News for hackers. Stuff that matters.

A comment on LastPass release fix for DOM manipulation vulnerability. Parent comment

Re:LastPass release fix for DOM manipulation vulnerability by gnopgnip on Saturday April 01, 2017 @02:46AM (#14010895)
The alternative is either going back to remembering passwords, sharing passwords between sites, or writing them down, or to switch to a similar product that has fewer features and an unknown amount of bugs with likely worse vulnerabilities because there are fewer people looking for them
[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by Artemis2 on Saturday April 01, 2017 @03:00AM (#14010932)
Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]?

These two products are very feature-complete (at least for my usage) and have as much attention as LastPass (with for example Tavis Ormandy working on both). They even publish information about their security model[2][3], which LastPass does not.

LastPass has proven repeatedly that it is not robust enough for storing passwords. Fewer or less important vulnerabilities reported does not equate to less security.

0: https://1password.com

1: https://www.dashlane.com

2: https://1password.com/files/1Password%20for%20Teams%20White%...

3: https://www.dashlane.com/download/Dashlane-Security-Whitepap...

[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by chrismonsanto on Saturday April 01, 2017 @07:04AM (#14011547)
> Out of curiosity, what LastPass features are you missing in 1Password[0] or Dashlane[1]?

Linux support

[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by daenney on Saturday April 01, 2017 @08:09AM (#14011745)
Enpass: https://www.enpass.io/apps/linux/
[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by noja on Saturday April 01, 2017 @12:04PM (#14012729)
Enpass ticks all the boxes, except... no-one ever mentions or reviews it. Has there been a security audit? Is it reliable?
[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by calvins on Saturday April 01, 2017 @12:27PM (#14012867)
It seems no security audit has been performed, but they plan on it at some point: https://discussion.enpass.io/index.php?/topic/404-security-a...

Their responses in that thread do not inspire confidence in the product for me, to put it mildly.

[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by noja on Monday April 03, 2017 @05:19AM (#14021536)
That was scary. I'm not going to be recommending Enpass.
[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by yegle on Saturday April 01, 2017 @12:06PM (#14012741)
ChromeOS support
[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by iraklism on Saturday April 01, 2017 @06:22AM (#14011456)
You are missing a middle ground alternative, keepass stored in OneDrive/Dropbox
[ Parent | on HN ]