Password Managers

trevo · Oct 13, 2024

glasskuter said:
LastPass, Keepass, and Keeper have been breached multiple times.

I don't think that is true of Keepass.

Anibor_11 · Oct 13, 2024

trevo said:
I don't think that is true of Keepass.

I agree. Where´s the proof?

About the latest version:

"Many thanks to the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) and mgm security partnersfor sponsoring and performing a code analysis of KeePass 2.x (the BSI willpublish information about it soon here: projectCAOS 3.0

).

No security vulnerabilities classified as medium, high or critical were found. However, two minor potential security vulnerabilities and some improvable codeparts were identified. As a result, various improvements have been implemented;see above (version 2.57.1). For details about the code analysis and the improvements, see therelease notes."

From KeePass 2.57 released - KeePass

glasskuter · Oct 13, 2024

@kelper

2015 was the worst where all master passwords were breached. Then a vulnerability was found in 2017, a phishing attack in 2016, but 2022 sealed the deal for a lot of LastPass users. LP was breached through a developer's system in August. Then in November the hacker used the info he had obtained in August to access a third-party cloud storage service used by LP to gain certain customers’ information, though not passwords . Finally in December LP admitted source code and technical information had been taken in the August breach.. I read somewhere at the time where in one of these cases it was determined the intruder was in the system for 4 days before they were detected.

https://www.silicon.co.uk/security/...ass suffered,to change their master passwords.

Marcus Vinicus · Oct 13, 2024

I used LastPass for a long time until last week when I changed to Dashlane. I grew tired of LastPass forcing me to enter my login information and master password every time I wanted to use it via my browser. This has been a very common criticism in their forums of late with unhappy users.

I much prefer Dashlane and will stick with that.

glasskuter · Oct 13, 2024

trevo said:
I don't think that is true of Keepass.

No, but the severibility of the vulnurability discovered in Keepass in 2023 was pretty bad for any password manager's reputation. It wasn't even a complex one,. Any inexperienced hacker could have found it if he had looked. They missed a real bullet on that one. KeePass vulnerability enables master password theft | TechTarget

kelper · Oct 13, 2024

If a password manager does not ask for a login when you wake Windows or when you log in, this is a major breach. Mine just needs a brief tap on the fingerprint sensor. Any decent password manager will log you out after a short interval or when you close the browser.

Marcus Vinicus · Oct 13, 2024

kelper said:
If a password manager does not ask for a login when you wake Windows or when you log in, this is a major breach. Mine just needs a brief tap on the fingerprint sensor. Any decent password manager will log you out after a short interval or when you close the browser.

Dashlane requires only a PIN when used, NOT enter in the full login info like the annoying LastPass does every time the browser is closed.

Overall I think Dashlane is the better software.

kelper · Oct 13, 2024

LastPass customers' master passwords were never compromised. LastPass has been quite open about security breaches. How do we know that their competitors are any more secure? So long as our sensible passwords are salted before encryption, there is no way they can be hacked. We just have to be confident that nobody has ever hashed our salted passwords. I believe most salts are a random 16-byte word.

Every possible unsalted hash of 'password' or 'password 12345' is already well known and anyone who uses these is a fool.

kelper · Oct 13, 2024

Marcus Vinicus said:
Dashlane requires only a PIN when used, NOT enter in the full login info like the annoying LastPass does every time the browser is closed.

Overall I think Dashlane is the better software.

You can use Windows Hello to log in to LastPass. That means facial recognition or a fingerprint. You don't need to use a "full login" as you said.

trevo · Oct 13, 2024

glasskuter said:
No, but the severibility of the vulnurability discovered in Keepass in 2023 was pretty bad for any password manager's reputation. It wasn't even a complex one,. Any inexperienced hacker could have found it if he had looked. They missed a real bullet on that one. KeePass vulnerability enables master password theft | TechTarget

I was replying to your statement that Keepass had been breached multiple times, which is not true.

In any event, I noticed that the same site that you referenced, TechTarget, recommends it as one of their "8 best password managers" and states..."KeePass is a free and open source password manager that only stores data locally. This eliminates the possibility of user passwords being leaked by the vendor in the event of a data breach."

