Hacker News Reader

Comment by devx | Hacker News Reader

I've seen a lot of people recommend Lastpass lately, but couldn't the government force Lastpass to create a backdoor for them to get the passwords before they are encrypted?

I'd also worry about a catastrophic event of Lastpass losing those passwords somehow, and then remaining locked out of many websites.

And what about Bittorent Sync with an old PC as an alternative? They even have an iOS app now.

View on HN

I personally use keepass and keepassx (the alpha compatible with keepass2.x) and sync my passwords with SpiderOak. That's worked pretty well for me, and I don't actually have to trust a website with my passwords. Even if there's an insecurity in SpiderOak, they'd only get my encrypted keepass database which they'd then have to also decrypt.

I definitely recommend keepass over lastpass.

Exactly what I do too, for exact same reasons. Crazy imho to store your passwords in a cloud service, using only their encryption.

> keepassx (the alpha compatible with keepass2.x)

A bit OT, but I'm guessing you're using keepassx for non-Windows OS? Is there a benefit to it compared to simply using keepass with Mono?

If I'm not mistaken, LastPass keeps both a local and cloud version of your password. When you're having trouble connecting to LastPass's servers, LastPass still functions. I think it's just that if the password changed on another device since the last time it synced locally, you'll still have the old one.

So I'm pretty sure that you'd have to lose basically every device it's on and have LastPass's cloud deleted to lose them all.

They don't keep a server version of the password (they don't have access to your password), but they do have the authentication credentials. A password manager that only worked online would be frustrating.

Yeah that's my concern too - any vendor can be compelled through secret courts to include backdoors in software.

I've had this worry as well, in regards to loosing passwords. I still believe writing everything down on a piece of paper can help. I have a little black journal that I carry with me everywhere that has all my passwords in it. Typing them in is the issue when they are longer strings, and mixed symbols.

Only issue is protecting that journal.. Hopefully I can eat the pages if things were to arise. Ha

> Only issue is protecting that journal

Or losing it.

Haha, yes or loosing it. I think that having a back up would be much needed. It's really too bad to think that we have gotten to this point. Not to be the paranoid one.

If you are sufficiently paranoid about having to destroy the notebook, tissue paper and water soluble ink go a long way to making it easier. I made about a dozen for a murder mystery party about two years ago and still have one lying around somewhere. A small waterproof bag should make sure it isn't inadvertantly damaged in the rain.

The more dramatic solution is flash paper, which destroys all conceivable evidence. Don't fly with it.

http://en.wikipedia.org/wiki/Nitrocellulose

I'd be very wary about carrying a book of flashpaper in my pocket.

Reply on news.ycombinator.com