LastPass notifies users of yet another data breach
9to5mac.com
9to5mac.com
The way to stop this is to have actual consequences for the decision makers here. You can build high-integrity software and some fields (avionics) have done it. But the organization needs to be built from the ground up to do it and nobody's going to do it if you can just get breached and offer a phony apology over and over again.
Crowdstrike had a famous incident and is still probably #2 in the cybersecurity world. Sometimes assessing risk is a funny business.
Because savings are promised. And who could say no to AI? (/s)
There's always some risk mitigation possible but it's costly or inconvenient. Companies pretend the risk is lower so they can do whatever they wanted to do but now with less accountability. The risk matrix says so.
But sometimes the tradeoff is genuinely not worth it. The bottom line is that each company has to do it's own calculations and decide whether moving is overall a better choice. Which risk is higher, that your provider is breached again or that you have new operational issues with the new solution. Which costs more, a chance of another security issue, or the guaranteed expense of replacing the solution? You do the same math at home all the time. Your washing machine leaked once, do you replace everything or just patch the hole?
If you want to be a security vendor reseller, just make sure to sell to orgs that have a compliance requirement, either by law or similar.
Do you sell firewalls? sell them to banks or something. Anti-malware endpoints? Insurances too. SIEMs? payment gateways for their PCI DSS environments.
Price it just below what would be the fine for not complying, that way you maximize the invoice.
I stopped playing the security vendor reseller game because it got too boring this way to make money.
With something like LastPass it's also much easier to create unique strong passwords for other sites.
Also, let's be real:
> The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.
I'm pretty sure 99% of the people on exposed have already had their names, phone numbers, email and physical addresses leaked already. This has nothing to do with the security of your passwords stored in LP. They have some CRM, some person from their 800 employees clicked a sketchy link and it leaked that. It's not good, but its hardly an indictment of their product or usefulness
Yeah but wanting a product like LastPass doesn't require that you use LastPass. There are many good alternatives.
I don't get how you think some other competitor would be better suited against this threat. The right solution is to mitigate the damage. CRM has minimum available stuff, like names, addresses, etc. Don't keep stuff like payment information, passwords, etc in that place as that's the vulnerable system. It seems like that's what LP does and probably every other company in this space does.
Again, it's entirely reasonable to have an off the shelf CRM, pretty broad access to it. You try to prevent phishing email or phone scams (assuming this is what it was) but you have 800 employees, its bound to happen.
Use any of the other password managers that don't have the poor security history that LP do.
By all means, have a CRM. But consider that it probably doesn't need to be as broadly accessible as you think it does, and consider that the people with access to it probably need to be held to a higher standard.
Would you be okay will a public database of all people's names, emails, addresses, phone numbers, and other contact details? After all, most people's data have already been leaked somewhere. Credit reporting agencies have leaked more sensitive data. I, for one, still expect companies to keep my private data private. Especially companies who's started purpose is to keep my secrets secret. It's a bad look for them and if I trusted them this would make me lose my trust in them. But, they already lost my trust two or three (I lost count) breeches ago.
Since we still use SMS as second factors (or primary, as some in this thread said they don't write down passwords but just use password reset links to login), it's not the best security hygiene
The damage is already done. Your private information was already leaked long ago. You can't make a sunk boat more wet.
better expect companies to never know your private data
What you are describing is a password manager. No one here is questioning why people would use a password manager. That's like asking why people would use a toothbrush. The question is why anyone would use LastPass as their password manager.
> Also, let's be real:
> > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.
> I'm pretty sure 99% of the people on exposed have already had their names, phone numbers, email and physical addresses leaked already.
I'm sorry to put it so bluntly, but this comment strikes me as really baffling.
LastPass has a very long history of breaches, some of them very severe with a big fallout. It's at the point where the yearly LastPass breach has become a meme just like the yearly T-Mobile breach. It makes no sense whatsoever to look at this incidence without that context and to claim "it's not that bad, they only leaked xyz".
