Hacker News Reader

Comment by benbristow | Hacker News Reader

To be fair to LastPass/LogMeIn, they're a company handling a lot of valuable information (passwords/form-fill data/card numbers/notes etc.) - and they're one of the biggest out there.

You'd expect them to be one of the more targeted companies just because of the 'treasure' they hold - hence the more security breaches.

View on HN

An “Ask HN” was just trending about this yesterday (https://news.ycombinator.com/item?id=29705957). Sounds like a good reason not to trust any third party service with my password database to me.

I’ve always taken the route of managing my own local Keepass DB & key files. Sure it’s more cumbersome, but it prevents me from having to decide whether or not to trust some third party vendor or not.

I know 100% that I’m in full control and I’ve never put my DB or key file in the cloud. I can sleep sound knowing that whatever password service, or file sharing service, somehow getting compromised, cannot endanger one of my most valuable assets

I recommend this every time a similar news item gets posted. Password Safe (designed by Bruce Schneier). I use the iOS and Linux apps and keep them synced via DropBox. Been around for years (I've been using it almost as long). Still getting updates. Still works. https://pwsafe.org

Also my password manager of choice. There's an Android app as well: https://play.google.com/store/apps/details?id=com.jefftharri....

Do they ever have a third party audit their code?

I've been doing this for years too. I recently bought two yubi keys and now don't rely on a master password for it. However now I'm scared I could lose my yubi keys.

Not sure what I can do about that.

Buy more keys, configure them as dupes and store somewhere secure but accessible given a day or so?

Still using 1password6 not trusting the cloud store.

I use KeePass with Syncthing, which works across all my PCs + Android. It's a good option if you don't want to use Dropbox or similar.

I wish there was an integrated solution for this approach. Both programs are relatively hard to use in isolation, for "civilians"; combining them is pretty hard.

Password management, afaik, still needs a zero-knowledge cloud-agnostic solution that is easy to set up and run. There are the big boys (1password, bitwarden, LastPass) and then there are local-only solutions; in between, where the sweet spot should be, there is only a bunch of hacks. The issue is monetization - the incentives for that side are towards centralizing.

>I know 100% that I’m in full control and I’ve never put my DB or key file in the cloud. I can sleep sound knowing that whatever password service, or file sharing service, somehow getting compromised, cannot endanger one of my most valuable assets

What's the risk of keeping the keyfile/password on your device(s) but uploading the database to the cloud? Assuming your keyfile has enough entropy (eg. 256 bits), your database is good as useless without the corresponding key file.

Because something like this break will happen, and the fewer suspects the better. Maybe the code to upload the encrypted version is buggy, maybe the code hits a bug that uploads the private key to Dropbox... there are all sorts of "maybes", no matter how remote. If the file never touches, eg, Dropbox's servers, then there's zero possibility the break happened because of something related to Dropbox. Maybe the keys used are weak in some manner that is later discovered.

Do you own assessment of all of the "maybes", and come up with your own conclusion and practices. Someone else's hard drive is not to be trusted, but it is convenient.

For a personal password manager, that works ok, although syncing between multiple devices can be complicated and is sort of what I do, but it is much more difficult when you need to manage shared password for a team. At the very least you need some sort of locking mechanism to prevent accidentally overwriting someone else's change. And you also probably want an audit log, admin override capabilities, ability to grant different levels of access to different groups, etc.

Pass with a git repo satisfies some of those requirements, but it isn't very user friendly for non-technical users, and fine grained access controls and groups is tricky.

That doesn’t prevent them from being open & honest about what caused a security incident and what they’ve since done to ensure they’re highly secure.

Furthermore, I’d argue that Firefox & chrome password managers probably have several orders of magnitude more passwords stored (and therefore much more highly targeted), yet they don’t seem to have annual security incidents. And you can’t even pay for those products.

People stealing passwords are probably doing it to eventually make money. Criminals could save themselves a ton of work by just directly hacking the banks, yet we don’t hear about highly regular complete compromises there.

Furthermore, if operating a password manager service puts a huge kick-me sign on your service, why don’t the other password managers have plenty of incidents?

You can search "lastpass project zero" to see a pattern of specific examples of how LastPass does not seem to have a well-organized approach to security.

once again, maybe security through obscurity is not the worst idea...

As long as it's not the only idea..

Reply on news.ycombinator.com