Re:I Lost All Faith in LastPass
by pentest_bob on Thursday December 29, 2022 @02:28PM
(#34176784)
Not dismissing anything you said regarding 1PW but they also had cure53 audits. See e.g.
- https://cure53.de/pentest-report_1password-b5.pdf
- https://cure53.de/pentest-report_1password-mobile.pdf
Edit: overview of audits https://support.1password.com/security-assessments/
These are pen-tests and black-box security audits. While they're definitely better than nothing, and they would show that their security is better than LastPass', the code was never audited.
Re:I Lost All Faith in LastPass
by bendiksolheim on Thursday December 29, 2022 @04:43PM
(#34178428)
Are we reading the same reports? At least the two latest reports by Cure53 mentions "source code audit". In addition, the audits by ISE and AppSec explicitly mentions code review as part of the audit.
I am in no way familiar with these kinds of reports, but does this not mean that (at least parts of) the source code was audited?
Re:I Lost All Faith in LastPass
by Dylan16807 on Thursday December 29, 2022 @02:35PM
(#34176868)
> 1Password claims are the same claims as LastPass
And the whole post is about things other than the claims.
The part of the post about 1Password is basically "trust me, bro, a buddy of mine used to work there".
Re:I Lost All Faith in LastPass
by Dylan16807 on Thursday December 29, 2022 @02:46PM
(#34176997)
All the things about encryption don't fit that.
All the things about previous breaches and bug reports don't fit that.
You're describing about a tenth of the argument.
On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.
I use 1Password but the slowly worsening/slowening UI and move to a subscription model, along with the fact I can’t even upgrade to the latest version because I still sync my own vault are making me look around for an escape hatch.
I guess it’s the Keepass family of apps, or perhaps Bitwarden, but it’s disappointing to even have to think about switching.
My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.
Re:I Lost All Faith in LastPass
by zeroonetwothree on Thursday December 29, 2022 @02:27PM
(#34176767)
Indeed I think BitWarden has the better UX
One of the tests we recently added to 1Password is the "Moby Dick Workout" for secure notes with Markdown rendering. Would love you to compare 1Password and Bitwarden:
For me, my password manager is the one absolute thing I want to be auditable. 1Password with its follower "who know people who designed it" reminds me of "trust me bro", "funds are SAFU" in cryptocurrency projects. Leaving LastPass in order to sign up for 1Password feels like out of the pan into the fire.
I've always use and will always recommend FOSS for password manager. I install Bitwarden on my technology-illeterate friends and family and I use KeepassxXC personally. I've looked briefly how vaults are encrypted in both software. The security is sound. Bitwarden was audited by Cure53[1] which is one of my favourite security auditing firm. (I highly recommend to read their audit of dovecot[2])
Anyway, you know what they say "fool me once…". I'll be eating popcorn when some claim will turn out to be false for 1Password…
[1] https://cure53.de/pentest-report_bitwarden.pdf
[2] https://cure53.de/pentest-report_dovecot.pdf