On another note, of course does a breach tell something about the security practices of a password manager company. You really want the developer of your password manager to have good security practices and any sign to the contrary is concerning even when it is not directly related to the core product. Of course security is not about absolutes and mistakes and incidents do happen – what counts is how, how is dealt with them and if they repeat. In the case of LastPass history, including this breach, shows that they have atrocious security and you do not want to let your credentials get any millimeter closer to them than you can possibly avoid.
> I'm pretty sure 99% of the people on exposed have already had their names, phone numbers, email and physical addresses leaked already.
Again, I'm sorry for being so direct, but this argument annoys me greatly: This argument – that others have done similar bad already and similar harm has already been done – is beyond stupid and needs to die. It's why slippery slopes are real. It's the reason why normalization of bad things happen. It's what people with bad intentions continuously use with great success to slowly make their bad deeds socially acceptable.
When my neighbor dumps his trash on the street that does not allow me to do the same and does not make it any better if I do. I will be just as much in the wrong as him. The only difference being – when I use that excuse – that I will also be a coward.
The wrongdoing of others is never an apology to do the same; and just because something bad is normal does not make it any better and it is especially not an argument for making it even worse.
> With something like LastPass it's also much easier to create unique strong passwords for other sites.
Sure, but LastPass, in addition to being the least secure option, doesn't even have a good user interface, and it's expensive. There are dozens of other password managers out there, each one better than LastPass in every way.
I often hit problems with 1Password's autofill on particular websites, but by and large I blame the website. Few examples:
* one website expects me to type the PIN then a Symantec VIP OTP token into a single field called "password". That's a (possibly deliberately) password manager-hostile design. I finally got annoyed with it enough to use an open source project called `python-vipaccess` to create a proper `otpauth://totp/...` URL I could add into 1Password and wrote a TamperMonkey script that added separate autofillable fields that would get concatenated automatically. Now 1Password works fine.
* frequently websites will complain about needing a valid credit card number after autofill. I have to go to the field, delete the last digit, add it back, tab away, then it works. I think they have just used the wrong event handlers and never tested it with autofill.
* they often will skip `autocomplete="new-password"` attributes, so my password manager will look for a (nonexistent) current password rather than prompting me for a new one, and/or they won't have the username and new password fields ever in the DOM at the same time so the password manager doesn't save it properly. (Even if it makes sense in terms of user-visible flow to do these in sequence, they can still leave the username in as a hidden form element for the benefit of the password manager.)
I've also hit UX problems in 1Password itself, for example the "quick access" pop-up doesn't reliably appear on the current Space in macOS. (Confusing and annoying to have to switch to another to see it.) But they seem less common.
I think it's not only that but also that making site-specific changes (as I did with a TamperMonkey script) is fragile and could get them into trouble if their changes do the wrong thing (immediately for everyone, for some users, or after some site change). Might be better from their perspective to honor the site's stated intent even if that intent is questionable. In my top example, the "password" field actually is a password if the user hasn't enabled 2FA, so the changes I made wouldn't work for 1Password to apply to everyone. They could detect the label "PIN + Token" to gate it, but what if that text changes in a redesign or is sometimes localized into another language? and so on.
In the broadest sense, I agree there are big UX problems, but how much should we expect the password manager to do unilaterally? fwiw even when a bunch of players got together to make broader changes, we ended up with passkeys, which are far from perfect in many ways. (The flows about scanning a QR code from one device to another, without necessarily even knowing which device has a working passkey for that site... the simultaneous confusing offers of different ways of signing in... try talking your vision-impaired father through that over the phone.)
> if the editor is on a different workspace on mac you have to go to the application space/desktop than three finger swipe back to the browser space/desktop and then back to the application space/desktop and then back-and-forth to fill in four different security questions.
Yeah, that sounds similar to my own complaint about quick access opening on the wrong Space, just applied to the main window instead. And of course when you have to use the security questions something else has gone really wrong, like the main password having changed on the site without having changed in your password manager.
