Feds Link Cyberheist to 2022 LastPass Hacks

https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/

by todsacerdoti • 1 year ago

383 258 1 year ago

krebsonsecurity.com

chinathrow2• 1 year ago

Me, looking at my local KeepassXC, calm, sticking with it.

selecsosi2• 1 year ago

They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.

rcMgD2BwE72F• 1 year ago

How do you make sure that file does not end up corrupt?

sneak• 1 year ago

Your hard drive is connected to the internet.

blackeyeblitzar2• 1 year ago

How do you sync it between devices like your phone? What about family sharing or access for emergencies or other such features?

mmwelt• 1 year ago

SyncThing[1] works very well for syncing with Android devices, but IIRC doesn't work with iOS.

[1] https://syncthing.net/

chinathrow2• 1 year ago

Actually I don't use it on my phone, at all. Another thing to care less about.

makeitdouble4• 1 year ago

This is the kind of control that is really becoming a luxury.

And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts:

Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass.

Moving to something like a self-hosted Bitwarden instance should be the way, but then one member of the family becomes a dedicated lifetime sysop making sure that instance is secure while being accessible anytime from everywhere.

TheDong3• 1 year ago

It shouldn't be a luxury, but it unfortunately is due to various big players refusing to play nice together.

If everyone has only apple devices (iphones + macbooks), then you can use a shared iCloud sync'd folder.

Except that doesn't actually work because the majority of iOS apps are incapable of using a shared iCloud folder correctly (including apple's notes app, most of apple's apps) because apple tries to hide the filesystem so much, that even saving a file into a folder is basically impossible for most apps.

That also doesn't work if anyone uses linux or windows because apple refuses to play nice with other ecosystems.

If everyone _doesn't_ use iOS devices, there are dozens of solutions that work well, from a shared google drive folder, to syncthing, but if even one person uses an iOS device, then suddenly none of the shared folders work, because apple has made it so creating a shared folder on iOS is bad for iCloud, but even worse for any third party app (be it google drive, syncthing, an FTP based solution, etc etc).

I guess what I'm saying is that apple tried to kill the filesystem, and in doing so has made it so the very idea of just sharing a folder of files securely seems like a per-app luxury.

Instead you need a shared photo album for photos, a shared notes folder for notes, a shared "apple invites invite" for a calendar event, etc etc. Apple has a lot to pay for, and a hatred for folders that has caused the entire industry to move away from simple secure app-independent sharing is one of them.

Instead, we have a jumble of apps being forced to implement their own sharing concepts poorly and often insecurely.

lotsofpulp• 1 year ago

I use Strongbox + iCloud Drive + KeepassXC.

alwayslikethis2• 1 year ago

Syncthing works great for this if you have an always on computer. If you don't you can use a server and add it as an untrusted recipient if you have to, though I would not bother since the database is encrypted with your password anyways, and is not vulnerable if you never reuse your db password and there is enough entropy.

noAnswer2• 1 year ago

I would argue that there is no need to sync all accounts between all devices all the time.

layman51• 1 year ago

The way LastPass had handled the incident back in 2022 is so disappointing. I don’t even how anyone could even recommend using them again.

some_furry2• 1 year ago

After my experience with LastPass (and trying to report cryptographic weaknesses), my answer to people considering switching is "RUN DON'T WALK"

https://soatok.blog/2023/01/21/how-you-respond-to-security-r...

gwern• 1 year ago

And still is disappointing:

Reached for comment, LastPass said it has seen no definitive proof — from federal investigators or others — that the cyberheists in question were linked to the LastPass breaches. “Since we initially disclosed this incident back in 2022, LastPass has worked in close cooperation with multiple representatives from law enforcement,” LastPass said in a written statement. “To date, our law enforcement partners have not made us aware of any conclusive evidence that connects any crypto thefts to our incident. In the meantime, we have been investing heavily in enhancing our security measures and will continue to do so.”

So, there's slightly less than conclusive evidence, and how much evidence should you need anyway, given the alternative hypotheses?

j16sdiz• 1 year ago

What else could you expect? It is their sole product.

Accept the responsibility and declare bankruptcy? No, if they care s little bit, they would have done that 10+years ago

czk2• 1 year ago

Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…

commandersaki14• 1 year ago

I think in some cases the iteration count was like 5000.

blackeyeblitzar2• 1 year ago

Didn’t many accounts have 5000 iterations by default

QuiDortDine• 1 year ago

Stick your passwords in the cloud, they said, nothing could go wrong they said.

