News for hackers. Stuff that matters.
Re:LastPass bug leaks credentials from previous site by vz8 on Monday September 16, 2019 @11:30AM (#20985038)
Love to hear more about why BitWarden is a safer choice than Lastpass if anyone cares to chime in. Thanks.
Re:LastPass bug leaks credentials from previous site by Someone1234 on Monday September 16, 2019 @11:45AM (#20985239)
It isn't. But they're both safe choices.

Both are based on the same underlying principles (AES encrypted database, encrypted using a slow hash of the master password). Both have been audited professionally. Both have browser extensions whose source code you can read (it is JavaScript, just open the extensions directory). Both support a full array of 2F options.

People are moving from LastPass to BitWarden because it is a better product. Plus many dislike LastPass's owners due to the LogMeIn pricing/business practices (like difficulty cancelling/early cancellation to avoid additional billing/aggressive sales people/etc).

The only advantage BitWarden may have is its backend is open source software and you can run a copy yourself (although most choose not to). If you're running it yourself BitWarden is likely your primary contender. If you aren't the difference is largely academic.

Re:LastPass bug leaks credentials from previous site by Avamander on Monday September 16, 2019 @12:10PM (#20985529)
Pretty sure LP's source is minified/obfuscated, it isn't just "open the extension's directory". In my experience LastPass was also much much slower in too many use-cases.
Re:LastPass bug leaks credentials from previous site by vz8 on Monday September 16, 2019 @11:55AM (#20985363)
Thank you, that's helpful.
Re:LastPass bug leaks credentials from previous site by propogandist on Monday September 16, 2019 @12:22PM (#20985686)
lastpass' privacy policy is very privacy hostile. They're now aggressively offering a free product with the ability to monitor (and sell) all browsing behavior tied to you as an individual (thanks to LogMeIn).

>How We Use the Information We Collect and Receive

>LogMeIn may access (which may include, with your consent, limited viewing or listening) and use the data we collect as necessary (a) to provide and maintain the Services; (b) to address and respond to service, security, and customer support issues; (c) to detect, prevent, or otherwise address fraud, security, unlawful, or technical issues; (d) as required by law; (e) to fulfill our contracts; (f) to improve and enhance the Services; (g) to provide analysis or valuable information back to our Customers and users. [1]

(e) is a very broad and loosely defined category. A contract can include Anything and this ambigious statement enables LogMeIn to inturn do anything with data they collect from all their services (including Lastpass).

In the new firefox updates, Lastpass won't let you open/run the extension until you provide it the abiltiy to monitor all browsing behavior (whereas on chrome I have it restricted to monitor sites when the extension is clicked/activated)... I will not be renewing my premium service and am looking to migrate away to another service.

[1] https://www.logmeininc.com/legal/privacy

Re:LastPass bug leaks credentials from previous site by jsutton on Monday September 16, 2019 @12:47PM (#20985954)
LastPass only collects data on how you use the product and how well the product works. It doesn't collect info about your sites or browsing activity.
Re:LastPass bug leaks credentials from previous site by propogandist on Monday September 16, 2019 @07:35PM (#20989609)
Says who? It's governed by this privacy policy and will not work until it has browsing and tab data
Re:LastPass bug leaks credentials from previous site by president on Monday September 16, 2019 @01:13PM (#20986272)
In my experience, LastPass UX leaves a lot to be desired. Also, I've heard a lot of stories regarding security negligence at LogMeIn (parent company of LastPass).
Re:LastPass bug leaks credentials from previous site by eitland on Monday September 16, 2019 @11:40AM (#20985166)
Allows you to run your own server.