* One way I've seen this is when people have overlapped usage in two different password managers (1Password vs either Google Passwords or Apple Passwords). They have import and export (except for passkeys), but it'd be nice if they had an incremental version to help you get out of this mess if you weren't disciplined in switching over all at once.
* Another is that when you change the site's password even while using the password manager, the actual site change and recording it in the password manager's database is hardly transactional. You can click the password manager's update pop-up even if it failed, or not notice it even if it succeeded. Again not really sure how they would address this unilaterally.
> I just hit one. Creating a new document in 1Password, the name of the document isn't preselected, so I have to hit delete to name it. Lots of little tiny shit like that.
Yeah, that's 100% on them.
I remember another stupid annoyance. There was one site where passwords were limited to eight characters but the way they password manager entered the passwords. It passed more than the characters along as the password so the password would fail if it auto filled, but if I copy and pasted or typed it manually it would work because the JavaScript had a chance to truncate. The fact that this site was limited to eight character passwords all other conversation, but that was super annoying until I figured it out.
Anyway. I have a love/hate relationship with my password manager.
It's true that sometimes very small/simple issues that affect some portiion of people can go for a long time. I'd like to find a better way of identifying these and getting to them quicker than just crawling through HN posts. If you have any thoughts or at least issues you'd like us to look into, always open to hear more.
I'd love to look into the Quick Access placement. It is supposed to appear on all spaces and sets an NSWindow property to do so. Is there anything particular that you think triggers it (multi-monitor, full screen apps, etc)?
Thanks! I haven't seen it in a while, so maybe it's been fixed by either a 1Password or macOS update or is specific to a setting I since changed. But I'll keep my eyes out for if it happens again. I do have a multi-monitor setup.
I do see right now that if I'm on a full-screen app, 1Password's quick access window doesn't show up; if I move to the next space over I see it for a moment and then it disappears. In contrast, Spotlight search will actually pop up directly over my full-screen app, though knowing Apple they could be using some private API for this behavior.
Switching takes time and energy.
Changing all your passwords after you switch so they aren't potentially exposed in the next LastPass break takes time and energy.
People have a lot of things going on and have to make a decision about whether the risk justifies the effort.
Then there's feature gaps. LastPass is available on all platforms, has convenient sharing, a good story for emergency recovery if I'm incapacitated and want family to get access to things, and support for 2FA options such as Yubikey. Most competitors lack at least some of those, which is an issue if you're relying on them.
Personally, I left Lastpass for 1Password several breaches ago, but it took me a couple weeks of research to decide where to move to, at least a week of changing passwords on sites afterwards, and however much time and energy it took me to help others who I share credentials with switch at the same time.
Their biggest security hole is probably somewhere in the operational pipeline between 1P browser client developers and the static file servers hosting them.
I've more or less switched to apple keychain/passwords at this point. I need a solution for linux, and have been thinking about some kind of simple 1-way sync issue that dumps stuff from keychain into some other tool for use on linux.
In terms of TOTP I just use googleauth and oathtool.
It won't ask me for my secret key, which I have an can provide immediately, no, it won't allow me to authenticate myself with the phone, because our enterprise vault logs off quickly, I must however do a some absurdly obscure dance because FY, that's why.
I was a paying customer for 15 years and migrated away with the last price increases due to "AI-powered functionalities" and the new features making the product worse on top of already being salty over when they stopped the one-time licenses in favor of subscription.
Right, but LastPass is a company that wants to make you believe that you can trust them with some of your most important assets.
--
Probably related to this:
https://www.bleepingcomputer.com/news/security/lastpass-conf...
“On June 12th, LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams, which integrates with our Salesforce and Gong systems,” LastPass says.
"We immediately launched an investigation and learned that, as part of this incident, an unauthorized actor was able to obtain OAuth tokens Klue held for many of its customers, including LastPass.”
“The threat actor then used these credentials to access LastPass customer data within our Salesforce environment.”
And then they force us to install cloudstrike, antiviruses and client side monitoring because "us are the security problem".