CaffeineLD503• 1 year ago

Lol. I heard someone say that that the cloud was just someone else's data center behind an API but did people listen? Nope.

yieldcrv4• 1 year ago

someone else’s computer

BSOhealth3• 1 year ago

“Bitcoin has never been hacked”

Don’t have to hack crypto to steal all the crypto.

anonym29• 1 year ago

Bitcoin has never been hacked.

The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin.

To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broken, which is really just a fundamental misunderstanding of cryptography 101.

tpurves• 1 year ago

You know what every other online money transfer mechanism has? An ability to reverse transactions in the case or error or fraud. Because those things happen all of the time.

BSOhealth3• 1 year ago

Has the dollar been hacked?

sanswork• 1 year ago

Not true.

"On August 15, 2010, an anonymous hacker exploited a critical vulnerability in Bitcoin, allowing them to generate 184.467 billion Bitcoin."

yieldcrv4• 1 year ago

Right, and its working perfectly for the current bearers of that crypto

The PvP nature is continual demand

FiloSottile• 1 year ago

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

aryonoco6• 1 year ago

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk.

In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file.

serf• 1 year ago

But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file.

technical possibilities aside, do you presume your grandchildren will be technically apt?

I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

notpushkin2• 1 year ago

One of the reasons I’m using Passwoed Store: https://www.passwordstore.org/

Though the tooling isn’t great – I’ll probably switch to Vaultwarden sometime this year.

nicolas_t• 1 year ago

It's such a pity that bitwarden's client doesn't work offline for modifying vaults (need to be online to be able to access the server implementation). I would switch from my old local vault 1password in an instant.

noduerme• 1 year ago

I still rely on a gpg encrypted text file for storing my passwords, too. 25 years of that and it's second nature. No other solution has ever appealed to me.

notesinthefield3• 1 year ago

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

JumpCrisscross• 1 year ago

Bitwarden truly doesn’t get enough credit for being completely open source

It’s their No. 1 selling point.

In 50 years time, who knows if any of these companies will be around

1Password has local clients. If you have the password, you should be able to unlock the vault locally.

MartijnHols3• 1 year ago

Proton Pass truly doesn’t get enough credit for being completely open source, more user friendly, and hosted outside the US (wouldn’t want to lose access to your vault [1]).

[1] https://berthub.eu/articles/posts/you-can-no-longer-base-you...

ehnto• 1 year ago

I am fascinated by the idea of being 50 years from now, and doing digital archaeology more or less. So much of our actual output is now digital and stored digitally.

Given how I have experienced technology up until this point, my assumption is that everything I will create for work or for pleasure, is more or less ephemeral. It has certainly proven true for work.

nytesky2• 1 year ago

I backup some what similarly.

Curious, how is Excel encryption? That may be a more approachable format than CSV GPG, and though technically the CSV GPG is more simpler, it may be less familiar to users in 100 years. Excel will still be around ;)

3np• 1 year ago

That's table stakes today. LastPass was not up to standards.

alwayslikethis2• 1 year ago

Wouldn't it also make you lose everything in a recovery scenario? If all your computers are lost in a fire or flood, you would lose the recovery key, and having your password would not be enough to recover your database. I use keepassxc with a somewhat long password with a high PBKDF iterations count, which would not require having any devices in the event of a loss.

iav• 1 year ago

Except for crypto, losing your passwords is annoying but not irreversible

aborsy2• 1 year ago

Loosing everything if you don’t have a key is part of the appeal.

choo-t• 1 year ago

Having one of your backups out of site will prevent its loss during a fire/flood scenario.

al_borland• 1 year ago

There is an option to print out recovery info. A sheet with a QR code and a space for you to write your password (or not, if you don't trust keeping those 2 things in one place). That paper can go in a safe deposit box, with a trusted family member / friend, or in some cloud service you'd still have access to. The QR code + your password allow for recovery.

ksenzee• 1 year ago

Your phone also has the recovery key. Having a copy on your person does lessen the chance of losing all your copies at once.

_2d302• 1 year ago

I'm a bit confused on how the LastPass hack enabled the loss of passwords. I assume it works the way that I understand 1Password to work which should mean this would still be very difficult to impossible to do. Can anyone explain what I'm wrong about in terms of how the password managers work or how LastPass works differently?

