The big difference between the two examples is this: LastPass is known to have bugs. Huge amounts of data were stolen from them and we just found out that it was a lot more than we thought.
For all we know, they were storing passwords in the clear somewhere.
Trivia note: the first compiled language I used was PL/I, and the compiler was notoriously buggy and would crash on well-formed programs. Our teacher told us to put do-nothing statements in when this happened (`PUT SKIP(0);` if I recall correctly), and with some trial and error, those would fix it.
Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.
The thing that's bad, is that apparently their developers have access to (backups off) production data. That implies that their security infrastructure is not different from regular startups at all so all of their marketing is just bullshit. They didn't sacrifice developer productivity for security on this point, so they can't be trusted to have sacrificed anything for security at any point.
No it isn’t.
> What would you have the people who are using LastPass do, stop using it?
Yes.
> Because some crypto dude…
No?
https://www.cnet.com/tech/services-and-software/lastpass-say...
https://www.forbes.com/sites/daveywinder/2019/09/16/google-w...
https://www.cpomagazine.com/cyber-security/lastpass-2019-pas...