Popular Password Manager LastPass Doubles Price of Its Premium Plan, Removes features From Its Free Service Tier (neowin.net)

An anonymous reader shares a report: In November, LastPass made a big change to its service, allowing users to keep track of their passwords across all their internet-enabled mobile and desktop devices, free of charge. In addition to the free tier, the cross-platform password manager - available on iOS, Android, and Windows 10 -- also offered a Premium plan with additional features, priced at $12 per year. Today, LastPass announced another wave of changes to its lineup for individual users -- but this time, the changes are unlikely to be welcomed with open arms by its customers. LastPass Premium has now doubled in price to $24 a year, which includes "emergency access, the ability to share single passwords and items with multiple people, priority tech support, advanced multi-factor authentication, LastPass for applications, and 1GB of encrypted file storage," along with all the other features of the Free tier. In a statement, the company said, "While LastPass Free continues to offer access on all browsers and devices and the core LastPass password management functionality, unlimited sharing and emergency access are now Premium features. Free users will be able to share one item with one other individual.

Comments

I use passwords.txt.

[Anonymous Coward]

Format:

# SomeShittySite
username / password

# AnotherShittySite
username / password

# AThirdShittySite
username / password

$0/year. You can have this "service" for free.

Re:I use passwords.txt.

[ShanghaiBill]

I do the same, except I have the same 6 byte prefix for all the passwords. So if a password is listed in "passwords.txt" as "correctHorseBatteryStaple" the real password is "7Rz8t5correctHorseBatteryStaple". If anyone gets access to my list, they won't know the prefix, or even know that there is a prefix.

Re:I use passwords.txt.

[Anonymous Coward]

I do the same, except I have the same 6 byte prefix for all the passwords. So if a password is listed in "passwords.txt" as "correctHorseBatteryStaple" the real password is "7Rz8t5correctHorseBatteryStaple". If anyone gets access to my list, they won't know the prefix, or even know that there is a prefix.

They know now.

Re:I use passwords.txt.

[Captain Splendid]

Yeah, I do something very similar except my prefix is a calculation, not an addition, and I don't bother with a text file, I keep it all in my head. I also segregate passwords into tiers, depending on the service. Throwaway web accounts do not need the complexity my online banking does. I do have an encrypted excel file for my wife to use should something happen to me though...

Re:I use passwords.txt.

[Solandri]

Sony did the same thing. And when they got hacked, all their passwords were revealed to the world too.

If you're gonna store your passwords locally, it needs to be encrypted with a single master password which you never write down.

Re:I use passwords.txt.

[unixisc]

Yeah, but that's not automatically available from any device. Lastpass allows that. I adapted LastPass but do not need any of the extra features, just the simple logins & passwords. Note, however, that LastPass also allows you to store things like Credit Card information (in case one gets stolen), DMV, WiFi SSIDs, Bank Accounts, Router info, et al. All of it quite handy. I don't need emergency access, tech support, ability to share, multi factor authentication or ability to share or any of that.

Re:I use passwords.txt.

[Anonymous Coward]

It's misdirection all the way down.

His password is Hunter2

Re:I use passwords.txt.

[Anonymous Coward]

It's a good idea, but you should make the prefix 8 characters long.

Re:I use passwords.txt.

[Anonymous Coward]

LOL. You're pretty smart, aren't you?

Re:I use passwords.txt.

[Anonymous Coward]

If you're gonna store your passwords locally, it needs to be on your wallet beside your credit cards.

FTFY

Re:I use passwords.txt.

[infolation]

And enforce numbers, punctuation & mixed capitalisation on yourself. If you get your own prefix wrong, SMS 2FA.

Re:I use passwords.txt.

[Anonymous Coward]

Not the OP here but I feel the need to point out that a text file also let's you store things like Credit Card information (in case one gets stolen), DMV, WiFi SSIDs, Bank Accounts, Router info, et al. And if you put it on an encrypted partition on some server like Mega, then you can also access it from everywhere.

Re:I use passwords.txt.

[vux984]

I do something very similar except my prefix is a calculation,

I used to do that. Then sites started having breaches, and that would require me to change the password I used, and the calculation method doesn't cope with that well.

And other sites with goofy rules about password expiration/rotation, or stupid lenth requirements (forcing me to use shorter passwords than i want, or omit punctionation etc...)

It started to be much too difficult to keep in my head all the exceptions to the "rule".

Re: I use passwords.txt.

[Anonymous Coward]

I just read your password as *******, even though you typed Hunter2.

Re:I use passwords.txt.

[ShanghaiBill]

It's a good idea, but you should make the prefix 8 characters long.

Some sites only allow 8 bytes. So the prefix would be the entire password, leading to the same repeated password on all these sites.

A few years ago my bank limited passwords to 8 bytes ... and insisted that they be changed every 3 months to show they were serious about security.

Re: I use passwords.txt.

[Anonymous Coward]

I just read your password as *******, even though you typed Hunter2.

Nice job figuring out how copy and paste works, AC...

Re: I use passwords.txt.

[VikingNation]

Six characters that are alpha numeric is not that much entropy. If they know the word from the text file and your convention they can execute an exhaust attack very quickly

Re: I use passwords.txt.

[Anonymous Coward]

That depends on how long one password attempt takes for a given service. If, for example, a service uses a really slow key derivation function, or rate-limits attempts, trying 56 billion possible values (assuming he uses both upper- and lowercase letters) of the prefix becomes impractical. Then again, if he reuses the prefix for all passwords, it only takes one cracked full password to know the prefix for all passwords.

I'd be more worried that he's storing all his passwords in plaintext.

Re:I use passwords.txt.

[Anonymous Coward]

I do the same, except I have the same 6 byte prefix for all the passwords. So if a password is listed in "passwords.txt" as "correctHorseBatteryStaple" the real password is "7Rz8t5correctHorseBatteryStaple". If anyone gets access to my list, they won't know the prefix, or even know that there is a prefix.

I have the same prefix on my luggage...

Re:I use passwords.txt.