So the way that I understand 1Password to work is that the decryption key is split in two: the user's single password + a secret key. You need both to decrypt the vault. The secret key is, again according to my understanding, generated randomly and is like 128bits? Once 1Password generates it and sends it to you (maybe they don't even send it and it is generated locally, I don't know), they never see it again. Thus, even if your vault were stolen, the thieves would need to crack your password (very likely not that secure) but also the 128 bit secret key so you would have a minimum of 128bit security which seems fine?

What's different about LastPass? Were the secret keys stolen somehow too? Were the targets of the stolen vaults then hit with further attacks to extract the secret keys? Does LastPass not use a similar structure as 1Password? Or am I actually not as safe as I thought using 1Password?

dathery2• 1 year ago

LastPass does not use the secret key concept that 1Password uses, it only uses a key derived from your password. After the breach they rushed to increase the hash iterations [1] and added features to let enterprise admins set minimum iterations [2] but of course it was too late at that point.

[1] https://palant.info/2022/12/28/lastpass-breach-the-significa... [2] https://support.lastpass.com/s/document-item?language=en_US&...

_2d302• 1 year ago

Got it, thanks!

colechristensen• 1 year ago

I was under the impression that basically lastpass knew your password, 1password does not. Lastpass owned the whole key. With enterprise organizations though we can still reset a users password if they forget so 1password might “know” your password too. Maybe older versions or individual versions are more secure.

dathery2• 1 year ago

It would probably be more accurate to say that LastPass has the information to decrypt your vault if they can guess your password. By contrast 1Password would need to both guess your password and guess your personal secret key. The latter is effectively impossible assuming the key generation was well-implemented. The trade-off is that users must keep track of their own secret keys.

semicolon_storm• 1 year ago

Adding on to what others have said, LastPass stored vault "metadata" unencrypted. Metadata included things the url. This allowed the attackers to prioritize cracking vaults of higher value.

See a vault with just a facebook.com and google.com login? Skip it. See a vault with coinbase and 10 other crypto sites in it? Spend a few thousand trying to crack it.

Source: https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...

CaffeineLD503• 1 year ago

LastPass understandably finds there to be no evidence linking the two. Uhm, OK.

But what's also hard to believe is that people storing millions of dollars of "collectables" would not change their passwords on at least a yearly basis.

I know that password rotation for its own sake is no longer best practice, but in this case it still seems quite prudent. No?

koolba• 1 year ago

You can’t change the seed phrase for a derived wallet. You’d have to create a new one and transfer the assets.

yieldcrv4• 1 year ago

glad to see the crypto discussion here getting more nuanced and technical

allset_• 1 year ago

Which you should absolutely do when the company storing your seed phrase gets hacked.

naet• 1 year ago

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one.

It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home office but that would be a pain to look up and enter things every time (and a big risk for anyone with physical access to my place).

7256862• 1 year ago

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

joshstrange• 1 year ago

The problems with this method are numerous:

* If 1 to N password(s) leak the pattern may be obvious leading to your other accounts being compromised

* Not all sites have the same password “rules” so there is no algorithm that works for all passwords without you being aware of the rules of the given site. Rules that only you only (may) have access to at signup time.

* Typing passwords out manually sucks (slow and error prone)

9x394• 1 year ago

But where do you store emergency codes? Or secret metadata for things? I think these are common artifacts to accumulate.

A password manager is ideal for these when security is far more than passwords at this point.

itscrush• 1 year ago

Bitwarden for usability. Vaultwarden if you can and prefer to self host. Being on the internet you'll have to trust someone at some point. Can reduce risk by combining strong 2FA (not SMS/Email) alongside backing up your vault.

Ensure all your passwords get reset at some point after vaulting, long randomly generated from Bitwarden extension/app is easy enough. Ensure you enable strong 2FA at each service you have an account at too.

https://bitwarden.com/help/setup-two-step-login/ https://bitwarden.com/resources/guide-how-to-create-and-stor...

briHass2• 1 year ago

Passkeys tied to actual hardware, like the TPM-based solution in Windows Hello, whenever possible, Keepass where not.

Keepass DB cloud synced, but the passkey file I use in conjunction with a p/w to open it never leaves the machine(s) it's on. Also, key file needs Admin rights to read, so KP is run privileged, which also protects its process memory space from user-land snooping.

loufe2• 1 year ago

Even better than the TPM in Windows is a hardway FIDO2 or OTP key, I'd imagine. Those cannot be comprimised by a virus on your PC in the same way, assuming you don't leave the key in at all times and you only tap the button when explicitly logging into something that would require it.

loeg• 1 year ago

They use 1password.

