290
Researcher uncovers one of the biggest password dumps in recent history
(arstechnica.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 18 Jan 2024
290 points (100.0% liked)
Technology
60012 readers
1702 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
https://bitwarden.com/, https://1password.com/, https://lastpass.com/, https://keepassx.org/
Take your pick.
Note: Probably don’t pick LastPass. Read comments below.
I feel like atleast one of these has been hacked at some point in the past, but I cant remember which.
It was LastPass, but the passwords themselves weren’t leaked. All of these encrypt the password.
You're not wrong, but you kinda are. The plaintext passwords weren't released, but the encrypted blobs were stolen. Unfortunately, the LastPass defaults were absolutely shit so people have been able to selectively attack the blobs and decrypt the vaults, leading to millions in crypto being stolen.
I was a long time supporter of LastPass, but they haven't been responsible stewards of sensitive information. The fact that they failed to encourage or force existing customers to update the encryption settings as they updated their defaults is negligent and is disqualifying in my opinion.
There is no excuse for LastPass and it absolutely should not be treated with your passwords or secrets.
This is an interesting and a bit terrifying podcast about it (and other things), from a infosec perspective. https://twit.tv/shows/security-now/episodes/905?autostart=false
Security Now is amazing. For anyone that wants the deep dive tech perspective, plus what it means for everyday people and users, this is a great option.
Ah, alright, thanks. Thats a good thing then, that you cant get to the passwords even if you hack the company.
Lastpass had lots of issues.
KeePass doesn't store your stuff in the cloud; it's all local storage. You can sync your encrypted KeePass DB in a number of different ways; personally, I go for SyncThing, but you can use Box or whatever.
Based on experiences helping people migrate away, I'd suggest removing LastPass from your list. See other replies for why.
Note: For those that care, not only is BitWarden FOSS, it can also be self hosted easily using VaultWarden.
I added a note. I personally use Bitwarden and would recommend it, but I didn’t want to give a biased recommendation. If, for whatever reason, one of the others works better for someone, just using an encrypted password manager is way better than not.
Oh I feel you. I did a ton of research on toilet paper (of all things) and made a recco and my post was deleted as an "ad", hah
I've had 1password for as long as I can imagine. Never failed me. Happy with it.
Only issue I have with 1Password is their Android app. It works great most of the time, except that they didn't implement the Android autofill stuff correctly.
It sees Firefox as a browser and offers autofill suggestions for the websites just fine, but apparently Fennec isn't on their allowed browser list or something. It just sees Fennec as another android app and doesn't offer logins for the website I'm on, just ones that I've linked to the Fennec app.