[reboot246]

My bank is worse. I'm limited to numbers, uppercase letters, and lowercase letters - no characters or punctuation. Some security, huh?

Re:I use passwords.txt.

[sublayer]

https://www.westpac.com.au/ limits the password for online banking to exactly six characters - letters and numbers only - and is not case sensitive.

And you have to enter the password using the mouse and an on-screen keyboard so you can't copy/paste the password from a password manager.

Re: I use passwords.txt.

[Anonymous Coward]

That is assuming someone gaining access to those passwords would know about that prefix in the first place, which is unlikely.
So without that knowledge they would have to test both prefixes and suffixes, without knowledge of the length or of what characters can be in the prefix or suffix. Of course if someone is dedicated enough to brute force a password with an unknown modifier it is not that secure, but it is probably less trouble than dealing with a password manager.

Re:I use passwords.txt.

[RuaisLampSilog]

You obviously have no clue of what you are saying and/or the implicancies of needing to store ~600 different logins, ssh keys and texts securely and still available wherever you go. Oh,and have the tool do the searching and autologin for you.

Re: I use passwords.txt.

[RuaisLampSilog]

Just in case: http://bash.org/?244321

Re:I use passwords.txt.

[Captain Splendid]

And other sites with goofy rules about password expiration/rotation, or stupid lenth requirements (forcing me to use shorter passwords than i want, or omit punctionation etc...)

This is where the 'tiers' come in. Lax password requirements/burner email addresses? Low tier. Most stuff? Medium Tier. Online banking/Sites with crazy requirements? Multiple 20 digit alphanumerics.

Re: I use passwords.txt.

[Anonymous Coward]

Please tell me that was not a real IRC conversation?

Re:I use passwords.txt.

[maestroX]

That's amazing! I have the same combination on my luggage!

Re: I use passwords.txt.

[Anonymous Coward]

You should do 5 minutes of google research about what Cryptographers and InfoSec analysts think about the concept of "security by obscurity". Also, I would argue that you gave up the obscurity part by telling people exactly how your system works online...

Re:I use passwords.txt.

[Anonymous Coward]

you got balls.....

may the schwartz be with you

Re:I use passwords.txt.

[Anonymous Coward]

with lastpass you can specify which field to populate a password into.

That being said, I remember a few years ago telling a bank that for security they should have a randomized keypad to enter numbers.
This way even if there's a keylogger / mouse movement tracker, there is no way to know what numbers were typed in for the password since the keypad randomizes on each instantiation.
Yes they could maybe determine what random seed number was used to change the keypad numbers but that is exponentially harder than looking at recorded keystrokes / mouse movements.

Unfortunately they took that feature away

Re: I use passwords.txt.

[ShanghaiBill]

Six characters that are alpha numeric is not that much entropy.

(26 + 26 + 10) ^ 6 = 56800235584

If they know the word from the text file and your convention ...

1. They don't know the convention
2. They have no way to do offline search, so each attempt will be online and take a significant fraction of a second.
3. All the accounts I care about shut down after 3 to 5 unsuccessful attempts and require 2 factor to re-enable.
4. Most important accounts don't allow ANY attempts from an unrecognized device without 2 factor.

"Lastpassholes hobble free tier, jack prices"

[xxxJonBoyxxx]

"Lastpassholes hobble free tier, jack prices"

FT headline FY.

Never understood the whole, "here Internet, take my passwords" mentality anyway.

Re:"Lastpassholes hobble free tier, jack prices"

[Anonymous Coward]

If I understand correctly, they don't have your passwords. They only hold blobs of bits that you can ask them to retrieve and resend to you. Everything is done local on your device (cellphone, laptop, PC, etc.). They don't even know what the bits are for. Of course, that begs the question why not save $20 a year and just do the same thing with a USB key or some sort of storage that you can easily duplicate/synchronize to all your devices?

Re:"Lastpassholes hobble free tier, jack prices"

[DarkRookie]

If everything is local, I shouldnt need an account to use it.

Re:"Lastpassholes hobble free tier, jack prices"

[Anonymous Coward]

Never understood the whole, "here Internet, take my passwords" mentality anyway.

Fair enough. I've never understood the concern myself, the existence of the company is predicated on them being found lying about the fact they don't have access to your passwords and on securing access. Personally I see the risk of using weaker passwords, or alternatively the hassle (obstacle) of maintaining a current and complete password inventory across my phone, work PC, work laptop, home PC, mobile and tablet as more important.

I've got 411 personal passwords (for a handful of the riskiest credentials I don't keep all authentication details on there). We're also up to 94 passwords on a small company teams implementation which is handy for things like devices (I can click a button and be logged into a UPS web interface, or pull up my phone and quickly see the lock code for display screen menus as can other authorised users). I've seriously considered moving to a self-managed keysafe but ease of use does have a value and I'm concerned it would lead to me weakening the credentials I use. With that said, I will be checking my options before renewing again. The service they offer is hardly expensive, it's a small amount of storage and a convenient interface, and even though $24 isn't much I don't like the principle of companies gouging customers because they hope the hassle of moving will put them off.

Re:"Lastpassholes hobble free tier, jack prices"

[EndlessNameless]

Never understood the whole, "here Internet, take my passwords" mentality anyway.

They don't have your passwords---at least, not in a usable form.

You create a master password for the application. It encrypts your unique, per-site passwords and syncs them. LastPass only sees encrypted data.

Meanwhile, you can create a strong, unique password for every site that you use. You can even use unique names to obstruct doxxing.

The application acts as a local database so that you don't have to remember each and every logon. Your security is a little easier, and they have nothing useful assuming the crypto is solid.

It makes a lot of sense if you have a lot of accounts. Me, though... I don't sign up for enough things to make it worthwhile.

Re:"Lastpassholes hobble free tier, jack prices"

[Anonymous Coward]

Because it's impossible for them to create backdoors on their crypto algo so the company can decrypt your binary blob containing passwords, correct?
?
? /sarcasm

Re:"Lastpassholes hobble free tier, jack prices"

[butzwonker]

I wouldn't trust them, since they're located in Washington D.C.. I've written my own password manager 20 years ago and still use it. Less features, but at least if there is a flaw in it, then it's my own fault and not some intern's at random company XYZ.