Havoc• 1 year ago

Self hosting a password manager is not trivial but definitely doable

JadoJodo2• 1 year ago

I switched away from LastPass after the 2nd major security breach sometime around 2013. Wikipedia only shows 3 total incidents, but I know I've seen reporting on _at least_ 5 between 2010 and today. In that time, I've continued to run into its use at companies, and it's honestly surprised me each time. Something something fool me 5x…

yard20102• 1 year ago

How come this is legal? By now this is a business practice. Why would the government close down a restaurant after food poisoning but do nothing here?this is much worse, considering all this money goes to the axis countries?

JadoJodo2• 1 year ago

I don't think there's anything illegal about being terrible at your job (information security), but I do think it's a tragedy that LastPass has somehow avoided the public shaming they so desperately deserve for their repeated ineptitude.

sciens3_2• 1 year ago

Centralizing everyone’s credentials after all these years still seems like the most risky idea ever. The only thing possibly more attractive to a hacker would be free sex and drugs, but only for a little while, and then they’d go back to trying to steal everyone’s credentials.

Some other targets: everyone’s PII, info on friends, family, pets, answers to security questions, mobile IDs, PIN numbers, account numbers, signatures, photos, fingerprints, voice patterns, facial and retinal scans, gaits, DNA, mitochondrial RNA.

n8m83• 1 year ago

I have similar gripes, but I still feel like on balance, randomizing passwords across accounts is more important. Selfhost vaultwarden ftw (or not — don’t f*ck it up)

sciens3_2• 1 year ago

Selfhost vaultwarden ftw (or not — don’t f*ck it up)

Right. Randomizing passwords doesn’t require centralization.

nonoesp• 1 year ago

Sharing a short post I posted a year ago with some thoughts on password managers.

## The password-management promise

I don't buy the promise behind 1Password or LastPass.
You only need to remember one password. The last password you'd need to remember.
They don't tell you that you're also building a one-stop shop for hackers to steal it all at once.
The solution?
Store hints, not passwords.
Don't reuse passwords. Use algorithmic passwords instead.
Use passkeys and security keys.

https://sketch.nono.ma/the-password-management-promise

---

I've always preferred 1Password and Bitwarden to LastPass.

I still prefer to encrypt sensitive data and "secure notes" with custom workflows (GPG keys, for instance) instead of relying on third parties, and even more when the data would be store in the cloud, in a centralized location.

I can't imagine the nightmare of having all your secrets exposed, not just for the risk of it but for having to reset all your exposed accounts.

(+1 to GPG encryption.)

dcchambers2• 1 year ago

I used to be really skeptical of online password vaults. I thought they were an obvious Honeypot begging to be hacked. But if I understand the technology behind 1password correctly, there is literally no way for a hacker to sign into my account on a new device without having one of my other devices or my secret key (the actual 34 digit encryption key used to verify my account and set up new devices).

So even if they know my 1password username and password they still can't really do anything with it. And if they steal my device, they would need to know my login password. Or cut off a finger, I guess, but I've got bigger issues if that happens.

They don't all work this way, but 1Password seems to be by far the best and most secure option, and IMO the convenience of an online password vault simply outweighs the tiny risk with a proper vault like 1password.

No idea why anyone has stayed with LastPass after the fiasco a couple years ago though.

psunavy03• 1 year ago

So even if they know my 1password username and password they still can't really do anything with it. And if they steal my device, they would need to know my login password. Or cut off a finger, I guess, but I've got bigger issues if that happens.

https://xkcd.com/538/

mcoliver• 1 year ago

One thing that I don't see mentioned very often with regards to the last pass breach is that 2fa seeds for their Authenticator product were also compromised and taken. Meaning not only could the attackers gain access to passwords, if you were using last pass for 2fa they had that as well.

jongjong2• 1 year ago

I've repeated over and over that password manager services are a horrible idea. Trusting a single service with all your passwords is worse than using the same password for all services (of the same sensitivity level) IMO. The ideal solution is to come up with a secret heuristic to come up with different passwords for different services. I kept getting downvoted for this. Well, IMO, these people deserved to be hacked.

I've never been hacked, never been locked out of any accounts.