Also, their marketing systems are also a mess. I've unsubscribed from their marketing emails multiple times, but to date I'm still getting marketing emails from them even though I'm no longer a customer. Even contacting their support about this issue hasn't helped.
In the US you can report it to FTC for CAN-SPAM violations, but don't hold your breath on any enforcement.
Lastpass is owned by PE. Why? Because Francisco Partners and Elliott Management bought a cashflow that is sticky. Its why most software companies were acquired by PE prior to the Cambrian explosion of generative AI.
If this bank were my client, I would make sure that the decision-makers were aware.
Just like a previous employer I had, on background checks. "We need to run one. We don't care what you did or didn't do, if you're doing good work for us. But some of our customers require that we have performed them."
Companies deal with leaked secrets a lot. A company already using a password manager is ahead of the game.
Suppose they move to a competitor. That's a migration and training that someone has to drive. What do they gain? Another company that can also have exploits? Or they self-host, and now have to fund that, and still potentially get exploits?
Ultimately, this likely isn't that big of a deal for a company.
And they have to weigh it up against all the other things that they can be doing.
Those companies do not have the same number and severity of security incidents. lastpass is truly in a category of its own
but there is a non-trivial switching cost to migrate several people (with varying technical aptitudes) that each use several platforms.
if 1password had a one-click migration flow they'd be able to win over a lot of converts.
OK their Mac UX is great, but given their rate of incidents how can you trust it?
Clearly this stuff is not actually bought based on track record.
Having your own auth workflow was instant fail with the well architected framework committee. Using Okta was instant pass.
I don't necessarily disagree with that policy but given that Okta was breached several times while I was working there, it was interesting the extent to which our CSO had blinders about it.
e.g. when Crowdstrike takes down Windows across the worlds or AWS east coast falls over everybody hurts. At that point the story is easy, you point at the broken thing, mumble something about improving resilience, and everyone just moves on.
Roll your own system and have it taken down / breached specifically? There's noone to point at. It's hard to make the narrative anything except it being your fault.
“Yeah, but they fixed that!”
Normies don’t pull the historical list of breaches and vulns.
They just read headlines.
I’m not saying I recommend LastPass for that reason, but I wouldn’t write them off for that reason.
I’m not saying you’re wrong, I’m saying you can’t tell from this incident.
Setting up KeePassXC is trivial.
It is a tool that does one thing really well.
It is trivial to sync the password db. You can use whatever you prefer.
> "I have a working, synced password manager across my devices with good security practices."
Well, using Lastpass or any other third party to store your passwords was never good security practice.
Is that actually something the average person needs? Do they create new accounts ever day or week that they need to have on all device immediately? Merging DBs is like a 2 minute exercise at best.
I would argue the friction is a good thing. "Do I actually need to give yet another website information about myself for an account?" The answer is no more often than not.
Yes I know people don't care but those who don't are not using a password manager.
1. It has lots of features and complexity, but doesn't always convey affordances for common use cases to the user.
2. Some of the UI design feels very incrementally developed (naturally), and the implementation a bit quirky in parts.
(For one of many examples, when I had to do something involving adding TOTP secrets, once I found where to add them, I had to be careful in which sequence I clicked things, or it would just discard the secret I already put in the right place. If I hadn't been watching carefully, I might not have noticed immediately that it did this, and not been able to restore the secret before it was lost.)
Of course, in an ideal world, one would like to do a great holistic rethinking of the UI design (while preserving the data model), but that's a ton of work.
When advocating it to a "technical" person (who is not scared of, say, a legacy IDE), I would say it might do everything they need. When advocating to an ordinary user, I would look at their use cases, and see what they are going to see, and how confusing or quirky that might be for them.
If I keep a KeepassXC database on a set of devices, sync'd using syncthing, then for a large range of threats I'd need to be a target of interest.
This is in contrast to LastPass which is going to attract a ton of blackhat attention.
Yes, supply chain attacks are possible but they're equally possible for lastpass.
