Hacker News Reader

Comment by tastroder | Hacker News Reader

Was prepared to change all my darn credentials when clicking on that. For those clicking the comments first, the byline is: "LastPass has released a fix last week. Vulnerability details are now public. Users advised to update."

View on HN

For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass.

Just one example (this one from 2017) of many: https://bugs.chromium.org/p/project-zero/issues/detail?id=12.... Fundamental architectural flaws.

For more HN references, see https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations:

"KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them."

Asked about the experience he had reporting a 1Password vulnerability, he says:

"Astonishingly bad"

(source: https://twitter.com/taviso/status/1167311357957435392)

Your comment implies that you're no longer changing your credentials?

Perhaps they mean just not all of them Right Now.

Yeah, that and especially not all the nonsense that's stored in there at once. I kind of wanted to migrate away to something local I'd also trust with mail and banking credentials but lastpass is one of those things for me that works just well enough to not push me over the edge to actually change anything.

Reply on news.ycombinator.com