For a year or two, lastpass for Firefox didn't have the copy option for usernames and passwords. I had to edit, show password, then copy.

The autofill problem became pronounced after the acquisition as well probably through no fault of the new owner. Many sites like Google and Microsoft have switched to a multi-step login process where username is entered first and password is entered on a different page

Also a proof of sites abusing autofill & hidden forms to steal passwords probably influenced the current situation.

(Now I just stopped holding my breath. Ah, breathing is good!)

Go to a site with saved passwords e.g. http://news.ycombinator.com

Lastpass icon changes to show you have an entry. Click the icon, click "Show matched sites." Hover over the entry and you'll see three buttons: Copy username, Copy Password and More options.

I'm assuming these buttons don't work for you. Right-click instead on the entry and you should see a menu with the following items: Autofill, Copy username, Copy password, Copy URL, Go to URL, Edit, Delete.

Try the copy password entry. Hope it works for you.

Years ago it was Hamachi (the LAN-over-internet software). Then it was LastPass and via it XMarks (itself acquired by LastPass shortly before). XMarks suffered much more grievously than LastPass — I suffered data losses on multiple occasions before finally throwing in the towel.

password-store uses git+gnupg so backing them up is a matter of distributing the git repo. My git repo lives on each of my laptops and I have a 'central' host of it...so it's backed up via distribution.

For getting passwords to my phone I use a homemade Android app + small web app that sends them to my phone encrypted on-demand from my laptop or desktop. There are Android apps for using password-store but you have to put your GnuPG keys on your phone for that and I prefer not to do that.

UP (uncle post) mentions a home-made Android app to sync... is there a more mainstream option?

But overall, yeah, it has been better than LastPass.

Agreed, ambiguously named form input fields cause all kinds of havok, I helped our UX team track down one in our application because it was breaking my lastpass =)

For the second issue, I've just adjusted my workflow to accommodate LastPass's peculiarities. I just click "Generate Secure Password", copy it to the clipboard and fill the form myself. Then I have a copy of the password on the clipboard should LP miss adding the site properly.

While it's a slight pain to work around that particular issue, it's far better than what I used to do with regards to password reuse.

I'm not that familiar with mobile dev, but could a rogue app just sit in the background, making a copy of whatever's in the clipboard?

Lastpass mitigates the issue somewhat by clearing the clipboard after a certain amount of time.

That is nice, but it is not sufficient mitigation for the issue to be dismissed.

There are more concerns in this article than the title issue, and it seems that in the past, LastPass has made some questionable design decisions that did turn out to have problems that needed to be fixed. I hope and assume that, prior to adopting these design choices, LastPass analyzed the risk and concluded that it had avoided creating any vulnerabilities, but nevertheless, there were some that it had overlooked.

If you continue in this manner, you are increasing the risk of creating a zero-day vulnerability that gets exploited, and I would guess that a central repository of passwords would be a particularly attractive target for bad actors. I would much prefer a security company to stay away from questionable design choices, rather than have rather complex and more-or-less tendentious arguments that the way they are doing it is safe, especially when there have been cases in the past where their arguments were not sound.

> This is just not something I have enough cycles in the day to let bother me.

Another reason to prefer KISS. If the vendor had refrained from making questionable choices that require complex analysis (such as the decision to fall back to server-provided pages for parts of the browser extension functionality), trying to figure out whether it matters to you would be less of a problem -- to the point, maybe, where you don't fall back on an "I can't be bothered" attitude.

I don't have time to really think about all this complexity and what it means for my security. So I just avoid it entirely.

I use a few different versions of keepass on two laptops and an android, and they all share a keyfile through dropbox. I get most of the same functionality that my wife does through LastPass. It's convenient enough that I don't see any reason to migrate to LastPass, despite their much more polished user experience.

I'm forced to use LastPass at work, and personally find KeePass to be a much better user experience.

A. The auto-fill extensions don't work on enough sites to make it annoying (maybe ~20%). Auto-type is a more consistent workflow for me.

B. Lastpass (and friends) browser extension doesn't do anything for desktop apps, SSH sessions, or anything outside the browser. You have to copy and paste one at a time.

C. I like all my passwords to be a particular format because it frequently happens that I have to type them in manually (Phone, vCenter console, BIOS, etc.) and I just like that to be easy. (I use 5 groups of 4 lower case separated by periods, with one number and one upper case letter in the last group. Still very strong but also manageable to type into an iPhone).