Switching to a self-hosted solution isn't perfect. Nothing is, and pointing that out isn't particularly useful.
What it does do is eliminate whole class of threats: large scale, broad based attacks against a single, high value target.
In fact I'd argue writing passwords down in a notebook or putting them in a naked text file on your computer is better than trusting a centralized service like LP.
Of course, if you are a target of interest, the calculus changes entirely.
nobody cares, there’s like 2 people whose job it is to care, one works for your company and one works for the third party IT company - and maybe your company’s General Counsel but even they just care that your CTO said they care
everyone else just has whatever enteprise service was presented to them
>"Klue has not said how many of its hundreds of customers are affected. Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium."
>Cybercrime group Icarus took credit for the breach, saying on its leak site that it will publish the stolen data on Monday if the company does not pay the hackers’ ransom."
https://techcrunch.com/2026/06/22/klue-hack-results-in-data-...
> The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.
For anyone looking for a recommendation: I use KeepassXC with Keepass2Android. Open source, with a local database that you can choose to sync (or not). I sync using Own cloud.
Why even give them that?
To be fair, I could just sync the db somewhere safe.
I think if people took a moment to actually look at what happened, they might realise that the story everyone has in their heads is quite different from reality.
Klue is one of those CRM services that so many sales teams are using. Yes, you have to hand them customer records (email of the customer contacts, finance teams, etc). That show Klue delivers it's "market intelligence" thing about that customer.
If you go to your sales teams and see what random stuff they have hooked up to your systems, I bet you will find similar things.
Whether or not this is a good idea (I firmly dislike it), this is how sales teams work these days. If you try to take it away you will be fighting the entire sales organisation.
I am more surprised that these breaches don't happen more often.
It doesn't impact LastPass's actual password databases.
(No affiliation with any of the entities involved in this)
They do.
how often you notify the public is a completely different discussion.
but for the past couple years I've just generated and forgotten 90% of my passwords. the final 10% I keep in a password manager. But if the service isn't really that important I just use the 'forgot my password' to change and generate a new password every time I need to login
In the end for a lot of services controlling your email is defacto controlling the login.
I NEVER log into my mail from my laptop/desktop. I access my email via my phone's mail app.
So
1. try logging on via my laptop's browser
2. service sends a magic link to my email
3. click the link on my phone
4. now I'm logged in on my phone! not what I wanted!
Even though i understand your consideration of separating regular access and reset onto different devices, im am still more sceptical about smartphone security than anything else. What happens when someone gets access to your phone? They could redirect and use the magic mails too.
This approach seems better to me. For one thing, I'd already be screwed if someone malicious got into my Google account, probably worse than if they got into my password manager. And additionally, this means they're not creating an absolute jackpot of data to breach in a centralized place. No one's gonna hack Enpass of all their passwords because that would require hacking all of Google Drive, Dropbox, iCloud, etc. and looking for the files manually.
I also got a good deal on the lifetime pro membership before they moved to more of an annual model, which factors into my decision.
Which Keepass frontend do you use (if you use one on mobile)? Keepassium and Strongbox seem to be the ones that people talk about, but they are pricey too. I don't know anything about AuthPass, but I'm reluctant to use a free product; I'd rather use an inexpensive one, just to hopefully thwart supply chain attacks on that front.
Or they compromise their self-update system if that exists.
i can sympathize a little bit with companies that stick with lastpass. when i had to switch an org from lastpass to 1password, it was a massive undertaking and incredibly annoying. however, i have no sympathy for anyone who has chosen lastpass after 2022.
The non-story here is the data is of minor criticality.
The real story is is that however minor, you expect LastPass to be better. They’re a password storage company, in order to be trusted they need to be better than this.
> Yes, in a separate breech.
Not nearly that cut and dry.
Many, not all encrypted vaults leaked out. If you lost data it was because you used a weak master password for that vault.
> If you lost data it was because you used a weak master password for that vault.