I'm getting tired of being proven right about everything over and over after being downvoted. It's a very common pattern for me.

gblargg2• 1 year ago

What if you used a password service, but modified the password it puts in manually (and didn't let it update when you log in)? Would an attacker try variations, or just move on when your password manager-provided login doesn't work?

jongjong2• 1 year ago

This would probably help a little bit in terms of security but you would still depend fully on your password manager for access to various services. Personally, I don't like the dependency aspect of password managers.

I hate having to log into my password manager first before I can log into the service... And I don't like having to adhere to the whims of the password manager about things like changing my password every 6 months or using certain characters... It's really none of their business to determine what level of security is appropriate for me when trying to access my Instagram account which I barely care about anyway. I'm not some billionaire with teams of hackers trying to crack into my account 24/7.

I hate it when I can't use certain passwords because the password manager thinks it should contain certain characters which I simply won't remember.

I hate when trying to log into LastPass with my master password and I can't remember my password and have to try like 10 permutations to find the one in the format that it forced me to use last time that it forced me to change my password.

I hate getting locked out of LastPass and having to go through its 'Forgot my password' flow only to find out that the password for my email account which receives the email password reset link is also controlled by LastPass... And it's only by the grace of god that I had not trusted LastPass to generate my email password for me and I was able to guess it and didn't end up fully locked out of all my services which I need for my work.

That last experience was so scary, I actually wrote down my LastPass master password on a piece of paper and put it in my desk drawers so that I would not forget it. I know this is insecure but that sort of risk profile is aligned with my current non-billionaire status. Somehow, I don't think North Korea is going to send spies to my house to peak into my desk drawers to break into my work accounts...

9x394• 1 year ago

The ideal solution is to come up with a secret heuristic to come up with different passwords for different services.

How long does it take you to enter several keys of 16+ length for a few sites you might to access? A password manager can autofill, retrieve and input keys, provide an OTP in a few seconds.

Where would you store your emergency codes and other secret-like artifacts?

It just seems impractical for a person, let alone edge cases like sharing, or usability concerns like working with secrets frequently throughout the day.

I've never been hacked, never been locked out of any accounts.

Due to the strength of your system, general digital hygiene, or simple odds? If we're getting really contrived, how do you maintain confidence your heuristic can't be guessed from X plaintexts obtained from breached sites (highly common)? That's kind of like rolling your crypto, isn't it? -- doing it correctly is beyond almost all of us.

commandersaki14• 1 year ago

I feel like anyone with a visceral reaction to password managers that sync/store on cloud storage do not really understand E2EE. LastPass is really the only exception that didn't implement it properly.

ginkgotree• 1 year ago

3 Words: 1Password. 1Password. 1Password.

Ok, Im not sure "1Password," qualifies as a single world. Oh yeah, 1Password.

alfiedotwtf• 1 year ago

Get rid of passwords or GTFO!

PAKE has been around for about 25 years, and PassKey just works!

It’s 2025, and we have things like PassKey that connects to hardware devices with a challenge response rather than clear text passwords being sent to a website you THINK is the one you’re talking to.

moktonar2• 1 year ago

SPoF again..

hayst4ck• 1 year ago

This is such an under-rated comment for this whole thread.

This was my gut response to password vaults when they were first implemented. I still find the idea of password vaults spooky.

Open source ones scare me because it seems easy to slip a compromised library. The XZ debacle can't be the only time that's been tried.

All of them scare me because a bad browser extension or a more minor hack, like a trojan, could likely compromise all passwords.

Games on steam sometimes have some ridiculously privileged anti-cheat software, run by who knows what company, some of which offer direct RCE, in a process that already looks into other processes memory.

Virus scanners routinely analyze every single file on a computer and maybe memory too.

It just seems so... possible.

commandersaki14• 1 year ago

In the same league of paranoia someone could do a supply chain attack of your favourite browser engine to siphon cookies, credentials, etc.

moktonar2• 1 year ago

New fear unlocked: cloudflare

yard20102• 1 year ago

In my opinion Karim Toubba is liable and shouldn't be allowed to have more than 69$ forever.

alwa• 1 year ago

I don’t totally know what this comment is attempting to communicate, but Karim Toubba apparently had been CEO for 4 months at the time of the original breach:

https://www.cybersecuritydive.com/news/lastpass-ceo-reflects...

