Solved Which is your preferred password manager

Thanks. But isn't most of LP, including its encryption, open source?

Yes some code is open source and most of it proprietary. Details here: Third-Party Software Licenses

kelper said:

Thanks. But isn't most of LP, including its encryption, open source?

Click to expand...

Unfortunatelly with an online password manager, there is also code for servers, including 3rd party providers, browsers, emails. Too many parties involved, too many potential vulnerabilities. Thus it will get hacked regularly, it is inevitable. As far as I remember, LP itself was never hacked, last time admins had their credentials stolen and in previous cases their servers were hacked.

This is the reason I would never trust an online PM with core passwords, I use Edge, because MSA is protected by UAC/TPM and etc.

scopio said:

Keepass I like to have full control of my password.

Click to expand...

Agreed.

scopio said:

@kelper More secure because I keep it in an encrypted flash drive and not in a server that as far as LastPass is concerned has been hacked in the not too distant past.

Click to expand...

Same, only mine is a USB-connected encrypted NVMe drive. Same idea, though.

kelper said:

Is KP not cloud-based too?

Click to expand...

And for the one I use, a derivation from the original KP:


These are programs you use on your system. Not some silly web-based program with cloud storage.

scopio said:

@kelper KP is not cloud based.

Click to expand...

^^^^^^ This.

Calling LP silly is hardly adult. I use it for its cloud storage. I like the way it synchronises between phones and computers.
If it were cheaper, I might move to Bitdefender. But I'm confident that my passwords are salted and encrypted.
.

In your opinion, sure.

The whole point of passwords is that they are keys for locks on your systems. Can you guarantee that your LP-stored passwords are safe, 100%, that no one has access to them?

I can guarantee no one has access to mine. 100%. My drive is only connected when I need to use it to log into something and then disconnected.

It's silly to think you can fully entrust all of your passwords to an online company and have them 100% secure. And if you think that is immature, that's your right. As it is my right to think that this is a silly thing to do.

So, hackers did get their hands on customer data. Lastpass: Hackers stole customer vault data in cloud storage breach

At the Lastpass blog: Notice of Recent Security Incident

I deleted my family's data (not accounts) from LP a few days back though it may be too late. But no more Lastpass till they do something about this.

That's why I continue to use KeePass with a locally stored database file.

Bitwarden hands down

I understand how LastPass works. That's why I continue to use LastPass.

I'm done with Lastpass, going to give Keeper a try.

Beaupeep said:

So, hackers did get their hands on customer data. Lastpass: Hackers stole customer vault data in cloud storage breach

At the Lastpass blog: Notice of Recent Security Incident

I deleted my family's data (not accounts) from LP a few days back though it may be too late. But no more Lastpass till they do something about this.

Click to expand...

It's getting very serious now.
A few tips for anyone still using LastPass.

johnlgalt said:

In your opinion, sure.

The whole point of passwords is that they are keys for locks on your systems. Can you guarantee that your LP-stored passwords are safe, 100%, that no one has access to them?

I can guarantee no one has access to mine. 100%. My drive is only connected when I need to use it to log into something and then disconnected.

It's silly to think you can fully entrust all of your passwords to an online company and have them 100% secure. And if you think that is immature, that's your right. As it is my right to think that this is a silly thing to do.

Click to expand...

I just went through my last pass accounts and I had 250+ passwords saved in there. I managed to get rid of about 75 of them, for things I don't use anymore.

I cannot guarantee that my accounts will always be 100% safe. But I also do almost everything online, I work from various computers at home as well as computers from work. i access my various sites and such from my mobile devices, cell phones, etc. For example, I like to look at elevenforums.com from home, from work, from my phone while traveling, etc. for me, it's totally impractical to save the passwords to an external drive and then have to carry the drive with me 24x7 so that I can access from all of my devices. For somebody else, none of this may be applicable and another solution is the best option.

What I have done to stay as safe as possible is that I have a small collection of accounts that are far more sensitive than anything else. These are all together in 1 folder in LastPass. About once per quarter, I can go out and change the passwords for all of these accounts (less than 20 of them), and also change my lastpass master password. Each site has a unique password.

For everything else, like elevenforums, tenforums, sevenforums, Netflix, etc.....if these sites get popped from a security breach and a hacker bruteforcing my password gains access, I might lose access to the site or get a post that I didn't make posted to the forums. I'll then have to somehow figure out a way to get back in. None of these are really mission critical apps, I'll survive.

With KeePass you're not forced to carry around anything. You can share the database(s) in many, many different ways, from simple cloud repositories to complicated self-hosted repositories with secure connections. You can even manually copy the database(s) to your devices via physical connection only.

The point is that it is *not* in an online repository that is managed by another entity. You do the managing all by yourself, completely. So it is as secure (or insecure) as you make it, not as some other entity makes it or gets hacked for.

The thing is, in this thread, more people are educated enough that they won't (likely) fall for phishing techniques that this latest LP breach will inevitably lead to. But it's the folks who don't understand security in the digital age that are going to get reamed by these upcoming phishing attacks (and they are coming, you can bet on it) because they do not know. If everyone was security knowledgeable and security conscious, we wouldn't be having nearly as many successful hacks of major industries, corporations and services are we have been seeing for the last decade.

But they are not knowledgeable and not conscious. The vast majority of users probably think "Oh, they say it's protected so it must be."

They do not understand that "If it is digital, it can be hacked." Period.

LastPass users: Your info and password vault data are now in hackers’ hands

Gosh! This is appalling!!

I have started changing my account passwords including Banks, email, work, MS, Google, among others. They are protected by 2FA but it'll take me time to change/reset all of them. We customers/users have been let down.

I'm taking a look at Keeper as an alterative to last pass. Friend of mine really likes it and recommended it.

I started a new thread here, so others can discuss and share their likes and dislikes of the software.

TraderGary said:

I understand how LastPass works. That's why I continue to use LastPass.

Click to expand...

Hackers no longer need passwords, they only need hashes, cookies or credentials. Even 2FA is "useless" these days.

At the rate things are going today nothing is safe or hack proof. And when someone (company) tries to make things, safe people complain "it's too inconvenient. Why do they need my phone number and email address?"

That said, I don't use password managers unless you call Edge one as it saves the passwords I use.

Didn't realize I was a LastPass customer! Musta tried it some time in the past!