Dont think of last pass as a Password Manager think of it a a IQ test, last pass has failed on security lied and been far from truthful about security incidents, why would you trust them with your data? Would you ask a fraudster to look after your money ? Yes, I understand and I won't do that.
Functionalit wise, Lastpass is great. In terms of security, any cloud password manager is not to be trusted no matter how they market it.Hello guys,
I have a doubt: I didn't know about Lastpass, I only used Bitwarden (I'm sick of it) and offline password managers like KeePass. I created a random account just to check how Lastpass works and I liked it. Is anyone still using it? Is there any risk? If so, is there a product similar to LastPass?
I was reading on the LastPass blog and from what I understand, even if the data has been leaked, hackers will not be able to access the vault since there is no way to know the master password of each vault because LastPass is zero knowledge, but I could be wrong because I never used the service. What opinion can you give me about this?
Thank you all!
Cool, that's good to know. That's what I thought, as a password manager (in terms of functionality) it seemed excellent to me, but it has this other downside that you mentioned.
Users complained on Trustpilot on SP functionality on Mac. Anyway, give it a try and see how it works. Then try Enpass and see how it works and then you can decide what works best fir you.
While the hackers don't know the master passwords, by having copies of the vaults in their possession, they have an unlimited amount of time to crack them. Think about how bad people are at coming up with secure passwords on their own, and now imagine how many LastPass users were using weak master passwords when the vaults were stolen. The fallout's not going to be pretty.
Exactly, it is a gample I am not willing to take.
Really you are right.
"We have determined that an unauthorized party,[U] using information obtained in the August 2022 incident, was able to gain access[/U] to certain elements of our customers' information."Ultimately it's a personal decision. There's always risk no matter where you choose to store your data. Obviously this LastPass breach shows how damaging it can be if you choose to store your data on someone else's server, and that data is accessed by a malicious actor, but that doesn't mean it's guaranteed to happen. But even those who opt to store data locally are still at risk of malware infecting their system and exfiltrating that data (which, again, doesn't mean it's guaranteed to happen, but the risk is still present).
I really like KeepassXC, but the absense of dedicated mobile apps made me look elsewhere.
But storing password locally gives more control and peace of mind.
You are right. Offline password managers have attack vectors, but they are simply not prone to the same attack vectors of online password managers.
Remember not all users want control. (it’s the reason why HIPS aren’t popular) they rather have convenience.
You have a point here. Tbh if users are responsible of taking care of syncing password using for example Enpass, they might lose all of their passwords. Cloud password managers take care of that but that comes at a price.
I remember a few years ago. In another security forum, a user doing and suggesting what you describe here. Splitting passwords between password managers and IRLI will sync my passwords to the cloud no problem, but I will do the following, keep only a part of the password like this "3zN$KSohZn!vR78&cvXC" the rest that would be suffix or prefix would be basically like this + U4!5J%x^s* I will memorize the rest in my memory and if the cloud service is hacked good luck to the hacker
For Keepass, take a look at Keepassium and Strongbox available on iOS, not sure about Android.
For Android it is Keepass2Android or KeePassDX
Yes, exactly it was in security forum, I just remember where, later I saw it on Youtube, the curious thing is that the person who uses it this way is a developer seems more paranoid than me.
