Perhaps, but this particular exploit doesn't target the fact your passwords are stored in the cloud.

It targets the local autofill functionality in the browser, so it could conceivably have occurred in any password manager with browser/autofill integration. Including those that use a local password store.

Do you mean it could happen with, say, Firefox's built-in password manager?

Yes, it's exactly the equivalent of someone finding a bug with the auto-password fill functionality in Chrome or Firefox or IE to trick the browser into filling in a password on an unrelated site.

Yes, sir.

What's happening is that this extension auto filling the password in unintended sites. Where it is getting passwords from (offline or from cloud) is immaterial for this case.

It happens at the point that the browser functionality interacts with a webpage on the internet that is controlled by a third-party. A well-written autofill function will strictly only allow the 3rd-party website code to access passwords for logging into that domain - the Lastpass allows it to capture passwords for other domains.

This bug could easily occur in Chrome/Firefox's built-in password manager autofill, though I must admit I have slightly more implicit trust of the developers behind Chrome/Firefox than of Lastpass (instinctively; this may well be unwarranted).

Well, there's always a balance with usability.

password reuse < own memory/manual storage < synced unencrypted 3rd party storage < synced encrypted 3rd party storage < custom encrypted storage < some custom crazy HSM which doesn't allow you to get more than X passwords per minute and notifies you on each get()

There's another dimension for cross-platform support somewhere in there. At the moment if you want your passwords saved and shared between desktops and mobiles, the best solution I'm aware of is 1password with separate sync (dropbox/icloud) - and you're still trusting the 1password app. You can go further, but you're starting to destroy usability on the way. Lastpass / 1password is still a valid choice that's better than many alternatives.

Where do you write yours down?

I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else).

It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm.

For example, my 'insecure' fixed part might be 'Tenk5$' (I recommend including uppercase, lowercase, a number and a symbol in that part to get around idiotic password requirements). Then my algorithm could be 'the last 5 letters backwards, skip the first vowel'. In which case my password for HN would be 'Tenk5$rtani'.

Problem is, that not all sites use the same style of passwort.

Some need Lower-/Uppercase, some with numbers, some with special Chars, some restrict to minimum of x chars, some use a maximum.

Your system works not for all things, i use a similar system, but store a bunch of passwords with last pass. Only really important passwords are in my head.

> Only really important passwords are in my head.

That has not worked well for me. I have lost a small amount of bitcoin, and some encrypted homedirs and encrypted hard drives.

Yes, occasionally sites don't allow it, but I've found if you use at least one of: uppercase, lowercase, numbers and symbols, and have a length of around 10, then it will go through virtually all sites.

I keep meaning to collate idiotic password rules so you can see for sure which patterns work in all of them, but I've never got around to it.

I use a method like that, but the result of that step then goes through PwdHash (whose code is small enough to inspect for naughtiness) so that multiple web sites wouldn't expose the scheme.

> it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm.

Use that algorithm widely enough and several compromises are guaranteed. The only thing protecting your password is that url manipulation.

I do a vaguely similar thing but I don't share it with the world :)

That's not the actual system I use obviously.

I'd recommend Pass [1].

It stores your data locally, is suprisingly easy to use and relies on battle tested GPG.

From the website: "The community has even produced a cross-platform GUI client, an Android app, an iOS app, a Firefox plugin, a Windows client, a pretty Python QML app, a nice Go GUI app, an interactive console UI, Alfred integration (1) (2) (3), a dmenu script, OS X integration, git credential integration, and even an emacs package."

[1] https://www.passwordstore.org/

If safety is your primary concern though, stick with just the command line client, which is a Bash script most HN-readers will be able to follow to the letter. It in turn uses GnuPG.

The lack of integration then with the rest of the OS is actually a security benefit.

On paper.

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

https://www.schneier.com/news/archives/2010/11/bruce_schneie...

We use KeyPassX in our company.

Keepass(x).