I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so.

It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.

That's not an apt comparison.

Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass.

The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews.

1password has more recommendations by security engineers, and has been reviewed in significant depth.

Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.

I like the idea that you are just walking around asking security engineers for password managers

That comment is not wrong.

1password has changed recently. Are security experts recommending their newer cloud subscription service or the older version that stored the vault on Dropbox or another storage service (or both)?

Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.

How do you tell that LastPass has been vetted better than the alternatives? "Experts looked at X and found no major issues" normally doesn't get very much attention, and potentially isn't published at all, or just reflected in recommendations.

(some of it is of course also depends on the threat-model: something with no (or with more caveats, an explicitly activated browser integration) is way less likely to be vulnerable against attacks launched from a website, reviewed or not)

I do not know this. If you're informed, I would appreciate your advice.

As an enterprise customer, I previously tried getting people to use some Keepass databases available only on the local network. Compliance was roughly zero. The UI frightened people, it didn't integrate well into existing workflows, and, as an admin, I had no good way to segregate users into groups and only give them access to specific password sets.

Since moving us to LastPass, compliance is through the roof. Using the browser extension makes it much easier for everyone. Administration is much simpler too. I'm actually considering moving some personal Keepass files to a personal LastPass account, as I now find myself comparatively frustrated when I have to use my Keepass files.

The only good alternative everyone seems to agree on is Keepass. Keepass is useless if you need something that works in a group of people, especially across different devices.

I can't speak to the vulnerabilities in 1Password but the reason we decided against 1Password is that the user experience for LastPass (Teams) is much better. There's no point in having a secure tool without compliance and bad UX is a show-stopper.

Also the vulnerabilities so far have been mostly non-concerning:

1. The vulnerabilities of the browser extensions generally require the user to access malicious URLs, so they still require some degree of interaction.

2. The actual hacks of LastPass didn't result in any passwords or confidential information being leaked, so they're not very interesting.

That 1Password hasn't seen similar disclosures doesn't mean 1Password doesn't have any vulnerabilities, nor that it didn't have them in the past. No software is without faults and so far LastPass has always reacted promptly. That 1Password doesn't have as many recent disclosures may simply mean that Tavis hasn't gotten around to looking at it yet.

For me, it is because I have shared folders for credential management for various jobs and it would be way too hard to get everyone to migrate. In fact, I am not aware of any other solution that matches LastPass functionality.

I have changed my behavior to just using lastpass-cli and a self-written Go/Qt GUI wrapper over the CLI - https://github.com/alexzorin/lpass-ui - (only builds on Linux sorry) to protect myself from the problems of the browser extension.

LastPass user here, the reason why I choose LastPass is it's convenient and _not_ because it's safe. A common misconception is that softwares like LastPass/Keepass should be extremely secure, resist to any kind of hacking/exploiting, so that I can store all my passwords in it. Let face it, that's not realistic. The practical way is: 1, for non-critical accounts use the most convenient and relatively safer one, like LastPass/OpenID/etc. 2, for cirtical ones(like bank account, major email account) burn a strong passwords inside your brain and combine it with 2FA. Do not trust any one/software when something really matters to you.

Why not!? So they mess up. I figure all the other password managers either have similar issues and either weren't disclosed, or fixed before the issue was publicly found. No software is bug free.

While they have issues -- at least this is an issue I know that's been addressed.

That's fallacious logic.

"This password manager is bad, so all the others must be just as bad"... yeah.

Other password managers, like 1Password, are more frequently recommended by security engineers.

They're also not built entirely as browser extensions and interfaces, which massively increases attack surface.

Maybe the reason other password managers aren't tire-fires is because they're designed better and are more secure, not because they have more unknown issues.

There are tradeoffs to all software.

I use lastpass with a yubikey for 2fa and I feel safe enough. I briefly looked at other password managers when I was evaluating lastpass, but convenience won out for me. I haven't looked at moving out of lastpass, but 3 years ago no other password manager came close to the mobile and platform support that lastpass had.

I considered keeping my passwordDB local, but the inconvenience of needing it and not having it wasn't it worth it to me. Do I know I'm making a tradeoff? Yes.

I also have a nasty habit of setting things up on a local server and then never updating it. Instead I decided that lastpass was worth the $12/year so I wouldn't have to manage anything locally.

So while lastpass may not be perfect security, I'm a lot better off than I was three years ago when I used the same few passwords everywhere.

It also helps me share passwords with my wife, so that's nice.

Cost, 1Password is atleast 3 times the cost. And i use, 2nd factor on most sites + lastpass website only no app or no browser extension. I think using this way it is same as 1Password when it comes to security with 1 3rd of cost..

For me it's the ease of adding new sites, which is frequent. As a long time Keepass user I know the pain of generating often requiring navigating two programs for every sign up.

In light of recent revelations I'm considering going back. And possibly telling friends and family to maintain a separate LastPass for their important stuff, in a separate browser.