8 best password managers of 2023

Dedicated password managers each have their own strengths and weaknesses. Learn why you need them, how to evaluate them and the best ones to use.

www.techtarget.com

I have used it for years and my main reason for replying on this point is to hope that it doesn't put people off trying it for themselves.

BruceR · Oct 13, 2024

Microsoft Authenticator (free).

pparks1 · Oct 13, 2024

LastPass user here. $48 a year family plan. Everybody in my immediate family uses it. Recent breaches have not been a concern for me.

TraderGary · Oct 13, 2024

I've used LastPass for a couple of decades. I've tried most of the password managers out there and none of them work as well for me as LastPass. I understand how password managers work, so as long as you have a good, long, master password, a breach of any password manager's database means nothing. A hacker would have to brute force guess my password that is a passphrase of more than 30 characters. The odds of that happening are astronomically improbable. I like LastPass.

glasskuter · Oct 13, 2024

kelper said:
LastPass customers' master passwords were never compromised.

I guess it depends on what you read and how much you read. If something is reported on multiple reputable news, technical, and security sites and in technical security publications, I tend to put stock in it. My common sense tells me there's more truth in all that information that in whatever the company's statement says when they try retain their customers and mitigate the damage to their company's reputation.. I never used it so I personally would not know. I passed on what I read with just one of the references. Nothing more

kelper · Oct 13, 2024

Many reputable media sources reported a breach in LP's security. But they failed to mention that NO passwords were compromised.

TraderGary · Oct 13, 2024

glasskuter said:
I guess it depends on what you read and how much you read. If something is reported on multiple reputable news, technical, and security sites and in technical security publications, I tend to put stock in it. My common sense tells me there's more truth in all that information that in whatever the company's statement says when they try retain their customers and mitigate the damage to their company's reputation.. I never used it so I personally would not know. I passed on what I read with just one of the references. Nothing more

Yes, the media had a field day with the breach. And the technical knowledge of most of them wouldn't fit in a small thimble. For the media the breach was click bait. The hacker has had an old database for a couple of years now and to my knowledge hasn't been able to do anything with it. With 256-bit AES encryption, the odds that he even could are astronomically infinitesimal.

pparks1 · Oct 13, 2024

glasskuter said:
I guess it depends on what you read and how much you read. If something is reported on multiple reputable news, technical, and security sites and in technical security publications, I tend to put stock in it. My common sense tells me there's more truth in all that information that in whatever the company's statement says when they try retain their customers and mitigate the damage to their company's reputation.. I never used it so I personally would not know. I passed on what I read with just one of the references. Nothing more

A copy of the database information was compromised. With that, a hacker would have to brute force compromise the password in my account. Thus far, this hasn't happened. And I changed my current lastpass password and all of the important passwords kept in my vault, so even if my master password was determined, it wouldn't be useful with my current database.

One thing that last pass didn't do previously was enrypt the urls of the sites in the vault. So, those were all clear-text. Now those are encrypted due to changes that last lass made in their system due to these breaches.

I'm comfortable continuing to use lastpass based on my understanding and the actions that i have since taken.

KevTech · Oct 13, 2024

I use KeePass.
KeePassXC is a fork of KeePassX which is discontinued.

remover · Oct 13, 2024

@ShamrockRig over 850 passwords!

I keep mine in .txt files on several usb thumb drives 74 passwords in 28 years and, (some websites are gone)
Cheers.....

TraderGary · Oct 13, 2024

Marcus Vinicus said:
I used LastPass for a long time until last week when I changed to Dashlane. I grew tired of LastPass forcing me to enter my login information and master password every time I wanted to use it via my browser. This has been a very common criticism in their forums of late with unhappy users.

I much prefer Dashlane and will stick with that.

I have my LastPass extension set to automatically use biometrics. I use Windows Hello face recognition. I never have to enter my login information.

Password Managers

Well-known member

My Computer

Well-known member

My Computer

aka Mama Glass

My Computers

Semper paratus

My Computers

aka Mama Glass

My Computers

Well-known member

My Computers

Semper paratus

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Stock Market Wizard

My Computer

aka Mama Glass

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Stock Market Wizard

My Computer

Similar threads