Re:"Lastpassholes hobble free tier, jack prices"

[vux984]

They only hold blobs of bits that you can ask them to retrieve and resend to you. Everything is done local on your device (cellphone, laptop, PC, etc.).

Given that it's a web application, you potentially download new application code each time you use it.

It would be pretty trivial for them to sneak in an update that doesn't do what you expect it to do, and even to serve just targeted individuals malicious code.

So ... If the site were ever compromised, or under NSA gag etc, they could inject code, and collect master passwords without you ever knowing.

Of course, these are risks with any web app; but other web apps aren't the master repository for my security credentials, including credentials to corporate property like their domain registrars, vpn credentials, etc; not to mention a one stop identity theft shop.

Of course, that begs the question why not save $20 a year and just do the same thing with a USB key or some sort of storage that you can easily duplicate/synchronize to all your devices?
Flag as Inappropriate

Indeed. I personally advocate separating the responsibility for the hosting from the encryption. Encryption should be strictly client side; not 'client side downloaded from the server everytime you need it". Because then you really don't know what you are running each time you visit.

So, something like password gorilla or password safe or keepass running against spideroak, or owncloud... or even dropbox. Because then really doesn't matter if the cloud storage provider gets hacked through and through.

Now its possible password safe etc gets hacked and a malicious download made available, but the updates aren't that regular, it's open source, and I choose when to update, and whether to update. An attack like that would be far less far-reaching or effective. It is far easier for the code to be inspected and vetted, and to establish that I am actually running the code that was inspected, etc than anything in a web app.

No security is perfect, and everyone needs to make their own balance of convenience to security. I feel lastpass is way over on the side of convenience, with the compromises to security inherent in that.

Re:"Lastpassholes hobble free tier, jack prices"

[Excelcia]

Sure, LastPass may do everything is done on the local device - but it's done with a non-open-source app that they distribute. So we can just trust them that they would never ever do anything with my passwords.

A fantastic solution, which works fantastically for me, is KeePass + Syncthing (or you can use KeePass + DropBox/Box/anything). My password database file is distributed across all the devices which use it by Syncthing. I happen to control the communication path end-to-end with a hosted virtual server (which I have anyway for my web site, mail, and DNS server), but even so I still use a password + key file with the KeePass database so that the database is essentially useless if it's intercepted. The key file is never ever transmitted over any network. KeePass is also great for storing all my bank account and credit card numbers and photo ID (since you can attach images to an entry in the database), so as long as I have my phone I have all my ID as well. If I were ever to lose my phone the database's password is strong enough to stand up to strenuous brute force long enough for me to change all my passwords. Getting my credit cards reissued would be a pain, but is a trade off I'm willing to accept for the convenience of easy access to everything in the few times I forget my wallet at home.

Shocked.

[Anonymous Coward]

Shocked I tell you.

good business model

[Anonymous Coward]

#1 get them hooked
#2 get their passwords
#3 ????
#4 profit !!!!

Re:Well, i don't know...

[fustakrakich]

That post is almost illegible. Did you do that on purpose?

And please, don't start crying about unicode

Remember that there are alternatives

[Anonymous Coward]

that are just as good. Don't think that LastPass is the single condition for storing your passwords securely.

Re:Remember that there are alternatives

[Anonymous Coward]

Remember that there are alternatives..., that are just as good.

links please.

1GB?

[magarity]

A hosted 1GB of storage is kinda dinky compared to all the providers where one can get cloud storage but the infrastructure to provide it properly isn't all that cheap. I can't help but wonder why they thought to tack this on to their service.

Re:1GB?

[swb]

Maybe it's meant to cover all your stored password data, notes, etc in aggregate.

Because there are people who will look at it as a kind of steganographic file system and try to store a bunch of non-password data in LastPass under the idea that it's more secure than most file sharing systems, an unconventional place to put it, and possibly provides greater legal protection that file sharing specifically (I don't know if this last bit is true, but I guess I'd see it harder for the cops to get a warrant for your LastPass account as opposed to your Dropbox account).

Re:1GB?

[darkain]

My only thought is simplified remote encrypted storage? Something I don't really see the other providers doing. For basic personal documents, I think this would be worth it (think life insurance, social security, etc)

Re:1GB?

[DarkRookie]

The 15 both Google and Microsoft offer for free isnt much better

Re:1GB?

[Roger W Moore]

For basic personal documents, I think this would be worth it (think life insurance, social security, etc)

Agreed but both the local and remote copies need to be encrypted and require password access. My current solution for this is an encrypted disk image on Dropbox which works fine as long as the image can be kept reasonably small (few 100 MB).

Re: 1GB?

[Anonymous Coward]

Just use an abstract art image.Xor the site name with a fav prime and use that as a byte lookup on the file. I store my password as wallpaper and can dl it from google images.

Re:Well, i don't know...

[Anonymous Coward]

whatâ(TM)s the aim of a âoestoryâ

Seriously, does OP type their responses into MS Word, then post them here?

The Drawback of the Cloud

[sehlat]

Once you become dependent on cloud services, they are no longer in your service, you are in theirs.

Re:The Drawback of the Cloud

[Anonymous Coward]

"That's a nice password you got here. Wouldn't it be a shame if something happened to it? By the way, our new service is $24 - whaddya say? Shall I sign you up for one, or two?"

Re:The Drawback of the Cloud

[Trogre]

And, as a bonus, they know all your passwords.

Had no idea this was even a thing

[Rick Schumann]

Furthermore I can't comprehend why anyone would think such a service is safe to use in the first place. Typical 'Cloud' service: Get you used to it, then rip the rug right out from under you. Also, as previously stated: Why would anyone think something like this is safe or a good idea in the first place? Let a bunch of faceless strangers on the Internet keep all your passwords for you?

Re:Had no idea this was even a thing

[msauve]

"Let a bunch of faceless strangers on the Internet keep all your passwords for you?"