SpaceL10n• 1 year ago

Remember when LastPass first came onto the scene and everyone thought it was weak and not trustworthy? Pepperidge Farm remembers.

commandersaki14• 1 year ago

I was recommended LastPass by Lujo Bauer a professor and security researcher that has done a lot of work in password security - but this was in its nascent start-up days circa 2013). I think worse than low iteration count on password hash, I wasn't aware for the time using LP that it didn't encrypt a lot of the metadata and that concerns me greatly. I was and still use a 96-bit passphrase, so I would've been safe from the breaches from an offline attack perspective, but metadata would've been exposed which bothers me. I switched to 1Password in 2017, so hopefully they expunged my data before the breaches, but who knows.

gruez2• 1 year ago

Source? Were those concerns clearly articulated rather than something vague like "password managers are a single point of failure!"?

taikahessu• 1 year ago

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far.

Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it.

If you're using Lastpass right now, move to more trustworthy options like 1Password, Bitwarden or Keepass. Do it today. And change all passwords, that are meaningful to you.

mock-possum• 1 year ago

I swapped to BitWarden a few years back and there was almost no friction - export from LastPass, import to BitWarden, get used to the inevitable handful of UI quirks, and you’re good to go.

aborsy2• 1 year ago

1password is a good choice.

serkanh• 1 year ago

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

bognition• 1 year ago

Yes it’s annoying but it also means increased revenue which enables them to invest more in the product.

The new features released since I bought version 6 has me more than satisfied.

Also using a password manager is one of the most effective things you can do to protect yourself and paying a few bucks a month seems like a steal.

rmellow• 1 year ago

Yes, they felt very pushy with this & other tactics to get me to use new features.

That creates distrust in me, so I swapped to BitWarden and haven't looked back.

jorvi• 1 year ago

With the way the Apple is going in the UK, I'd rather give 1Password the keys to the kingdom.

Their whole raison d'etre is protecting your passwords. If they start selling people out, their business implodes.

They also keep adding thoughtful tweaks and new features. A couple years back I thought I'd give it a few years and then hop from 1Password to Bitwarden. But Bitwarden's UI and UX is still subpar (doesn't even support drag 'n drop..)*. All Bitwarden does is invest in enterprise features, which mean jack for the average user.

*dragging items from one vault to another, not a hugely important feature but Bitwarden has a thousand of these kind of paper cuts compared to 1Password

jonpurdy• 1 year ago

Highly recommend Strongbox. The underlying DBs are KeePass DBs and can be stored anywhere as well as opened with any KeePass client, with a UI even better than 1Password (you can have columns for every field) as well as passkey support + export/import (even before the official method came out because they believe in you owning your own data).

I love it because Strongbox also has its own cloud feature (optional) that is just a hosted KeePass DB which makes it easy to have a shared DB with my partner.

The only downside for me: there isn’t a universal search that searches all DBs for credentials. So if you are in a browser and trying to autofill, you need to select the DB you want it to populate from.

pier25• 1 year ago

except for the fact that they basically forced users to use their cloud offering

Yeah that's when I left 1P after having bought hundreds of dollars of licenses for myself and my family (for multiple OS).

The other big thing was self hosting the vault. You used to be able to sync the vault with Dropbox and access it from a browser but at some point Dropbox killed public folders. It would have cost 1P pennies to store the vaults of paying customers in S3 buckets. Instead they decided to use that as leverage to force people into subscriptions.

Very happy with Bitwarden now.

mlissner• 1 year ago

Just for the record, they are being sued to oblivion:

https://www.courtlistener.com/docket/66607916/debt-cleanse-g...

You'd have to go study the case, but it's a class action case, so it'll hurt if they lose (and even if they don't). The court appears to be consolidating cases into this one, because LastPass has been sued in federal court 15 times so far:

https://www.courtlistener.com/?q=lastpass%20AND%20(caseName%...

UltraSane• 1 year ago

I like Bitwarden and selfhost a vaultwarden server on the cheapest instance AWS has. The server only needs to be running when I change the local database. I created a API key with only the ability to start and stop this one instance. The server is only accessible over a Tailscale tunnel so it is extremely secure. It is neat making servers available over a Tailscale tunnel because you don't have to have any open ports at all. I snapshot the instance disk to S3 when it changes. This way i can securely store my passwords on the world's most reliable storage and on my local PC.

Feds Link Cyberheist to 2022 LastPass Hacks

Related Stories