Lesley Carhart Dec 23, 2022
I’m worried about LastPass’ incident, but I’m equally worried about password managers of renown at all that have not recently disclosed any (data or code base) cybersecurity incidents. Any password manager is a huge, juicy target…
Show threadLesley Carhart Dec 23, 2022
I’m also worried about all y’all going “lololol pEoPle UsE LasTPaSs” when getting just one person on a reputable password manager they’ll actually understand how to use is a massive, uphill battle.
Show threadLesley Carhart Dec 23, 2022
Anyway, like other sane people have said, you don’t have to stop using LastPass - for gods’ sakes just use a password manager. If you use it, spend some time over the holidays changing all your meaningful passwords in it and your master password. Make sure you’re signed up for haveibeenpwned. If a cloud-based password manager is right for your risk and threat model, for heavens sakes don’t stop using it in favor of a techier option you won’t use.
Show threadPatrick C Miller Dec 23, 2022
@hacks4pancakes don't stop using password managers because a single password manager has a security issue. If you did this every time a product had a security issue you wouldn't have any products left to use. It's not if they have a security issue, it's how they handle it. Everyone is essentially buying time between hacks.
Show threadZate 🦘🇦🇺
@patrickcmiller @hacks4pancakes They all have this same issue. That if someone gets the encrypted blob, yes, they can attack it offline. All of them have that issue. It's literally the entire job of the thing is to make the encrypted blob.
Dec 23, 2022 at 5:37amWeb
Show threadPatrick C Miller Dec 23, 2022
@zate @hacks4pancakes well said. And so true. It all comes down to the time/cycles needed to break the encrypted blob.
Show threadZate 🦘🇦🇺Dec 23, 2022

@patrickcmiller @hacks4pancakes right, and having done a quick glance over whitepapers for LP and 1Password, I think sure, 1PAssord is likely to be doing something that looks a bit stronger.

But it's white papers, and I ain't a crypto guy. I just think that the stuff I am reading for both, should be pretty good at protecting something that gets breached given other good practices on the sid of the consumer.

Show threadPatrick C Miller Dec 23, 2022
@zate @hacks4pancakes few of us really qualify as crypto people... 😀​