They don't. They keep encrypted versions of your passwords. All encryption/decryption happens locally.

Re:Had no idea this was even a thing

[Anonymous Coward]

Spoken like someone who has no idea how password databases work. You can give your password database to anyone and unless they have the master password they can't open it. All password databases work like this.

Re:Had no idea this was even a thing

[jtara]

> Furthermore I can't comprehend why anyone would think such a service is safe to use in the first place

It's safe because the data is encrypted on your local computer/device. The encrypted data is sent up to the cloud. The company doesn't have any key that can be used to decrypt it.

You do have to guard your master password! But most of us can memorize one good password.

Re:Had no idea this was even a thing

[Rick Schumann]

I understand all that. But I still would not trust them.

Re:Had no idea this was even a thing

[Anonymous Coward]

They keep encrypted versions of your passwords. All encryption/decryption happens locally.

Ummmm...yeah. I'm sure they do. And I promise I won't cum in your mouth. Pinky promise.

Re:Had no idea this was even a thing

[Rick Schumann]

I understand perfectly well how all that works. Doesn't mean I trust them at all or see why anyone with at least two working brain cells would trust them.

Re: Had no idea this was even a thing

[Anonymous Coward]

Ignorant & paranoid

Re:Had no idea this was even a thing

[ctilsie242]

It is a gamble. For a lot of users, having randomly generated passwords that are stuffed in a PW database is more secure than having them have "hunter2" for their bank, "swordfish" for their Facebook account, etc. The chance of a mass compromise of a Lastpass is definitely less than having one's password revealed to the world the next time some company's list of hashed PWs gets snarfed.

Even with the potential hazard, if combined with 2FA, the hazard of a compromised password is reduced significantly.

To boot, longer, hairier PWs can be used as well, as the user doesn't have to remember them.

Re:Had no idea this was even a thing

[Anonymous Coward]

For the most part I agree. On the other hand, there are important passwords (e.g. banking) and unimportant passwords (e.g. forums). It is possible to use a service such as this one for the latter and not the former.

Re:Had no idea this was even a thing

[suutar]

You also have to trust the company to not have their product leak your master password to them.

Re:Had no idea this was even a thing

[bill_mcgonigle]

Ummmm...yeah. I'm sure they do. And I promise I won't cum in your mouth. Pinky promise.

So do you work for a competitor or did you just want to comment without reading up on how the encryption is done locally with audited viewable-source code in the browser extensions?

Re:Had no idea this was even a thing

[AmiMoJo]

The real issue with LastPass is that it runs in a browser. The most common way of using it is a browser add-on, and it's been found vulnerable in the past.

Much better to have a separate app and copy/paste. Javascript is not secure.

Also, KeePass is free and you can sync the database via your own server or any number of free services.

Re:Had no idea this was even a thing

[Anonymous Coward]

Ah, spotted the /. security expert! You've reverse engineered LastPass up to the last undocumented opcode they are using, so you can assure us their program is safe!

Jokes aside, if you're fine with trusting all your passwords in the hands of a company located in Washington D.C., USA, then you should be fine. I personally wouldn't, but at least they look alright.

Re:Had no idea this was even a thing

[aaarrrgggh]

Unfortunately, copy/paste isn't so secure either.

Re: Had no idea this was even a thing

[Anonymous Coward]

KeePass has at least two ways of password-transfer that do not involve copy/paste:

1. Auto-fill using global hotkey: press hotkey, enter master password, username+tab+password+enter is "typed" into the active window.
2. Drag-and-drop text using the mouse pointer.

Neither of these are KeePass-specific, but KeePass does them very well.

Re:Had no idea this was even a thing

[Anonymous Coward]

For me, it's nice for those unimportant sites where you create a random username, random password, with some random personal details -- all those sites where you need to login but aren't anywhere near as important as your bank or tax department.

I migrated to KeePass some time ago... and glad I did. Not so likely to be #### over by random changes like this!

Re:Had no idea this was even a thing

[Anonymous Coward]

Much better to have a separate app and copy/paste. Javascript is not secure.

JS isn't the root problem here. The security context is. If the browser gets compromised so is any code that it runs, or any memory that it has allocated, as a result. If it can launch a new process, so is that process and any descendant it makes. Anything on disk that it has permission to open is compromised, anything it has permission to write is infectable. Any connection it has the ability to listen on is compromised, any connection it has the ability to send on is a new impersonation. This is true of any program not just web browsers.

The last thing you want to do is expose critical authorities to unreasonable risk. Which is what you are doing when running something like a password manager inside of a insecure program that runs instructions from an unknown untrustworthy source. (Like a web browser.) What those instructions are, is not as important as where they come from and how they can be changed. I.e. A locally installed program that must be updated manually by an authorized individual is much harder to alter for malicious purposes than code from some random server on the internet.

And before you say code signing: Unless you got that public key from the developer themselves in person, and you both verified it and each other at that time, it's not trustworthy. It can be just as easily intercepted in transit and replaced with a compromised key, as can any code, signature, or html document you request from the server over a connection "secured" by a random bundle of unverifiable certificates that either shipped with your computer / browser or was downloaded the same way as your request via a url that has no means to verify, and could be intercepted anyway by someone modifying the routing tables between you and the real server to say whatever "verified" IP address you looked up was owned by some other random server. Never mind that the signature only verifies the executable image on disk NOT the code in memory while it's running. (The only way it could would be to use a crypto processor to verify each executed instruction between each instruction fetch, and you'd have to have a ridiculous amount of memory to account for each possible codepath (as the instructions executed before the current one are important, you have to include context in the verification process), and you'd have to solve the halting problem to do that. Also the ridiculous amount of processing power you'd need to verify each individual instruction for every possible codepath makes that idea impossibly difficult to implement with any amount of reasonable execution speed. And all of that assumes your system is not already compromised by something else.) Long story short, code signing is useless except under very specific circumstances that do not apply to most people nor can it be expected to. The only thing it's good for is giving false assurances of security to a clueless public that wants SOMETHING done about their lack of security without them being involved in it.

