Toggle sidebar

Which Password manager

Sort by date Sort by votes
kulture

kulture

Free Member
    • Aug 11, 2007
    8,962
    1
    2,753
    69
    www.kultureshock.co.uk
    I have been using LastPass for many years and I am happy with it, however on reading scare stories on how it has been breached I wonder if I should move and if so what is a suitable alternative.

    I use a single user premium lastpass account.
     
    I'm bonkers for lastpass, its a great app.

    It's by far the market leader, so it's going to be the biggest target for scumbags, dont be sucked in by bad press.

    I appreciate their honesty, I've read all the reports on the so called breaches, none of them are actual breaches of anything important, unless someone is an idiot not using it properly. There are a lot of configuration options for lastpass, it can be complex to set up and use correctly.

    I do wonder how many other password managers, or any app really, would just keep quiet about problems.

    As long as you're following best practice in your use of lastpass, you're fine.
     
    • Like
    Reactions: kulture
    Upvote 0
    hss001 said:
    I looked at a few password managers, including lastpass. I went with bitwarden. It has similar features, but is open source.
    Click to expand...
    I too use Bitwarden. To be fair it isn't quite as good as LastPass, but it does the job and it's free.
     
    Upvote 0
    Bitwarden
    Keypass
    1password

    Above 3 have very solid reputations. Keypass and bitwarden have the added advantage of being open source and bitwarden even more so that you can self host the server.
     
    Upvote 0
    Upvote 0
    I use the pemium version of Eset Smart Security, which is an all in one virus, malware, browser protection software which also includes a password manager. I have it on both my desktop and smartphone.
     
    Upvote 0
    kulture said:
    No, Lastpass itself was breached and all the customer data copied. Those who have been using Lastpass for a long time are said to be especially vulnerable. See https://www.intego.com/mac-security-blog/lastpass-password-manager-suffers-massive-data-breach/
    Click to expand...

    I've had a read, it's a worry innit!

    So hard to get to the truth with this sorta stuff, how much of it is mud slinging from competitors, how much are lastpass not telling us.

    If I go through the hassle of changing to another password manager, how long until something happens with them, I certainly don't trust a browser with my passwords.
     
    • Like
    Reactions: kulture
    Upvote 0
    estwig said:
    So hard to get to the truth with this sorta stuff, how much of it is mud slinging from competitors, how much are lastpass not telling us.
    Click to expand...
    It doesn't really matter. Entrusting your password data to a third party is a nonstarter if you are serious about security.

    For instance I have the root passwords of all my client's servers. Never in a million years would I let that data go outside my own direct control. I won't even say what I use, as to do so would also be a breach of security.
     
    • Like
    Reactions: kulture
    Upvote 0
    KM-Tiger said:
    It doesn't really matter. Entrusting your password data to a third party is a nonstarter if you are serious about security.

    For instance I have the root passwords of all my client's servers. Never in a million years would I let that data go outside my own direct control. I won't even say what I use, as to do so would also be a breach of security.
    Click to expand...
    It's all about a balance of risk and that balance depends on circumstances. What is a good solution for you would be problematic for many others I suspect. A good password manager with 2FA is likely a big step up in security for most as opposed to the widespread reuse or emails / usernames and passwords because no one can remember all the unique ones.

    You can host your own Bitwarden server but they you have secure it and unless that's your business then you are probably better off using the third party and hope they do what they say they do.

    Safes weren't truly secure in the past and neither are password managers but at least they make it harder if you use a strong password and have 2FA. All you want to be is not the easy target and hope they can't be bothered with you because there are easier targets out there.
     
    • Like
    Reactions: kulture
    Upvote 0
    KM-Tiger said:
    It doesn't really matter. Entrusting your password data to a third party is a nonstarter if you are serious about security.

    For instance I have the root passwords of all my client's servers. Never in a million years would I let that data go outside my own direct control. I won't even say what I use, as to do so would also be a breach of security.
    Click to expand...
    Security via obscurity is not a good idea. It has been debunked for years and years.

    Your best option is to use a well-known open-source solution that multiple people understand and use and has been audited by external parties. Bitwarden is an excellent choice.

    By relying on security via obscurity, you risk using an insecure option through ignorance.

    en.wikipedia.org

    Security through obscurity - Wikipedia

    en.wikipedia.org en.wikipedia.org
     
    Upvote 0
    Upvote 0
    estwig said:
    Thats not what the man said he was doing.
    Click to expand...
    That's right, nor did he tell us he's not doing it. In fact, he didn't tell us anything about what he's doing, other than the data is under his direct control. with the implication he doesn't use a cloud service.

    estwig said:
    If your holding sensitive or important data, it would make sense not to give bad actors the first foothold, by telling them how you hold it.
    Click to expand...
    He didn't tell us anything about how he's holding it. He may well be running a locally hosted password manager (which has been recommended on UKBF).
     
