LastPass stores passwords so securely, not even its users can access them

Re:LastPass stores passwords so securely, not even its users... by gregod on Monday January 20, 2020 @10:14AM (#22099334)

For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with.

When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.

[ Parent | on HN ]

Re:LastPass stores passwords so securely, not even its users... by tdons on Monday January 20, 2020 @03:09PM (#22101739)

This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately)

I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch).

Did you find a better solution?

[ Parent | on HN ]

Re:LastPass stores passwords so securely, not even its users... by gregod on Thursday January 23, 2020 @08:30AM (#22127346)

No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance.

Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.

[ Parent | on HN ]