Re:Had no idea this was even a thing

[Lost Race]

I like how they claim "more than thirty years of combined development, network security and user interface experience" then show pictures of 32 people. So... about one year of experience each then?

Re:Had no idea this was even a thing

[Anonymous Coward]

Any any paticular person of interest won't invisibly have this turned off (or a side channel to send the actual pw's).

Because it's a web service, this would be *PISS EASY* to do without anyone knowing (provided you kept the masses with the 'nornal' code for your site.

That way you could snipe passwords all day from singular users, nobody would know.

Re: Had no idea this was even a thing

[Anonymous Coward]

Not ignorant, certainly. Paranoid perhaps, but why take chances with important data when you don't have to?

How do you know Lastpass won't sniff you master password and send it back to their servers? It would be easy enough for them to hide it, if they send it along with the regular sync data they need to send anyway. And for the browser based version, they only need to send the password sniffing code once, and the code they send can be clean all the other times up until you change you password. They probably don't do this, but they could potentially do it on a targeted basis. But unless you reverse engineer and thoroughly check what their code does (not an easy task in itself) every time you update their app, or every time you download their browser-based code, then you can never really be sure.

On the other hand. If you use an open-source password manager, one that has already been check for flaw, there is unlikely to be any malicious code in it, and you can use any cloud-based storage for syncing the password file. The functionality is perhaps a bit more cumbersome this way, but it achieves the same end result without taking an unnecessary risk.

Re:Had no idea this was even a thing

[Rick Schumann]

Meanwhile there's zero risk when I use my own formula for passwords that the likelihood of anyone cracking is small, and since it's a formula and not random characters they're easy for me to remember -- or if it's one I don't use more than a couple times a year, write it down on a nice piece of low-tech paper and hide it somewhere. Frankly I feel I have more to worry about from data breaches from whatever website or company than I do anyone guessing my passwords or raiding my house to look for scraps of paper.

Surprise....

[Anonymous Coward]

Big surprise. I used them because they were decently priced and useful. I got annoyed when I had to start paying for my wife's account because they stopped letting you use the free version on mobile. Now they're doubling the price and their browser extension has become a shitpile of slow-loading crap.

So where's the open source alternative? I don't want to go back to a GPG encrypted text file. Or will everyone *please* implement U2F with yubikeys already? It's nearly 2018...

Re:Surprise....

[Anonymous Coward]

Uh nice job doing any amount of looking. Keyeass is great alternative and is open source.

http://keepass.info

$24 seems kind of high

[execthis]

I just renewed recently while it was still $12/year. I feel that $24/year is a bit high. But on the other side, I would never need any of the premium features. That said, I'm happy to pay $12 per year for their service to help a great company. Lastpass has been solid and their service is indispensible.

Re:$24 seems kind of high

[Anonymous Coward]

You *should* be using two-factor auth, which comes at premium sub.

Re:$24 seems kind of high

[Anonymous Coward]

Even at $24, they are still cheaper than the competition. I'm going to keep using them, because they have managed to get hacked, and their security is good enough that even with that, no plaintext passwords were obtained. This is good enough in my book.

Re:$24 seems kind of high

[Anonymous Coward]

So $2/month to make safeguarding all your website accounts is too high, but what else have you wasted $2 on this month? Probably a lot of things.

Re:$24 seems kind of high

[blahbooboo]

You *should* be using two-factor auth, which comes at premium sub.

Wrong. Multifactor is in free teer. Advanced multifactor is extra. Read next time

Re:$24 seems kind of high

[Anonymous Coward]

It's not $2 a month, if you can't pay for it month by month--it's simply $24 a year. Pricing language sugar coats reality for some, while serving as a bittering agent for others.

Re:$24 seems kind of high

[Anonymous Coward]

actually a lot of people would say it WAS a great company, unfortunately it got acquired by a company that was known for its unethical ways of subscribing users and making it hard to cancel.

If you need a password manager

[Anonymous Coward]

then you spend to much fricking time online.

I subscibe to a number of online services small enough that I can remember all my passwords. Old school brain memory is the ultimate available-on-all-my-devices-and-unhackable service.

Password managers are like all those people who seriously try to make us believe that they really need all those two dozen credit cards in their wallet. They don't.

Re: If you need a password manager

[Anonymous Coward]

I have 75+ sites in lastpass so yeah maybe too much online or in this day and age not really

Re:If you need a password manager

[Minupla]

I can remember a few passwords. I can't remember a 24 digit random alpha-numeric-symbol string.

You know what I do when I get one of those "Geez, sorry guys, we hashed our data with md5 and posted it on our fridge and someone got all your passwords. Change them quick!" emails form SecurityWazzat.org? Giggle as I imagine someone chewing up cycles trying to dehash my random gibberish... Hope they enjoy waiting forever for my password to turn into something readable. Oh, and since I use a different random password for each site it doesn't matter anyways.

Now I'm in the infosec industry and some of my passwords protect other people's data, and I have a responsibility to keep your data safe, but let's not be so dismissive of other people's security practices. If HorseBatteryStaple is secure enough for your risk tolerances, that's awesome, but it won't be for everyone else's.

Oh and I'll leave this here for anyone interested in a more indepth review of password security:

https://diogomonica.com/2014/1...

Min

Re: If you need a password manager

[cdwiegand]

Or youâ(TM)re a network admin and need to share hundreds of network credentials for internal and vendor systems with your team. Thereâ(TM)s a lot more use cases than what you are magically aware of.

No objection

[jtara]

I've been using LastPass for many years. I used to use Password Safe, which is strictly local. But they had me at "all popular platforms including Linux".

I have no objection to the price increase. They deserve it, and no doubt will use the money to make the product even better.

Re:No objection

[fph il quozientatore]

Should have been "all popular platforms, and then Linux, too".

Re:No objection

[Anonymous Coward]

lol, unprovoked even...

Re:Well, i don't know...

[grub]

Is that Perl?

Re:Betteridge's Law of Headlines

[unixisc]

Says someone obviously grammar challenged, & can't tell whether or not a headline is a question. Betteridge's law only applies to headline questions that have a simple yes/no answer

Re:Well, i don't know...

