Hacker News Reader

Comment by clumsysmurf | Hacker News Reader

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo.

You must make sure the exported CSV file has everything!

View on HN

Too much work. At that point, it’s easier to just hack the LastPass servers.

This really hurt me last year, when I migrated away. I didn't realize at the time how much didn't come with, so I've been playing the reset / recovery game since.

I feel your pain. I switched to KeePassXC, and will never use an online password manager again.

For a password management company, they can't even be bothered to fuzz their export functionality. QuickCheck works unreasonably well on `import(export(a)) == a`.

But maybe it's intended to be buggy, in order to keep you in their walled garden. Clearly the sync between devices works, so they have solved this problem.

> Clearly the sync between devices works, so they have solved this problem.

Presumably they don't use CSV to sync, they're using a saner json/etc. data structure that they're not letting us export ourselves. Seriously, being limited to CSV in this day and age...

I keep thinking I should reset my passwords anyway (not moving of apples keychain tho) and should probably just move off using gmail at same time!

This is years ago now, but every ampersand in my passwords came across wrong. I can't recall if it was missing or url encoded, but even passwords weren't safe.

I'm still finding passwords in Bitwarden to old accounts that have `&` in them. Thanks, LastPass!

Your password is safely html encoded for distribution on the web.

Like on Hacker forums? :)

That is especially surprising, considering that passwords are more than likely going to contain special characters.

LastPass's own generator puts them in there.

Avoid such trouble is why I want to avoid using symbols for password. Just use more alphanum characters for strength.

Or just use proper tools that work.

I want to as well, but annoyingly there are many sites that insist on a "special" character because their strength measure says "low" for the 20 character alphanumeric string I generated %-}

My favorite is when they actually limit what special characters you can use. Must include 1 of x special characters. Why? I always just assume they baked their own password storage and couldn't figure out how to handle the whole set of special characters

Multiple times I've found that this is caused by a web application firewall that is intended to mitigate SQL injection attacks. So they disallow the characters that would commonly be used in those attacks.

Interesting, I had never considered that

On those sites, I generally insert the same fixed uppercase-and-symbol string on my zbase32ed-entropy passwords. Zbase32 tends to produce numbers already, and that combo tends to satisfy the silly sites.

Well, this completely explains where one of my Truecrypt volume passwords disappeared to after migrating away from LastPass years ago. Too bad the account has long since been deleted.

Also if you try to export multiple times it will start spitting out exports full of duplicates. Only safe way is to export right after a fresh session login.

Wow. Is LastPass generally just really bad software? These bugs mentioned in this subthread make it sound like amateur hour.

It's packed with enormous amount of bugs that make the day to day experience terrible.

I want to move but I'm terrified of the export process

I moved to 1password a few years ago and haven't regretted it for a second. I still have Lastpass installed, but it's probably getting to the point I can delete it.

OK, wait, you still are using some other cloud password provider?

I moved to BitWarden a year ago after a billing problem with LastPass that their support handled badly. I haven't had any problems with the migrated data and I finally deleted my LastPass account last month.

Likewise, deleted my LastPass account after a year with Bitwarden. I regret suffering LastPass’ UX for so long.

my major concern is that I have:

* custom "items", so instead of "Password", I also have my own * attachments, which I know 100% are not exported. There is a CLI app to help with that, but still horrible * I have large notes with weird characters, which makes me concerned if they will be exported properly * Last time I checked, the CSV seemed very broken (not respecting the standard), I'd be surprised if it imports properly

That's the reason why I haven't moved.

I'd move to bitwarden, but the lack of tags is too much for me. I use tags everywhere, I don't want to deal with directories anymore, so 1Password it is.

As today I attempt to perform the migration, their export to CSV outputs a CSV with 2 lines of my 700+ passwords. The HTML in the page shows a lot of items, but if I save directly from there, it's poorly formatted, it won't import anywhere.

Last I checked, they still didn't have a useful Content-Security-Policy header on their Web Vault (which would prevent XSS), and also didn't have a way to separate "being logged into the extension" from "being logged into the Web Vault".

I... would definitely not recommend them, no.

The UX is surprisingly bad, and has been for a long time.

