Hacker News Reader

For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass.

Just one example (this one from 2017) of many: https://bugs.chromium.org/p/project-zero/issues/detail?id=12.... Fundamental architectural flaws.

For more HN references, see https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

View on HN

Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations:

"KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them."

Asked about the experience he had reporting a 1Password vulnerability, he says:

"Astonishingly bad"

(source: https://twitter.com/taviso/status/1167311357957435392)

Reply on news.ycombinator.com