[unixisc]

Not a bad idea, if one is afraid of the browser quitting any time and eating that composing time w/ it. A lot of people, after being burned, adapted this policy. And yeah, it's perfectly legitimate to scream about Unicode: Android, iOS and even Windows 10 supports it, but Slashdot doesn't. And renders posts in ridiculous ways out here.

Great - count me in

[Troed]

I was a Premium user since they launched. The changes to the free tier last year caught me by surprise, and sure enough, since I had no reason to pay for Premium I stopped. I remember getting an automated questionnaire as to why I stopped being a Premium customer and I explained clearly that they now offered the full feature set I was interested in in the free tier.

Now they're apparently changing it so that one feature I want (emergency access) becomes part of the Premium package. Fair enough, they'll get me back as a Premium customer. LastPass is one of those tools I happily pay for, no questions asked.

Re:Great - count me in

[Anonymous Coward]

LastPass is one of those tools I happily pay for, no questions asked.

Apparently not, as you stopped paying in the past.

I use KeePass

[b0bby]

I've used KeePass for years now, and while I don't have all the fancy password sharing features I do have my passwords, in a format I trust, available on my PCs and phone. I haven't yet seen a reason to switch.

Re:I use KeePass

[idji]

and with the keepass files in dropbox, my passwords are auto synched to my wife's laptop and vice versa. Pressing CTRL-S on a password file synchs it. and with dropbox and minikeepass on my iphone they all synch to my smartphone.

Re:I use KeePass

[bigal123]

Last i saw Minikeepass on iPhone still did not support the new Keepass XML format or encryption. You found anything else for iOS? Still looking for my iOS friends. Android was easy.

Re:Well, i don't know...

[Frosty Piss]

Not a bad idea, if one is afraid of the browser quitting any time and eating that composing time w/ it. A lot of people, after being burned, adapted this policy. And yeah, it's perfectly legitimate to scream about Unicode: Android, iOS and even Windows 10 supports it, but Slashdot doesn't. And renders posts in ridiculous ways out here.

Actually, I *did* type it in Word on Windows 10, but what's interesting is I pasted it into Notepad and replaced all the Unicode, but apprently Notepad really didn't replace them...

Just use KeePass

[chaotixx]

Just use open source KeePass to hold your passwords and use DropBox to sync your encrypted database between computers/phones/tablets. Works great between Windows, iOS, and Android at least. http://keepass.info/

Re:Just use KeePass

[Major_Disorder]

I do exactly this. Has worked well for me for several years.

Re:Just use KeePass

[jukk]

I've also been using keepass for years with password file in Dropbox. Syncs between all of my devices including linux PCs and Jolla phone (Sailfish). Even on terminal with keepassc (dropbox works also fine in terminal). Then there is an increasing number of sites accepting TOTP 2FA. You then also need your phone or tablet with a TOTP application, but it doesn't feel like too much hassle.

Is PINS.exe still a secure option ?

[Anonymous Coward]

Is PINS.exe still a secure option ?

I don't thinks its being maintained but was very handy a number of years ago.

Keepass & NextCloud..

[erktrek]

So why not use a local app and cloud storage service? I use Keepass and NextCloud but could easily use GoogleDrive or DropBox or somesuch. The encrypted file doesn't take up that much space and you can sync it to whatever device you want.

Re:Keepass & NextCloud..

[Anonymous Coward]

So why not use a local app and cloud storage service? I use Keepass and NextCloud but could easily use GoogleDrive or DropBox or somesuch. The encrypted file doesn't take up that much space and you can sync it to whatever device you want.

For me, it's a matter of accessing my passwords at home and at work. I use LastPass because it runs in the browser. At work, we can't install third party applications. But I can install a browser plugin.

So I can't use KeePass at work, because that's an applicaiton. But I can use LastPass at work. So I'm using LastPass.

Re:Keepass & NextCloud..

[danpritts]

The browser integration is arguably as valuable as the multi-device syncing. They also have sharing features so that you can share certain passwords with other people.

Re:Keepass & NextCloud..

[Anonymous Coward]

pretty much this, i use keepass + spideroak myself, also for the comment below mentioning integration, keepass does have autotype which great if done correctly, you press the autotype hotkey, keepass asks for the database password than types in your username{tab}password assuming you have the username input field focused.

Doesnt work so well on mobile though :/

Re:Keepass & NextCloud..

[Anonymous Coward]

Because the interface for those aren't as good. I use KeePass myself but I can barely get mys ister to change her passwords. I could never get her to use something like KeePass it's super awkward to explain even when I set up everything for her. LastPass is nice and simple. Ever since it made mobile sync free I've been trying to push it on her.

Re:Keepass & NextCloud..

[Anonymous Coward]

KeePass does have browser integration for the record. It's not built in but it's as simple as download a plugin, install an extension and then approve the extension and it's basically working anytime you have it open and not when you don't.

Which is cool because it means you can for instance put your key file on a flash drive and no one can access your passwords with your computer even with your database.

Re:Keepass & NextCloud..

[Anonymous Coward]

For me, it's a matter of accessing my passwords at home and at work. I use LastPass because it runs in the browser. At work, we can't install third party applications. But I can install a browser plugin.
So I can't use KeePass at work, because that's an applicaiton. But I can use LastPass at work. So I'm using LastPass.

If you're happy with LastPass then this probably doesn't matter, but it may still be possible for you (or anyone in your situation) to still use KeePass.

You said you can't install applications, which is fairly common, but can you run executables?
(By "can" that would be both technically and allowed to by policy)

There is a standalone "portable" version of KeePass that doesn't require any installation.
It's one program executable and one config file read from the same directory, which typically is where you'd also keep the database file.
This way it can be kept on and run straight from a USB flash drive, or in a folder synced to a server somewhere, etc.

