Should you be concerned about LastPass uploading your passwords to its server?

Re:Should you be concerned about LastPass uploading your pas... by Razengan on Friday April 05, 2019 @08:12AM (#19581722)

I've only ever used Apple's iCloud Keychain [0]. It has always worked great, and seems to have good security in order to enable; it asks for the local login password that you signed onto one of your other devices with, but it feels scarily easy to see ALL your passwords in plaintext with just a single Face ID authentication.

I'd be more comfortable with bio-authenticating per password (though that might use more battery) and preferably asking for the password/code if you look up more than 5 passwords too quickly, but I'd rather have to trust a big company than a smaller third-party that gets acquired and sold around.

What are the advantages of LastPass and other password managers over iCloud Keychain?

[0] https://support.apple.com/en-ae/HT204085

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by perlgod on Friday April 05, 2019 @09:15AM (#19582169)

I too was a happy user of iCloud keychain for many years. Except one day, I made a new password on my Mac, but even after a few hours it hadn't sync'd to my iPhone.

I followed some instructions and toggled iCloud keychain sync on my iPhone (just turned it off and on) and it proceeded to erase about 250 of my 300 saved passwords. Wasn't able to get to my other devices fast enough to turn off the networking - they had all already been deleted from my Mac, iPad, etc as well.

Spent an entire weekend resetting passwords - never again. I am now a happy Bitwarden user. Even if it eats all my passwords one day, at least it's trivial to export them all to CSV.

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by gruez on Friday April 05, 2019 @09:15AM (#19582166)

>preferably asking for the password/code if you look up more than 5 passwords too quickly

Great, so rather than being able to access all your passwords, the attacker can only access your two personal email, company sso (including email), and two bank accounts. The rest can be obtained with password resets.

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by SamuelAdams on Friday April 05, 2019 @10:32AM (#19582879)

LastPass is cross platform. I use an iPhone, a Windows 10 desktop, and a linux laptop. How do you access iCloud Keychain on non-apple devices?

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by bigbadgoose on Friday April 05, 2019 @11:03AM (#19583214)

I slack them to myself, of course

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by aloer on Friday April 05, 2019 @08:35AM (#19581872)

If only there would be a browser extension for anything other than safari on OS X. Manually copying passwords (and then saving in chrome) gets real annoying

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by Razengan on Friday April 05, 2019 @09:40AM (#19582355)

Can't check now, but I thought Chrome did integrate with the system Keychain.

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by jonlucc on Friday April 05, 2019 @09:59AM (#19582531)

I don't use Keychain to manage most of my passwords (because I have Windows devices), but when I click a password field, the space above the keyboard says "Passwords". If I click on that, it lets me choose between LastPass or Keychain.

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by lotsofpulp on Friday April 05, 2019 @08:17AM (#19581748)

I use keychain for convenience, but I also don’t enable touchID or faceID for this very reason. Too easy for someone to gain access to all of your credentials. With touchID, anytime you’re unconscious, anyone can get access to all of your stuff.

KeepassX works well as the actual database of credentials.

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by sneak on Friday April 05, 2019 @05:23PM (#19587176)

What is your threat model where someone has access to you while you are unconscious who also wants your web passwords?

[ Parent | on HN ]

Re:Should you be concerned about LastPass uploading your pas... by lotsofpulp on Friday April 05, 2019 @07:31PM (#19588041)

I don’t understand the question. I don’t want anyone to be able to get access to my credentials while I’m unconscious or incapacitated, so I don’t use touchID or faceID.

[ Parent | on HN ]