LastPass release fix for DOM manipulation vulnerability

Re:LastPass release fix for DOM manipulation vulnerability by TheDong on Saturday April 01, 2017 @12:00AM (#14010326)

That's not an apt comparison.

Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass.

The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews.

1password has more recommendations by security engineers, and has been reviewed in significant depth.

Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.

[ Parent | on HN ]

Re:LastPass release fix for DOM manipulation vulnerability by DiNovi on Saturday April 01, 2017 @12:09AM (#14010360)

I like the idea that you are just walking around asking security engineers for password managers

[ Parent | on HN ]

Re:LastPass release fix for DOM manipulation vulnerability by tptacek on Saturday April 01, 2017 @01:12AM (#14010566)

That comment is not wrong.

[ Parent | on HN ]

Re:LastPass release fix for DOM manipulation vulnerability by ryankask on Saturday April 01, 2017 @11:35AM (#14012588)

1password has changed recently. Are security experts recommending their newer cloud subscription service or the older version that stored the vault on Dropbox or another storage service (or both)?

[ Parent | on HN ]

Re:LastPass release fix for DOM manipulation vulnerability by arjie on Saturday April 01, 2017 @12:05AM (#14010343)

Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.

[ Parent | on HN ]