Also I don't know exactly how LastPass integrates with your browser, but there is at least two Chrome extensions for KeePass available.
One works completely within the Chrome extension and can decrypt and open a keepass database file directly, although in a read-only sort of way.
The other extension however requires KeePass installed to communicate with, in order to replace the Chrome password store. I don't know for sure but assume it requires the installed version of KeePass, so that option probably wouldn't work for you.

I do recall seeing other KeePass addons available on their website for other browsers, but have no experience with them myself.

Re: Keepass & NextCloud..

[Anonymous Coward]

Keepass does not have to be installed. Use the portable download. Unzip and run.

Install keepass apps on your phone and with cloud drive apps you have access to the same data. Android use keepass2android.

You should report the hole in the company policy about third party application installation. A browser plugin is as dangerous to security and stability as installed applications.

OS policy on installing is easy to get around. OS policy on application execution may not.

Why use a password manager?

[BitterOak]

I just use gandalf as my password everywhere. If they require letters and digits then I use gandalf1.

Re:Why use a password manager?

[Anonymous Coward]

Difficult to remember the word gandalf, I just use password1 so I would remember it every time I login online. Easy to remember because the txtbox is labeled similar to my password. Also my pasword hint is "rhymes with ass-word".

Re:Why use a password manager?

[Anonymous Coward]

I use "wizard1" for unimportant places like AT&T accounts and "give me cookies" for more important connections like when I hook up with NORAD.

rent seeking as inevitable as gravity

[Thud457]

That's a nice password list you've trusted us to hold for ya. It'd be a real shame if anything happened to it.

in other news...

[dAzED1]

In other news, people still use services what that store all the keys to the kingdom...and now, those services have extended to sharing your passwords to others. :sigh: it's like laziness and lack of security is a virtue these days...

Re:Well, i don't know...

[DarkRookie]

I will when they remove the emoticons

Re:Well, i don't know...

[Anonymous Coward]

That's a very strange browser if it quits without any warning. I have posted here more than 100 posts, real posts and not spam, but haven't experienced my browser quitting or crashing without any warning. Maybe my OS is more stable? Didn't experience a browser crash since the past 3 years.

p.s
Seriously, I don't use any ad-blocker, no Java, no Flash only using JavaScript + hand edited my hosts files after importing 24 MB of junk sites.
I am on XP and browser is FireFox and currently having 7 slashdot tabs open on my browser and taskmgr is telling me I have consumed 330 MB out of 4 GB of total RAM.

Re:Well, i don't know...

[fustakrakich]

Android, iOS and even Windows 10 supports it, but Slashdot doesn't.

Yes, and that is a feature. There is no need to take unnecessary risks.

Re:Well, i don't know...

[Anonymous Coward]

Definitely not Perl, looks like COBOL to me.

Re:Well, i don't know...

[mark-t]

It doesn't help matters that the edit box in which one creates such posts will happily accept such characters as input and display them appropriately there.

Re:Well, i don't know...

[fustakrakich]

That part is not a feature. The text box should sanitize input also, or maybe not since it is not stored on their server yet. That's where preview comes in? And it's a bit trickier in journals, but I did find a preview that works there.

So basically, they just went all Netflix.....

[Drakonblayde]

If I'm understanding things right, what they're doing is basically pulling some features out of Free and making them Premium only (I'm ok with this), but they're doubling the price of Premium without actually adding any additional benefit to the users.

I cancelled my Netflix account when they tried this same stuff lo those many years ago. I understand the need to raise prices, but generally speaking, a naked money grab doesn't tend to go over well with users, A moderate raise in the yearly price, ok, not that big of a deal, but when you mark up 100% without adding any benefit, yeah, thanks, but no.

Thankfully, I've had my solution in place for years. KeePass is also multi platform and I just sync the database among my devices (started out with Dropbox, then Google Drive, now I use the Synology Cloud Sync stuff on my NAS in order to keep all my Cloud Synced stuff private)

Re: Well, i don't know...

[Anonymous Coward]

Fuck you, fish tits.!!!.

I saw this coming

[Anonymous Coward]

It was pretty obvious this was going to happen when they were bought by LogMeIn last year as they have a history of buying good, useful things and jacking up the price. That's why I bought 5 years of Premium subscription as soon as the purchase by LogMeIn was announced. I'm actually surprised it's only a 100% increase so far.

Proprietary software for passwords?

[VeryFluffyBunny]

You can't trust closed source, proprietary software, full stop. It may be ethical and secure today but how will you know when that changes if nobody but the company selling you the software/service can do a security and privacy audit? And what if they get a national security letter one day and push an update that sends all your passwords and usernames to the NSA?

Re:Proprietary software for passwords?

[Anonymous Coward]

it's been hacked before.. repeatedly.. it's had vulnerabilities... repeatedly... and who knows what happens to your data when they sell out. who knows what the software is *really* doing as it's closed source. i would never even consider using lastpass. never.

Re:Proprietary software for passwords?

[Anonymous Coward]

Troll and FUDer

You can easily see exactly what the browser plugin is doing, because it's written in Javascript.

EnPass

[CrashNBrn]

I switched to EnPass, which runs locally on your machine (encrypted) and a browser addon uses a websocket to connect the two. Which means it doesn't inject itself into every page like Lastpass. Also LastPass tends to cause Firefox to take fits.

EnPass runs on pretty much any platform:

iOS, Android, Blackberry, macOS, Windows, Linux, USB-Stick, Chromebook

So pay for premium if you value it

[Anonymous Coward]

Sorry not sorry. If you value something then pay for it. If you are using a free service that is no longer available for free, well you should be happy you got the free ride in the first place.

Obviously they felt as a company they have a product people want and are seeing less of a need to give away free services. They may lose some non-paying customers, but that isn't exactly going to hurt the revenue now is it?

I have a cheaper method...

[Anonymous Coward]

A piece of paper and pencil. It's amazing how much money I can save for password access and also have access to said passwords when the Internet takes a crap.

Re: Well, i don't know...

[Anonymous Coward]

You have to save it in notepad (ansi) and close/reopen it for the "washing" to take effect.

Re:Well, i don't know...

[Anonymous Coward]

If that happens to you, maybe you should change your browser to one that isn't shit.