D. I like to record more than just passwords (the email I used, answers to security questions (always random, but legit looking), bank and credit card details, stuff like that). The KeePass UI for keeping those kinds of notes is just so much cleaner, simpler, and better than anything else.

E. KeePassXC has first class support for Yubikeys.

One mitigation is to use Firefox account containers.

If I navigate to what claims to be Bank of America, but the tab doesn't open in my "Banking" container, that's a huge red flag.

Also, as another poster mentioned, Lastpass sometimes fails to autofill. Unless a manager can achieve 100% error free operation (unlikely), even autofill managers will also have a risk of phishing.

I don't think there's one correct answer. For me, as an expert who's confident about my security posture (2FA, verbal passwords for vendors that can reset 2FA, backup codes stored securely offsite), I value the simplicity of Keepass.

The website from the service in question also suffers from severe JS-errors on their page (FF 66).

I always manage my passwords on my computers, and type in on phones as needed. Simpler and just works.

To easy the pain of typing passwords, I always follow a consistent format that's easier. Example:

7,#/T8z%FS%zht6S

ctaq.zwjd.qnbu.ut1A

The first one is terrible to type on a little Android keyboard whereas the second is a breeze, and still perfectly respectable as far as password strength goes.

[1]something that will not likely happen between family, work, and chores around having a large property

I respectfully disagree that apps are the same as webpages. The big difference is that apps are signed, so if things are done properly, you only have to trust the devs of the app and whoever operate their CI. Web pages on the other hand have no such security (yet), which means you also need to trust the cloud provider, the CDN, the fact that the website was not hacked, the ops team of the password manager, and probably anyone who is able to make a valid SSL certificate and might do MITM...

Disclosure: I work for a company that makes a cloud-based password manager.

This seems to me like a great argument to avoid all cloud based providers and their mobie apps. Especially when opensource, time tested, self-hosted solutions exist.

You seem to be more concerned about UX than security. Compromising security for better comfort is not a very good strategy.

From my practical observation: People will go to great length to avoid dealing with a crappy UX. That can include falling back to "YOLO, I'll just use the same password everywhere" if the password management process is sufficiently atrocious. So I'd say good UX is part of the security concept, bad UX will compromise it.

Maybe, but a good UX goes a long way to convincing people to use the solution. The best security solution is the one you actually use.

People are reusing passwords and writing passwords down on post-its specifically because they haven't found sufficiently UI friendly options of password management. Regardless if that is out of ignorance of available options, UI not being friendly enough for them, or some other technical hinderance.

A compromise isn't weighing between an ideal scenario and your current situation. A compromise is finding an optimum between value extremes in acceptable real world scenarios. An ideal security extreme is a disconnected system, but that's never something you can compromise towards since the comfort/usability reaches 0.

You're trying to move security up by getting users away from pass reusage and post-its. In this case added comfort happens to also be increased security.

Any app that gets updates is vulnerable to that type of attack.

This approach is exactly why the vast populace has essentially no security. I'd be glad if my parents were to switch to last-pass, as it is so much better then weak password re-use schemes.

I'd say that compromising security for comfort is a given, its guaranteed to happen. The best strategy here is to make sure that users will have the most security after the compromise.

I think a lot of people feel uncomfortable giving a proprietary product access to their passwords, and feel more comfortable doing the copy-and-paste themselves. But compromising security for better comfort is not a very good strategy.

Keepass has a third party Firefox extension that does this. Bitwarden is open source and has their own extension that does the same.

My annoyance is lately it's become less skilled at detecting password changes properly, even when I'm invoking 'Generate Password'.

I think this is a good argument against cloud-based or auto-updating password managers in general.

What do you mean? How are you measuring that? How do you think that would make a password of the same length and character set less secure in a practical way?

https://security.stackexchange.com/questions/77345/security-...

So it seems like LastPass-generated passwords are fine?

[1] https://developer.mozilla.org/en-US/docs/Web/API/Window/cryp...

The thing is, there is a chain of things you have to trust wrt the LP generator: Has the OS implemented the backend API correctly? Were there issues in the browser build that mess up the entropy derived from the OS seed? Has the Javascript done anything stupid?

In comparison, I have complete confidence in the entropy of the passwords I generate via CLI.

Wrt. password length: yes you can change it. But the dialog is a bit of inconvenience that tilts away from the hassle of switching to my terminal and typing "suggest-password". And I have something of a moral objection to password generators that default to insufficient entropy.