They also address that in their response. It stems from the fact that they use memory-managed programming environments, so they don't have that level of control over memory.

If you're going to hold that against them, LastPass is just as bad:

> During a workflow to derive the decryption key, the master password is leaked into a string buffer in memory and never scrubbed, even when LastPass is placed into a locked state.

Not that storing a masterpass as sting is acceptable - nor that I readily believe that statement entirely. But why would you be using any of these without 2FA?

If it’s an interesting annecodte to you, I moved myself an 5 people in my company from 1Pass v4 to LastPass, no complaints from anyone and the iPhone integration is unbeatable.

Altogether I’ve moved 100 people to LastPass and some of those users have been not-exactly-power-users, yet, zero complaints from 100 people. A year later almost every single one is still using and the downstream effect of children/friends/kids is surely in the hundreds. They owe me a shirt or something really!

LastPass isn’t perfect but it’s pretty great for the price. What made you switch to 1P v7?

Are the people using LastPass commenting on how nice the interface is, or are they just not saying anything at all?

I have to use both LastPass (enterprise) and 1Password 7 (personal). The experience is pretty incomparable: the LastPass user interface and browser extension are abysmal, whereas 1Password is very enjoyable. On the most recent version of Chrome, the LastPass extension is slower, less intuitive and less organized than the 1Password extension. 1Password also has more features and a fast desktop application for macOS.

Note that I'm not saying LastPass doesn't work. It works...but it's an incredible pain for me to use every day at work after using 1Password at home. I think the design sucks, to put it bluntly.

I've had a few questions about interface, but for the most part it's intuitive and I've had very few questions even from older people. Not hearing anything is a good sign.

I've had none of the UI issues you have (Firefox, Safari) and have heard none from any user. Weird!

Did they do an overhaul recently? Maybe people are remembering an older version.

I had to use LastPass at work, maybe 2 years ago, and I can confirm, it may have had the worst user interface (both in terms of aesthetics and usability) of any webpage I've ever had to use. I simply couldn't believe any self-respecting developer shipped that.

I've been using lastpass for 8+ years and had a previous employer move their password management to lastpass as well (they are still using it from what I hear). I've been nothing but supportive of them from the get go. But I have to say I'm starting to get a little disappointed. While security/functionality are the number one priority, I feel like once you get those figured out you can at least try to work on the UI a little bit. I don't think that aspect has changed since I started using it and if anything it's been getting worse. I now have multiple pet peeves with it: 1. Firefox now sometimes complains about the lastpass addon slowing pages down (sounds like they don't care much to maintain their FF addon) 2. I can't turn off the login field icons while lastpass is logged out so those are always present in login forms (until I login and it reads my addon settings to turn them off) - this is probably an addon bug but see above. 3. I think the default security settings when you install the plugin are too permissive, probably in an attempt to increase uptake (which is a big no-no to me) 4. Lately it's taken multiple back and forths when emailing support because they just can't be bothered to read the initial request. I end up repeating myself a number of times before they stop responding with some canned response that doesn't apply to my support request.

I'm probably done renewing. I've been using keepassx for things like banking and trying out bitwarden for the less consequential stuff. Sorry - this turned into a rant.

As an admin, laspass is anything but great. Having to create a shared folder for every user and group is ridiculous. I will switch to 1Password teams soon most likely, although bitwarden is the new hotness these days.

Why do you have to create a shared folder for every user and group? You should be able to add any users and groups all to a single shared folder.

oh, that's a really good idea. I should put all my apps and logins in a single folder and then share them all with everyone in the company. security shmurity!

Reply on news.ycombinator.com