News for hackers. Stuff that matters.

A comment on LastPass stores passwords so securely, not even its users can access them. Parent comment

Re:LastPass stores passwords so securely, not even its users... by tdons on Monday January 20, 2020 @03:09PM (#22101739)
This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately)

I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch).

Did you find a better solution?

[ Parent | on HN ]
Re:LastPass stores passwords so securely, not even its users... by gregod on Thursday January 23, 2020 @08:30AM (#22127346)
No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance.

Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.

[ Parent | on HN ]