    Upvote 0
    Just when some say a non-cloud hosted solution is safer, a self-hosted one Keepass has an issue

    portswigger.net

    Web Application Security, Testing, & Scanning - PortSwigger

    PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.
    portswigger.net portswigger.net
     
    Upvote 0
    estwig said:
    Thats not what the man said he was doing.

    If your holding sensitive or important data, it would make sense not to give bad actors the first foothold, by telling them how you hold it.
    Click to expand...
    If it truly is stored securely, it won't matter if the attacker knows how or not.
     
    Upvote 0
    This should be terminal for LastPass but they are unfortuantely still a well-known password manager with lots of marketing. They hope they can sweep it under the rug.

    Why oh why do they not adopt sensible access policies, such as only access to a corporate network from approved devices? This is basis security 101. And really employees at a password company should be adopting the most secure access protocols - such as hardware tokens (e.g. Yubikey), which would have stopped this attack as the hacker does not possess the device.
     
    Upvote 0
    I evangelise 1password whoever I go. I was a long time Lastpass user - but always found it clunky.

    When I discovered and tried 1password, lastpass all of a sudden looked as if it was designed in Microsoft word!

    If you’re a lover of aesthetic in any way, I think 1p will hands down be your favourite password manager of any you try.
     
    Upvote 0
    Alistair Wilson said:
    I evangelise 1password whoever I go. I was a long time Lastpass user - but always found it clunky.

    When I discovered and tried 1password, lastpass all of a sudden looked as if it was designed in Microsoft word!

    If you’re a lover of aesthetic in any way, I think 1p will hands down be your favourite password manager of any you try.
    Click to expand...
    You pick a security product because it looks good?! You should choose based on security and technology instead. UI is going to be way down the list.
     
    Upvote 0
    Kerwin said:
    You pick a security product because it looks good?! You should choose based on security and technology instead. UI is going to be way down the list.
    Click to expand...
    I can see how you arrived at that conclusion but no. It’s a superior product that happens to also have an amazing UX.

    With a background in IT Services and having worked alongside ex-GCHQ secops and specialists, I can assure that I am a function over form guy - but also happen to prefer apps that are nice to use - since security is as much about behavioural compliance (usage and adoption within workflows) as it is technicality, if not more. The best tool is the one that gets used! Hope that clarifies it but thanks for asking.
     
    • Like
    Reactions: kulture
    Upvote 0
    I'm still rolling with LastPass, it works beautifully with all my apps and devices, I understand its myriad of security settings, I keep those very tight and I use it with 2FA via an authenticator app.
     
    Upvote 0
    estwig said:
    I'm still rolling with LastPass, it works beautifully with all my apps and devices, I understand its myriad of security settings, I keep those very tight and I use it with 2FA via an authenticator app.
    Click to expand...

    Really, even after all of the horrific security practices and data breaches recently? Surely this would absolutely not inspire confidence for a company who supposedly keeps users data secure.

    This was not your run of the mill data breach, they stole the encrypted vaults, which is just laughable how they allowed it to happen. The worry is even if you have a strong password, you will not get any notification your vault has been accessed and all of your passwords are now exposed. So you would need to change all your passwords as well as the master password.
     
    Last edited:
    Upvote 0
    The big problem with anything to do with security, this seems especially true of IT, it is sold on fear!

    There is good money to be made by everyone in this industry, by scaring people. You need to try and stay objective and not make rash decisions based on emotion.
     
    Upvote 0
    You must log in or register to reply here.

    Similar threads

    Newchodge
    Password issue
    Replies
    10
    Views
    6K
    IT & Internet
    WaveJumper
    WaveJumper
    reeliva
    Building an AI Reels app for small businesses – I'd love your feedback ⭐
    Replies
    1
    Views
    834
    IT & Internet
    fisicx
    fisicx
    G
    Remote IT support packages
    Replies
    6
    Views
    4K
    IT & Internet
    ChrisLambert
    ChrisLambert
    Ashley_Price
    A good alternative to Google Calendar
    Replies
    25
    Views
    3K
    IT & Internet
    mahad
    M
    Ozzy
    Who's business operates by subscription?
    Replies
    20
    Views
    529
    General Business Forum
    Newchodge
    Newchodge

    Latest Articles

    Top Bottom
    Back