Re:Well, i don't know...

[unixisc]

Why not use Wordpad instead, which saves you from those formats? I know that Notepad has that annoying scrollovers that won't go to the next line until carriage return. But Wordpad does it right

Re:Well, i don't know...

[unixisc]

It's happened to me occasionally w/ both FireFox and Chrome. Not on Slashdot, though, but other sites.

Re: Well, i don't know...

[BcNexus]

XP?!? That can't be secure online, can it?

My password generator

[Anonymous Coward]

Here's my encrypted password generator:

#include <stdio.h> // cc -o tinyrg32 tinyrg32.c ; ./tinyrg32 'Test vector'
#include <stdint.h> // ./tinyrg32 --hex --numbers 'A tiny list of numbers'
#define b(z) for(c=0;c<(z);c++) // ./tinyrg32 --binary-stream 'Es la niña'
#define d f[c*13]^=s;e[16+c]^=s; // This is public domain, but NO WARRANTY
uint32_t c,e[19],f[40],g=19,h=13,r,s,t,n[19],i,k;void m(){int c,j=0;b(12)f
[c+c%3*h]^=e[c+1];b(g){j=(c+j)&31;i=c*7%g;k=e[i++];k^=e[i%g]|~e[(i+1)%g];n
[c]=k>>j|k<<(32-j);}for(i=39;i--;f[i+1]=f[i])e[i%g]=n[i%g]^n[(i+1)%g]^n[(i
+4)%g];*e^=1;b(3)e[c+h]^=f[c*h]=f[c*h+h];}int main(int p,char**v){char *q=
v[--p];b(40)f[c]=e[c%19]=0;for(;;m()){b(3){for(s=r=0;r<4;){t=*q++;s|=(t?t&
255:1)<<8*r++;if(!t){d;b(17)m();b(p?8*p:8){if(~t&1)m();s=e[(t&1)+1];r=(p&3
)-2?c:1;b(4){i=s;if(p&4){i&=31;i+=i<8?50:89;}printf(p==2||p&4?"%c":"%02x",
255&i);s>>=8;}c=r;if((++t%8==0||(p&22)==2)&&p-2)puts("");}return 0;}}d;}}}

Point being, no one needs Lastpass to make strong passwords that are not duplicated.

Mobile

[eWarz]

They haven't even figured out how to implement proper support on mobile devices and they are raising the price? Hah! On Android, their only real 'supported' method is using Android accessibility services that drastically slow down the device and reduce battery life (it's meant for REAL accessibility needs like blindness, etc.). If you try to avoid that option your only other options are a glitchy Android 2.3 era keyboard or their internal browser. Thanks, but no thanks. The password manager built into Chrome or the Samsung browser may be far more limited, but it works better than lastpass...don't get me started on the fact that Google is rumored to be toying with a universal password manager for Android internally. (I don't mention Apple here because outside of a Macbook Pro and Mac Mini I use for dev work, I don't use anything Apple creates at all, so I have no idea if the situation is better/worse over there).

Re: Well, i don't know...

[Anonymous Coward]

If you believe that I have a bridge to sell to you.

KeePassX and a Tresorit

[Anonymous Coward]

Both are free and cross platform. But honestly, a Dropbox account works just as well if you're not too paranoid.

Re: Well, i don't know...

[Anonymous Coward]

...and what do you believe my dear?

That XPocalypse is true?
That the latest Windows don't have bugs?
That the latest and shiniest Windows is more secure than the previous ones?

I am sure internet browsers in Win10 or Win8.1 would only crash if you keep on lambasting M$ on your posts. Now which OS is more secure? LOL

I am curios when my Win8.1 consumes 3.8 GB (3,800 MB) of RAM on startup while my XP machine uses only 82 MB of RAM. Which one has more bugs logically?

Why? Just why?

[Anonymous Coward]

You can steal quotes from [insert favourite film] and prefix the weight of an electron on to it and be done.
Why waste your time with stupid cloud shit when all it takes is not being lazy to (remember and) type 20+ words?

No attacker is going to know a single thing about your password, nothing. (unless the sysadmin can't understand unicode so limits you to ASCII / base62 usually, making brute forcing trivial)
They can't just shit out a magical dictionary attack that will know exactly how long your password is or what characters you used.
It needs to brute force every iteration of every word. If you use non-English words, for example, most dictionary attacks fail horribly.

Even if you use the longest password ever, it won't matter if the hashing system used by the sysadmin is weak, in which case hash collisions can occur with passwords that could be well under a tenth of the size.
Never mind the DB being leaked. That'd be worse.

Don't spout "but I have like 10 passwords I need to remember!", I have well over 50 of the damn things memorized.
Stop being lazy and actually use your damn brain. Offloading memory-tasks to other systems makes you provably dumber the more you rely on them.

NOT stuff that matters

[UsuallyReasonable]

Someone raised their price. Who cares?

I use Codebook

[CanadianMacFan]

It used to be called STRIP and they have been around since Palm was popular. It doesn't sync to their servers. If you want to sync between devices you log into Dropbox or Google Drive or you can sync over Wi-Fi from the mobile device to the desktop app. It stores the passwords in an strongly encrypted file on your account.

The application itself could use polish but it is very stable and it does everything that I need. It lets you add custom fields. The developers are quick to respond to queries. It's stable, quick, easy to use, and secure.

Beware of the shills!

[Anonymous Coward]

n/t

Re: Well, i don't know...

[Anonymous Coward]

If your idea of secure is relying upon updates, then you are an idiot and you don't know what the fuck you are doing. ANY operating system can be hardened against attack.

LastPass cut off access 2 password with no warning

[leftie]

password just stopped working in the middle of the night

LastPass websites now demanded a full year payment up front to get access to MY PASSWORDS on their servers

Disabled person SSD cut off from online banking in the lat on Friday night
Not one email sent to warn me

Re: Well, i don't know...

[Anonymous Coward]

Its called wordwrap, it was added in win98 or something, just turn it on ffs

Re:Well, i don't know...

[Anonymous Coward]

you're a fucking COCK SMOKER