It’s the worst desktop software I’ve used in several years. The UX makes no sense, it’s full of bugs, it performs badly, they’ve had multiple breaches. I can’t think of a single thing it does that’s even approaching average, let alone good.

I just exported my own vault with the latest version, it was ok for me. I have plenty of passwords with all kinds of special characters. Still, be sure to review the CSV file. If anything looks weird, double check that the password is the same in your LastPass vault. As with all backups/exports, you should always do a sanity check of the data.

One issue I ran into: the CSV file that "downloaded" in the browser didn't have all of my passwords, only about ~20 of ~400. I had to copy and paste the CSV text in the browser to a new CSV file with a text editor. But upon reviewing that, the format of the passwords was fine.

I had a problem not with the password data but with the content of some notes (or whatever it is called in LastPass)

I have been a paying customer of Lastpass for about 15 years. I moved to Bitwarden for all sorts of reasons. I work in technical information security so it was also for that teason (but not only)

We were considering self-hosting but sadly Bitwarden is still stuck on MS SQL ;/

There was some apparently compatible rust implmementation in PostgreSQL tho...

Have you tried Vaultwarden? (Ex bitwarden_rs). It is in Rust and it's absolutely fantastic.

I self host it for a year or two and it is a single container. The BW officer docker distribution is a nightmare.

Add to that a proxy with caddy and you get a great solution.

> the password export malfunctions

oh wow, what a surprise.

I migrated from LastPass years ago and ran across this error. Sounds like they still haven't fixed it.

Man, outputting data to a CSV is a very difficult computing problem. /schadenfreude

Maybe I lucked out? I migrated to Bitwarden early this year and so far all of my passwords have worked. I also made sure to compare the site entries in both. One thing that can't transfer were attachments in LastPass secure notes. So I had to download each one individually and upload them to Bitwarden.

Is it obvious that it failed (e.g. displays an error), or does it just silently skip over the entry?

Uh oh, now I’m paranoid my LastPass export didn’t have everything, and I deleted my account years ago

Personally, I'm more paranoid concerning whether the deletion actually worked when I deleted my LastPass three or four major security incidents ago...

You should probably change all your passwords anyway..

If you look at LastPass page in wiki, someone from LastPass org keeps deleting the incidents.

https://news.ycombinator.com/item?id=15756044

Yeah, in any migration—if you can—it's good practice to run both simultaneously for a while until you're convinced you've checked everything and you're ready to drop the old for the new without much downtime.

What would be considered a good alternative?

Bitwarden, Keypass and 1password seem to be some of the most popular ones.

Bitwarden is great. There is even an opensource implementation of bitwarden server you can self-host that includes premium features for free.

I'm curious what did people migrate to, and is there any feature disparities?

1Password. The largest feature disparity is 1password is designed and built by competent engineers. The history of breaches and technical mistakes Lastpass has made over the years is amazing for a tech company let alone a password manager.

How is the user experience though? "Designed and built by competent engineers" is reassuring in the face of security breaches, but often means it's less convenient to interact with on a day-to-day basis.

1Password has the best UI/UX of any that I've used. It's clean, pretty, and solid in my experience. Honestly it's a joy to use which I prioritize in the software I choose to use daily.

I've tried LastPass, 1password, and Bitwarden. Bitwarden has been my favorite as I can selfhost it if I want (open source fork with feature parity)

But do you self host it?

Yes, I do.

Used BitWarden for years, happy with it. Recently switched to Nord Pass, also happy with it. Not sure about feature disparity though, just mentioning some ideas in case you're researching alternatives.

Any specific reasons for the move away from BitWarden, or move to Nord Pass?

My wife and I switched from Lastpass to Bitwarden early this year. Glad we did, considering all the news! Password sharing is different, since you have to make a group/organization and share the password in there. But once that was figured out, it's been a better experience with less bugs. It doesn't look slick, but it's more functional.

It also didn't export attachments when I used it (long while ago now though)

Is there an api to fetch all the data instead?

Being that the blob is never decrypted off your local machine, it would have to be a local data API.

That's fine too!

They seem to have a CLI to export attachments!

Reply on news.ycombinator.com