I would check out 1Password. I can't compare LastPass and 1Password since I have never used LastPass, but adding a new login/password for a website is pretty easy in 1Password (just open the app and choose generate password, as long as the extension is installed on the browser it understands the website). It also prompts you if you login without generating a password.

I used lastas for two years. When my student license expired I tried KeePass, 1password and Dashlane. Dashlane used over 1.2gb of memory, was slow and made no sense. You could add sites in the standalone client but NOT passwords. So you had to use the browser extension to create the password and copy paste it into the client. 1password might be amazing on Mac but on Windows it was so barwbonea I could just use lastpass without the extensions and still get more features. KeePass was fine just a bit cumbersome to integrate and browser integration would sometimes stop working. That being said the UX in lastpass is also horrible and getting worse. It is so slow now with the fancier graphics. I'm still surprised they are all so bad but lastpass is the least annoying to use.

The alternative is either going back to remembering passwords, sharing passwords between sites, or writing them down, or to switch to a similar product that has fewer features and an unknown amount of bugs with likely worse vulnerabilities because there are fewer people looking for them

Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]?

These two products are very feature-complete (at least for my usage) and have as much attention as LastPass (with for example Tavis Ormandy working on both). They even publish information about their security model[2][3], which LastPass does not.

LastPass has proven repeatedly that it is not robust enough for storing passwords. Fewer or less important vulnerabilities reported does not equate to less security.

0: https://1password.com

1: https://www.dashlane.com

2: https://1password.com/files/1Password%20for%20Teams%20White%...

3: https://www.dashlane.com/download/Dashlane-Security-Whitepap...

> Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]?

Linux support

Enpass: https://www.enpass.io/apps/linux/

Enpass ticks all the boxes, except... no-one ever mentions or reviews it. Has there been a security audit? Is it reliable?

It seems no security audit has been performed, but they plan on it at some point: https://discussion.enpass.io/index.php?/topic/404-security-a...

Their responses in that thread do not inspire confidence in the product for me, to put it mildly.

That was scary. I'm not going to be recommending Enpass.

ChromeOS support

You are missing a middle ground alternative, keepass stored in OneDrive/Dropbox

A similar question I have is why use a browser extension for your password manager? I use 1Password as well, and if I need a password I just head into 1Password Mini. It's convenient enough, simple, and completely eliminates this attack vector.

Because it's extremely convenient. When this bug was first reported a few days ago, I disabled the Lastpass browser extension and started copying and pasting passwords from the vault, basically as you describe. It's been a very noticeable inconvenience, to the extent that I probably would have turned it back on soon even without a fix.

I'd argue convenience isn't really the point of password managers. Extremely convenient would be using the same password everywhere or letting your browser save them.

I've never used LastPass, but 1Password Mini is pretty convenient. It's always ready to go in the menu bar, and once you enter your password it stays unlocked for a good while.

You mean this 1Password? https://bugs.chromium.org/p/project-zero/issues/detail?id=88...

Yes. That one. No one claims they didn't have any bugs of their own, but they tend to fare better. That bug also only affects Windows users and is only locally exploitable, compared to LastPass which is pretty much always RCE.

Just b/c they also have a bug doesn't make them any worse than anyone else or diminish their track record in general. And contrary to just about everyone else LastPass doesn't care to notify you of updates or have the auto-update mechanism on.

>why do people (at least here on HN) stick with it despite these major issues?

Before I switched to lastpass, I had maybe 10 different passwords I shared across 100 sites. This was terrible, and now that I use Lastpass, every password is unique. So I use Lastpass because its an incremental improvement.

Is 1Password an incremental improvement over lastpass? I'm not convinced. It might be a tiny bit more secure, but nowhere near the gain in security I had from 10 re-used passwords -> all unique randomly generated 20+ char passwords. The cost of switching is high and so it would have to be enough of an improvement to justify the switchover.

I recently switched. There's a LastPass import option, and it took about 20 minutes to get all my devices synced up. The cost of switching may not be so high, depending on how you use LastPass (if you use their Enterprise features, for example, it would be higher).

> 10 different passwords I shared across 100 sites. This was terrible

That isn't terrible so long as the email linked to them has a unique, strong password. How many of those sites need the highest level of vigilance?

LastPass is terrible, but without alternative, at least if you want cross platform.

People keep bringing up KeepPass, but apart from the bad UX, it's developers seem to be even more incompetent concerning basic security design. That leaves 1Password, which also hasn't covered itself in glory security-wise, but appears to be marginally more competent. No linux client though.

don't use a browser addon. don't use one with cloud features. that takes away a lot of attack surface.

And most of the convenience. I don't need a password manager if all I'm using is a single machine - an encrypted file in my homedir would do. It's the syncing of passwords across all devices that is the most useful.

Syncing does not need cloud features built into a password manager.

How else would it sync automatically?

Syncing of the encrypted store file between devices or your home server when they're in the same network.

What if they're never on the same network? I don't bring my work machine home, or my personal laptop to work, and yet they have to sync passwords somehow.