Slashdot Mirror
LastPass Makes Password Management Free Across All Of Your PCs, Tablets and Smartphones (cnet.com)
LastPass on Wednesday announced that its popular password manager will now be free for all to use. LastPass previously charged a fee of $12 per year to sync passwords across multiple devices, such as a computer, tablet or phone. From a report on CNET: To entice newcomers, the service allowed you to access select features for free on either the web or on a mobile device, but syncing between the two required a premium membership. Not anymore -- that service is now free. LastPass is one of the best known and most trusted password managers. Its main purpose is to store all of your passwords in an encrypted vault in the cloud. The vault can only be opened using a master password that only you know. LastPass doesn't store the master password or have access to it, which means even if its servers were to be breached, your precious passwords would remain encrypted and protected.
I don't see anything newsworthy here at all. Did some sneaky little marketer pay for someone's lunchy-lunch yesterday?
Bad Slashdot, bad!
...that only you transmit up to 'the cloud' anytime you want to use any of your passwords, anywhere.
I know it isn't quite that simple or risky, but it's rather close.
Password Managers, by design, serve the function of reducing your security.
This is where a hardware token or some kind of biometrics could be beneficial, in combination with the password manager.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
The nice thing about these kinds of Slashvertisements is there are at least 1 million other similar marketing changes to other products that could also become Slashdot stories like this one. So there is potentially no end to Slashdot's pool of potential stories, which is so very reassuring.
Better known as 318230.
Which is why I still don't use it. If they really wanted to bolster security then MFA should really be standard, IMHO.
I will just leave this here...
http://keepass.info/help/kb/yu...
-- The morphemes of your disquisition are ascertainable, but they have eschewed an ambit of transpicuous exposition.
Cut out the middle! The F.B.I. has said this all along:
TRUST NO ONE!
Because someone's got to pay for it.
Can someone explain why I would want to have Lastpass hold the keys to my kingdom when I could just use a trusted, open source option like Keepass with a private server or free account on any number of cloud storage services? Browser plug-ins aren't exactly known for their great security.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Which leaves us with the interesting question of LastPass's business model.
1) Advertising? Knowing every site you visit - AND YOUR PASSWORD?
2) "We have a benefactor". Yeah. Except that maybe that benefactor is the NSA. Or is it the GRU? Or is it the MSS (China's NSA)?
No matter how I slice it, I can't figure out an angle that isn't kinda creepy.
And now only LastPass premium doesn't have ads.
I have difficulty remembering which websites I use the password password1 or password1! or Password1 or Password1!, there are so many alternate password passwords I use, that this app will be handy.
I'm not trusting some company with my passwords.
People are too trustworthy. And if LastPass gets hacked and all those passwords get stolen, LastPass will just say "oops!" and "oh well" and their customers will be scrambling to clean up the mess. Six months later, everyone forgets.
This will not stop someone from 3D printing your fingerprint, or wearing a mask that looks exactly like you or even simply holding up a photograph of you. Biometrics are extremely insecure.
What is their revenue source then? If they aren't charging anything, are there gonna be ads, thus is it going to negate what they're trying to do for privacy? Or how are they going to make money to keep them going?
Use a flashdrive to back up the password database. Keepass has apps for every OS.
keepass with cloud solutions is the same thing the file itself is encrypted and depending on what cloud service you use it can be too to different degrees so why switch? keepass is used and imported by many programs and all platform that ive seen.
Unless they haven't updated the Android app, it's still showing this as a premium feature. I've installed it and it says "Your LastPass Premium trial will expire in 60 days". I would think if it was truly free now then I wouldn't be seeing this message.
Biometrics can be insecure if you're being specifically targeted. The most common security breaches for regular users come from phishing, hacks or vulnerabilities in software, and those are non-targeted most of the time and would be significantly hampered by biometrics, since the hackers don't know you and don't specifically care about you.
Also, you're seemingly assuming that today's biometrics are as good as it gets, which is rather myopic. Fingerprinting will move on to finger vein matching, face recognition will include depth perception and infrared matching, iris scanning will get more popular, etc. It's like saying passwords will always be insecure because 6-character passwords are.
The other big problem with biometrics is that once a breach does occur, you can't change to a new set of fingerprints, eyes, etc.
Conversely, if you're in some sort of accident, you now have no way to access any of your accounts.
You mean like requiring that you log into your device (laptop, phone) with a fingerprint, an iris scan, or facial recognition in order to even open the Lastpass program - at which point you then have to put in your master password? Yeah, I think modern hardware can accommodate your request. It's not set up to be used that way, but the effective result is the same.
Is it just my observation, or are there way too many stupid people in the world?
That's why I use my dick print instead of my finger print. If I'm in "some sort of accident" life isn't worth living at that point.
Oh, so the NSA is paying them to make it free in exchange for a backdoor. So that the NSA can access the passwords of anyone who uses LastPass.