Even this is more complex (horrible pbkdf2 defaults, you're welcome for getting lastpass to increase them btw that was me) but it isn't relevant, no vaults are accessed in this breach.
It's a purpose specific knowledge base, not a data broker or any sort. But it will surely have information of who you sold to or tried to sell to because of it.
The specific dependency that gets companies infected, and the optics that result, are so important. There have been sillier examples, but you can see how in this case, the priority of sales and profits has resulted in the sacrifice of the main quality measure of their main and only product.
To be fair, and I don’t want to, supposedly the only thing that was compromised was contact info. No vaults were exfiltrated or unlocked (as far as the article info goes).
So this is really just another very boring info breach, not a targeted password-stealing hack.
The other breaches they suffered were worse.
What do you mean exactly here What do you think LastPass could have done to prevent this specific issue?
customer names, phone numbers, email addresses, physical addresses, support case data, sales-related data.
But LastPass does (Salesforce CNAME):
https://support.lastpass.com/s/?language=en_US
So this couldn't have happened to bitwarden, you own the reputation loss if any of your suppliers get owned. Though it really doesn't matter anymore for LastPass they leaked their customers vaults before, I have no idea how they can still be in business.
It's worth noting that this is not 'their marketing provider' what they do is load 30 different providers for some reason, to maximize the reach of their data sharing and advertising network. Well, their network reached too far and touched an infected node.
There are a few decent Android and iOS apps that work well. I use Nextcloud and WebDAV for access.
Not a setup I can recommend to just anybody though.
The need to have an opinion on how you’d like to sync a file does, as you suggest, eliminate some portion of the population who need a fully baked answer in one step.
I used to use Google Drive, but now I use Syncthing, further reducing my exposure. Paired with Synctrain and KeePassium on iOS.
One tip: enable the atomic save option in settings to reduce the risk of weird cloud sync issues.
For syncing, I do it manually with rsync. Given the database is 1 file it's easy to move around. You can rsync / scp it over, use a USB cable, use cloud storage, etc..
I use a password manager in a "read many, write infrequently" way so I don't mind occasionally syncing it as needed.
I’m sure it works for many people to Dropbox their vault around anytime they want to access something and manually handle copies and sync. I’m not nearly so naive as to think that has any degree of success outside tech bubbled people.
But we are prioritizing “can’t” over “won’t” in terms of provider access to our credentials. That’s why these hack-related threads tend to draw folks who will remind you that other tradeoffs exist.
For a technical audience like HN, “can work out how to sync a file” is a decent assumption to make.
1. I have a side screen that is merely 360 pixels in height. KeePassXC does not work fine on it. KeePass2 does.
2. KeePass2 remembers the names of custom fields added and allows picking from those for a new entry. KeePassXC does not.
The lesson here is to get off of LP ASAP, you can figure out where to go later.
At the end of it I couldn't help but reflect on my foolishness. I realised just how much better I would've felt if only it had been an American, Canadian, or European Googler who stole my data. It really is the worst when malicious entities are Chinese, Indian, or Pakistani. Just the worst!!! (/s)
Google accounts aren’t immune to being compromised, so I agree that it’s not a good home for passwords (without even the need to invoke internal threats) — but it felt safer than LastPass. Which ought to be an embarrassment.
Well, I hope Klue got them more customers than they are losing due to this.
The first step was easy. The account creation and import of legacy data all went pretty well. But after that it wasn't so pretty.
The first hurdle was trying to understand their model for sharing data (so my wife and I can share important credentials). The model that LastPass uses is pretty intuitive to me: it's just a matter of sharing a folder, so relatively transparent. But Bitwarden has a whole separate concept of "organization", and the items being managed don't go in "folders" here, but in "collections". So there are two separate, and subtly different, models in play, and this is confusing. The good news is that the client aggregates the data so when you're using it day-to-day to fill login forms, you don't have to worry about the differences.
