LastPass data breach...again!

[arrix]

Two weeks ago, the password manager giant LastPass disclosed its systems were compromised for a second time this year.

Two data breaches in one year? If you use this service, I think it might be time to look elsewhere for pw management.

LINK: https://techcrunch.com/2022/12/14/pa...breach-notice/

[TacFan]

first place I would go to as a crook. A place where people store all of their passwords.

Remember, you sacrifice security for convenience. Come up with a system in your head and use passwords for categories so you are not always using the same password everywhere.

[AtomicOrange]

Yeah, I tried a similar system years ago and could not get comfortable with it. Just did not seem right, so I abandoned that idea pretty quickly. Might have been Keypass?

Edit: our cyber guy at work recommended plain old pencil and paper as the safest approach --nothing digital. I used a encrypted container for a while, but too much effort to maintain.

[WoodTurner]

I like both Keepass and Bitwarden.
Keepass if you don't want any cloud/remote access and are willing to spend the extra effort dealing with backups and transferring to other devices.
Bitwarden if you want to host your own server or want a paid cloud solution (as well as the potential downsides that come with that, see OP)

Should also have 2FA on any important accounts.

[nate76239]

They use last pass at my job but I had never signed up to use it fortunately. We got an email about the breach recently.

[rodralig]

Abandoned LastPass years back...

I now use 1Password for my PW management across devices/browsers, etc.


_

[Cowboy T]

KeePass is a good solution. There are versions for MS Windows, Mac OS, and GNU/Linux. Since KeePass and its derivatives are Free Software under the GNU GPL, the issue of backdoors is severely mitigated.

[high_revs]

i only use it for non-financial stuff and my logins i use thre don't "keep" the payment card. as a best practice in case those vendors i use also get hacked, don't keep credit cards online. i go about maybe 4-5 different user names and 4 key passwords with minor variations (depends on each site's password rules). it's easy enough to key in the credit card if you're making a purchase.



they do say.. still need the master key from the user to unlock the passwords.

[WoodTurner]

i only use it for non-financial stuff and my logins i use thre don't "keep" the payment card. as a best practice in case those vendors i use also get hacked, don't keep credit cards online. i go about maybe 4-5 different user names and 4 key passwords with minor variations (depends on each site's password rules). it's easy enough to key in the credit card if you're making a purchase.



they do say.. still need the master key from the user to unlock the passwords.

That's a terrible plan.