Even I I could view the source, I still wouldn't know that. I don't do cryptography or programming for a living at the level which would allow me to review the code for vulnerabilities, which puts me in with about 99.999%* of the general population. I can't verify keepass either. So I can either trust that their business model and livelihoods are based on some level of security, or I can base my trust of, say, keepass on some random set of internet users I've never met, have never seen the credientials of, and have nothing to lose if they happen to have missed a backdoor in the code during their perusal of the source.
Neither seem all that certain, tbh. I mean, TrueCrypt was open source, and rock solid. Until the day we all found out it was compromised and insecure.
*I wonder if there are even 70,000 people on earth who could effectively evaluate the entire source for vulnerabilities in their spare time, including every upgrade and change. The number may be quite a bit smaller.
Is it just my observation, or are there way too many stupid people in the world?
When LastPass was bought out by LogMeIn, I was worried that they would discontinue the service, however this seems even worse. Because in general if you're not the customer, you're the product. And in this case you're the product with all passwords stored on the cloud.
It might be time to move on to KeePass. Then again the mobile versions are not 100% from the source. So even that is a tough decision.
Agreed. Also consider that any information that can be digitized can be copied/forged. Using anything that you can't change whenever you suspect a password breach is idiotic.
Businesses:
https://lastpass.com/enterprise/enterprise-pricing/
Purchase $100/year Apple developer license
That's no longer required since Xcode 7 if you're not distributing your apps, but a $150/year* sufficiently recent Mac is required, unless the computer that you already use for other things happens to be a sufficiently recent Mac.
* Estimate based on dividing the price of a Mac mini by its expected four-year update life.
We all know the legal game of plausible deniability. "We didn't know Bob and Mary were skimming keys." ends any legal challenge you pose for violating their policy. Hell, that works for breaking actual laws nowadays.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
The point is that with free software, anybody interested in evaluating a particular application can hire one of those 70,000 to perform and publish an audit.
Of course I just renewed and paid $12 yesterday.
I do not see how it would end well.
Yep. KeePass is open source and stores your password database locally (or remotely via something like WebDAV). Another alternative is to use a password hasher that regenerates all of your passwords based on a master password so that there is no stored database to be potentially compromised at all.
There is no reason to trust LastPass or any other proprietary, third party solution with your most valuable data. Also, didn't LastPass recently get hacked?
I don't understand why people are making it sound like using keepass is so hard to use. I also don't understand why people are so insistent upon syncing files over a network connection to be stored on an untrusted machine. Even if the data is encrypted, why transmit that data over the network? (E.g. Kerberos doesn't transmit passwords over the net.) Sneaker net is pretty secure. I use keepass on my desktop, laptop, phone, and work computer. Sometimes I have to copy my database. In case the people here on slashdot need some tech help, here is my code, GPLed of course.
#!/bin/sh /mnt/thumdrive
cp keepass.kdbx
Feel free to audit that code and report back here about NSA backdoors.
For me, KeepassX compiled with Qt 4 or 5 does the job. I store its encrypted wallets on the cloud. Linux, Android, Windows, and Mac all work with it. What's LastPass got that I should be interested in?
https://www.humblebundle.com/l...
Last Pass is part of the "LifeHackers" Humble Bundle. Cost just under $8 for it (and others).
Guess that's okay because it's charity right?
But the $1 for Directory Opus is a great deal.
Be seeing you...
I'll continue to encourage this for grandma and other family members that need an easy solution, but to anyone who really cares about privacy and security, a proprietary, closed-source, cloud-based solution is simply not an option. I have used and enjoyed KeyPass (and KeePassX) for years. They are fully open source, and, along with KeeFox and Keepass2Android, very well-integrated solutions. They use high cryptography, and you can achieve the cloud storage benefit if you want by storing your files on a Google Drive, Dropbox, etc. Highly recommended for anyone with the skills to use it over something like LastPass.
Why is this going to fking CNET instead of the LastPass blog? Here is the actual article https://blog.lastpass.com/2016...
Yep. KeePass is open source and stores your password database locally (or remotely via something like WebDAV). Another alternative is to use a password hasher that regenerates all of your passwords based on a master password so that there is no stored database to be potentially compromised at all.
There is no reason to trust LastPass or any other proprietary, third party solution with your most valuable data. Also, didn't LastPass recently get hacked?
And if you want to sync passwords across devices, just keep the KeePass database in a cloud storage account. In the event that your cloud account is breached, the database is still encrypted
Redundancy is good And also good.
(or remotely via something like WebDAV)
I use a combination of Keepass, Cryptomator, and Google Drive.
All of my clients have google drive, cryptomator, and Keepass and they all access the same keepass data file that is encrypted via cryptomator on google drive. The key for me is that all of the packages are available on a wide variety of clients: iPhone, Windows, Mac, Android, etc.
I can put their portable app on my thumbdrive, plug it into a Windows PC, (e.g. my work PC) and it plugs itself into to Firefox/Iexplore. When I remove the drive, the application disappears. Nothing is left on the work PC.
That alone is worth $20/yr to me.
How's the whole concept different from keeping an encrypted file with all the credentials stored in a dropbox folder?
Any guest worker system is indistinguishable from indentured servitude.
"Encrypted vault in the cloud"? Do people even hear the words that come out of their mouths any more?