LastPass Has Been Hacked

https://www.theverge.com/2022/12/22/23523322/lastpass-data-breach-cloud-encrypted-password-vault-hackers

by bapetel • 4 years ago

10 5 4 years ago

theverge.com

smcn• 4 years ago

https://en.wikipedia.org/wiki/LastPass#Security_issues

At this point, LastPass is a form of password sharing. No rational person should be trusting it.

If anyone wants an alternative, I'm a big fan of https://www.passwordstore.org/

drKarl• 4 years ago

Pass is nice, but I prefer KeepassXC because it's multi platform, Linux, MacOS X, Windows, Mobile and also command line, and you don't have to trust an online service not to be breached

almostjson2• 4 years ago

There are pass clients for all platforms. Although only the terminal variant is officially supported as far as I know, but that’s the same model followed by KeyPass

bapetel• 4 years ago

Thanks for sharing, I like how it works, I think I will use it. First, let's document myself a little bit again.

almostjson2• 4 years ago

For anyone looking for an alternative, let me pitch pass (https://www.passwordstore.org/). Think of it like it like the vim/emacs of the password storage space — it’s minimal, highly portable, easily expendable, has a minor learning curve, but is well worth it.

Pass essentially takes your passwords stores them in a regular file and encrypts the file using GPG. These files are then stored in a folder that uses git to do version tracking of the files. All this means that:

- Pass can easily be distributed (you can sync your password across devices via GitHub, Gitlab, or your own ssh/git setup) - Passwords are encrypted using GPG, so y unless someone has your private key they’re not decrypting anything - It’s open source and there is a client for basically all operating systems - If you can’t install a client or need to access a file, it’s just a regular encrypted text file so you can decrypt it using GPG and edit it how you see fit.

Things that suck: - Setup isn’t as easy as lastpass: You’ll need to generate an private key/public key pair. While this is fairly easy, sharing that key to your other devices can be hard especially mobile. - Your passwords are now protected with a key file not a single password (most likely it’ll be a keyfile protected by a key) so if you’ll need to make sure you back up that key. - It doesn’t just work, if you want cross platform usage, you need to setup your own cross platform distribution method. Although the pass community basically uses git for distribution so it isn’t horrible but not as seem less as other products

LastPass Has Been Hacked

Related Stories