Once I'd gotten the data in place, I had to get the clients set up on the various platforms (browser extensions; desktop native, which is actually required for the browser extension's security to work right; phone). The OoB settings were entirely paranoid, and had me re-entering the complex master password over and over, really annoying me. Figuring out how to get to a reasonable balance required figuring out some settings whose labels are misleading. For example, "Unlock with PIN" sounded to me like it was going to add an extra layer of security, but it turns out that it really means "allow unlock using PIN in lieu of master password".
Also, note that while most of the settings default to paranoia-level (like the "require master password every time I inhale", that I mentioned above), you will probably want to change the default crypto cypher. It defaults to PBKDF2, but a better modern approach is the other choice, Argon2id.
...which also reminds me that there's a distinct lack of parity between client platforms. Although you need the desktop native app to manage browser extension security, there's a bunch it can't do. For example, after importing my legacy data, I needed to select all the contents of my LP shared folders and move them to the BW organization collection, but the native app (which seems to be an Electron app, btw) doesn't have a multi-select feature; you need to do that in the online web app.
The companies responsible for these lapses of security should be paying, starting first with investors, then the C-suite. That'll put a stop to this negligence VERY quickly.
I "just" use google chrome password manager for "everything".. yes im sure it horrifies some HN ppl but my thinking is, from all the password managers out there, does anyone one spend more on security or hire better security ppl or have access to better security tools and infra than google (yes yes im sure outliers and some counter examples exists).
I routinely die a little inside when i see my gf (none techie) try and remember which one of her fav 3-5 often used passwords she has used for site/service abc as she tries to login.
Kinda tongue in cheek, I always tell her if you can remember your password it's a bad one !
1password or Bitwarden is great alternative
Private company third party password managers are bad. Across the board. They're a bad idea.
Deeply localized actual best practices can help solve this. Private companies can also help, but only if it isn't in the form of "you can't have this unless you pay for it." The point is, it's like fighting fires, you can't isolate it.
It's a complete dead-end and the sooner the industry realizes this the better.
1- Tradeoff individual account risk, for systemic risk. You may argue password managers are safe, but few would argue that the risk model reduces the risk of individual password leaks more than the risk of all your passwords leaking. It's a tradeoff.
2- Cat and mouse security: There's a class of security decisions that work because they are new and different. First the weakness was that passwords were short, then you make passwords long but unmemorable, so people rely on some other mechanisms to authenticate, like a file on their computer, a drive, a fingerprint, facial recog, which may in turn be protected by a second factor password.
At first the new security model will not be stressed, but as more users migrate from one security model to the next one, that's when you are able to compare the security of both technologies, it starts being a juicy enough target that it becomes attacked.
So we are at the point where password managers are used enough that they start becoming worthwhile targets of attack (to overcome the difficulty of vulnerating them).
Also worth noting that these attacks are more winner-takes-all. In the sense that rather than seeing one account hacked every couple of hours, you will see them all hacked at once, because you introduced a vendor in the password supply chain AND because the vendor centralizes all of the passwords. So target that one vendor and from a single attack you get all the spoils. So when comparing the security of the olden method and the new, just 1 incident is enough to undo all of the reputational gains it has made over the years.
I do think there are some cases where an online password manager makes sense, e.g. for businesses, but for individuals it's better to just stick with an offline password manager, at least for the high value accounts.
But if even that is too much then f.ex. `keepass` + a scheduled script to periodically backup to your own servers is also perfectly viable.
Wait. That's a thing? Like, there are drooling, mouth-breathing stooges out there that would trust not just one of their passwords to such a thing, but all their passwords to it?
Sure you can self-host all of it also, but people like to pay for not having to do that.
I don't think password managers which store encrypted vaults are less safe than trying to have and juggle strong unique-per-domain passwords, even if you think that the password manager is becoming a target.
And it's not unheard of that infections metastize, whether into developer accounts, product code... Probabilistically, this was a shot on goal.
I apologize for the mixed metaphors.
For backup, the hardware security key let's you download a file from it with all of your passwords encrypted, and the decryption password it's shown on it's screen (something like 12 random words)