LastPass

thanksajdotcom

I've been using LastPass for 5 or 6 years. The one time they thought they had a breach of their database they emailed everyone as soon as it was even suspected and forced a password change. That alone proved they were a customer centric company, as most others would have tried to PR their way out of such a "breach"

The app also encrypts your passwords with your key on the client end before it even goes to the cloud database. So even if someone managed to break in and get it they would just have the hashed values that would take a significant amount of time to figure out.

Yup, there's this too. LastPass only decrypts your password database at the local level. It's always encrypted in-transit and on the cloud server.

scottalanmiller

LastPass is extremely secure. But, as with anything, the end user is a point of risk that is very difficult to mitigate.

Dashrender

To the OP - the answer is (as @scottalanmiller and other have said) LastPass is only as secure as your Master Password, and possibly a second factor authentication.

So first things first - use a long (16+ characters, including upper, lower, numeric and symbols) Master Password
and second - use a second factor - YubiKey Google Authenticator Toopher Duo Security Transakt

Additionally, you should consider printing out a few one time passwords and storing them in a safe place. Safety deposit box, safe at home - where ever you store important papers at home, etc.

Personally I use a 16+ character password and Google Authenticator. I trust this system very much and have had little to no problems with it.

I also gladly pay my $12/yr for mobile access - so I can continue to use secure passwords, even on my phone.

thanksajdotcom

@scottalanmiller said:

LastPass is extremely secure. But, as with anything, the end user is a point of risk that is very difficult to mitigate.

A.K.A you can't fix stupid.

thanksajdotcom

Also, I should add, that when HeartBleed came out, and sites like Facebook and Google were compromised, LastPass was unaffected because they were on a newer version. Just something to think about.

scottalanmiller

@thanksaj said:

Also, I should add, that when HeartBleed came out, and sites like Facebook and Google were compromised, LastPass was unaffected because they were on a newer version. Just something to think about.

And they payload is encrypted, not the tunnel. LastPass isn't SSL.

Dashrender

@thanksaj said:

And they payload is encrypted, not the tunnel. LastPass isn't SSL.

Actually LastPass is both.

@thanksaj said:

Also, I should add, that when HeartBleed came out, and sites like Facebook and Google were compromised, LastPass was unaffected because they were on a newer version. Just something to think about.

And I'm pretty sure they were affected, but it didn't matter since they use their own encryption on the endpoint before sending to the cloud.

LastPass utilizes OpenSSL for HTTPS/TLS/SSL encryption and we were therefore “vulnerable” to this bug.
http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

thanksajdotcom

@scottalanmiller said:

@thanksaj said:

Also, I should add, that when HeartBleed came out, and sites like Facebook and Google were compromised, LastPass was unaffected because they were on a newer version. Just something to think about.

And they payload is encrypted, not the tunnel. LastPass isn't SSL.

True.

scottalanmiller

@Dashrender said:

@thanksaj said:

And they payload is encrypted, not the tunnel. LastPass isn't SSL.

Actually LastPass is both.

@thanksaj said:

Also, I should add, that when HeartBleed came out, and sites like Facebook and Google were compromised, LastPass was unaffected because they were on a newer version. Just something to think about.

And I'm pretty sure they were affected, but it didn't matter since they use their own encryption on the endpoint before sending to the cloud.

LastPass utilizes OpenSSL for HTTPS/TLS/SSL encryption and we were therefore “vulnerable” to this bug.
http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

Their website was affected, but not the application, AFAIK, which I think uses AES256.

thanksajdotcom

@scottalanmiller said:

@Dashrender said:

@thanksaj said:

And they payload is encrypted, not the tunnel. LastPass isn't SSL.

Actually LastPass is both.

@thanksaj said:

Also, I should add, that when HeartBleed came out, and sites like Facebook and Google were compromised, LastPass was unaffected because they were on a newer version. Just something to think about.

And I'm pretty sure they were affected, but it didn't matter since they use their own encryption on the endpoint before sending to the cloud.

LastPass utilizes OpenSSL for HTTPS/TLS/SSL encryption and we were therefore “vulnerable” to this bug.
http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

Their website was affected, but not the application, AFAIK, which I think uses AES256.

That's what I believe to be the case.

JaredBusch

I have used LastPass since December 2008 and I have been a Premium subscriber since December 2009 when I first got an iPhone.

The service absolutely rocks and security is completely serious. Everything is encrypted locally prior to transmit so even on a insecure line you have security around your password.

I personally know 3 passwords. LastPass master password, my gmail password for my main account, and my bank account password. All three of those passwords are more than 16 characters long and more than jsut letters and numbers.

For the rest, they are random and were generated by LastPass.

technobabble

Thanks everyone, I will be able to explain why LastPass is safe. I personally plan to upgrade so I can have it on my phone. I have a problem with one site, my hosted WHMCS billing platform. LastPass tries to override every user pass area on the program with my login to the program.

Carnival Boy

I didn't get on with LastPass. I'm a KeePass man. The main issue being the lack of an official iOS app for KeePass - I'm reluctant to trust 3rd party apps.

scottalanmiller

KeePass is nice because it is free! It is really great as well.

thanksajdotcom

@Carnival-Boy said:

I didn't get on with LastPass. I'm a KeePass man. The main issue being the lack of an official iOS app for KeePass - I'm reluctant to trust 3rd party apps.

Just cause you're paranoid doesn't mean they aren't out to get you...:P

thanksajdotcom

@scottalanmiller said:

KeePass is nice because it is free! It is really great as well.

KeePass is good. I just like the cloud factor to LastPass.

thanksajdotcom

@thanksaj said:

@scottalanmiller said:

KeePass is nice because it is free! It is really great as well.

KeePass is good. I just like the cloud factor to LastPass.

I know some people keep their KeePass in their Dropbox or that, but I actually originally signed up for LastPass because they had a Windows 8 Phone app, which most don't.

Carnival Boy

I keep my KeePass databases in OneDrive.

thanksajdotcom

@Carnival-Boy said:

I keep my KeePass databases in OneDrive.

Same difference. You keep it in a cloud storage app of one kind or another.

Carnival Boy

I know. I was just saying what I do.