Great Password Saver / Security App

[whizzard]

I am sure many of you here have already heard of or use "LastPass".  It organizes, saves, auto-fills, generates, and does everything you can think of for your passwords.  It's great if you like having different passwords for different sites and don't want to write them down.  It organizes them very nicely and I think it is super useful so I figured I would post here in case someone hasn't heard of it.  Basically it is all controlled with one "Master" password, an interesting idea.  I think it is a great security solution for most (emphasis on the most) internet users and it is pretty popular, works with most browsers windows or mac.  It is also FREE.

If you want the extra bells and whistles like I do, you can go premium and get some extras.  I got it because I like using 2-step authentication devices.  I have an invite code for a month of premium free as a trial, (gives me a free month too full disclosure)... so if you want me to send you an invite let me know here or PM me.  All I need is an email to send the invite to.  Check it out especially if you are like I was and used mostly the same password everywhere.  Yes, I know, its a computer sin.  Its a good example of a program I didn't think I needed or would use, but after I did can't go without.

If someone has posted this before... my apologies.

LastPass Site Link

[Belfong]

I use KeePass and its open source and is free. Also have a Mac and iOS client.

[whizzard]

KeePass is another good client for sure.

[RedRoboHood]

I have used LastPass for a couple of months now, and I have been very pleased with it so far. It's elegant, it works well, it's secure, and its UI is very clean. Thanks for creating this thread so more people can experience the joy of LastPass!

[metalliqaz]

Does anyone else have trouble trusting these companies?  Imagine if they were compromised... law enforcement agencies or cyber criminals, I don't know which would be worse

[RedRoboHood]

Does anyone else have trouble trusting these companies?  Imagine if they were compromised... law enforcement agencies or cyber criminals, I don't know which would be worse

If it was an absolute, ongoing security breach, then it would definitely be a problem, but that's true for every company that stores any type of data. However, the great thing about LastPass is that all the data it stores for you is encrypted with AES 256-bit encryption using your master password, and as long as you don't write it down yourself, nobody knows your master password except you. So even if someone were to steal all of the data on all of the LastPass servers, if they don't have your master password, they can't get your data.

[metalliqaz]

How sure are you that they don't have a backdoor like Apple puts in their iPhone encryption? If I remember correctly, Dropbox also has a backdoor.

[RedRoboHood]

How sure are you that they don't have a backdoor like Apple puts in their iPhone encryption? If I remember correctly, Dropbox also has a backdoor.

Honestly, I'm not sure. That's a very possible risk to using any password manager. But to me, the pros of being able to use an extremely strong, unique password for any site, and not needing to remember any password except my master password, far outweigh the con of a possible backdoor or other way my passwords could be compromised. It's a tradeoff, like most things.

[metalliqaz]

That's true. I'm paranoid.

[whizzard]

The best thing you can do is have a hand written list of all your passwords, long strings of characters randomly thought up by you, on a slip of paper that you can keep safe and secure.  Some companies even make little notebooks designed to write your passwords in.  To me, that would be a pain in the ass.  You don't want a text file on your desktop with your passwords (for obvious reasons)...  so unless you are super paranoid that you are a target of hacking, this is a great solution and makes it so you don't have to remember or forget your passwords for any given site.  I made a nice master password and printed it with a labelmaker and stuck it somewhere I can refer to if I need to... easy.  It also saves usernames, which is nice because those can vary as well.

Nothing is foolproof, but unless you have great discipline, you use the same password on a few sites... so just one of those getting compromised threatens more than one account.  I hate forgetting and resetting passwords, especially with the "shutdown rules" some have that you only have a few tries.  And not even having to remember or ever type them in is so convenient.  The reason I love this program is it does what it is supposed to and makes my life easier and my online IDs far more secure.  It keeps your form autofill info inside it as well if you want, making filling stuff out super fast and easy, and it won't be stored in your browser cache like other auto-fills are that are usually targeted. 

Its one of those things you gotta try to appreciate, and I liked it so much I got premium for 10 bucks a year... worth it imo... but if you dont use this one, using some kind of password organizer is a good idea.  The main point is to never use duplicate passwords on any two sites.

[RedRoboHood]

The best thing you can do is have a hand written list of all your passwords, long strings of characters randomly thought up by you, on a slip of paper that you can keep safe and secure.  Some companies even make little notebooks designed to write your passwords in.  To me, that would be a pain in the ass.  You don't want a text file on your desktop with your passwords (for obvious reasons)...  so unless you are super paranoid that you are a target of hacking, this is a great solution and makes it so you don't have to remember or forget your passwords for any given site.  I made a nice master password and printed it with a labelmaker and stuck it somewhere I can refer to if I need to... easy.  It also saves usernames, which is nice because those can vary as well.

Nothing is foolproof, but unless you have great discipline, you use the same password on a few sites... so just one of those getting compromised threatens more than one account.  I hate forgetting and resetting passwords, especially with the "shutdown rules" some have that you only have a few tries.  And not even having to remember or ever type them in is so convenient.  The reason I love this program is it does what it is supposed to and makes my life easier and my online IDs far more secure.  It keeps your form autofill info inside it as well if you want, making filling stuff out super fast and easy, and it won't be stored in your browser cache like other auto-fills are that are usually targeted. 

Its one of those things you gotta try to appreciate, and I liked it so much I got premium for 10 bucks a year... worth it imo... but if you dont use this one, using some kind of password organizer is a good idea.  The main point is to never use duplicate passwords on any two sites.

Yeah, pretty much this. Also, it's debatable whether writing passwords down on a slip of paper is actually the best thing you could do. I think the safest way to keep track of passwords would to keep them all stored on a Raspberry Pi, encrypted using 4096-bit RSA with some sort of master password that you memorize and don't write down anywhere. Of course, that would still have all of the same problems of keeping them on a slip of paper.

(And by the way, it's $12 per year, not $10. )

[noisyturtle]

Fog had a touch-keypass system on his Cartesian that randomly generated a unicode password every time you touched it. One of the coolest things at the meet.

Hell, that entire board was chock full of little features like that.

[Belfong]

That's true. I'm paranoid.

Which is the reason I highly recommend KeePass instead. It being open sourced means that people have checked the source code to ensure that there are no back door.

[RedRoboHood]

Which is the reason I highly recommend KeePass instead. It being open sourced means that people have checked the source code to ensure that there are no back door.

That's very true. I'm thinking it might be a good idea to try out KeePass, now that I've already used LastPass so I can compare the two. There are a couple of reasons I'm reluctant to do so, though:

• I have had multiple bad experiences with my hard drive crashing and causing me to lose important data. One of the things I like about LastPass is that it stores everything online, so if my computer crashes, I still can use my logins. How could I similarly backup my data with KeePass? Some people recommend using something like Dropbox, but that sounds very insecure to me.
• Similar to above; since LastPass is online, I can easily use it on any of my devices. Is there a secure way to do the same thing with KeePass?
• LasPass has extremely convenient auto-fill capabilities. On any website for which I only have one login, it auto-fills it before I even need to do anything. For a website with multiple logins, it only takes two clicks to select the correct one. Does KeePass provide similarly convenient auto-fill features?

[whizzard]

That's true. I'm paranoid.

Which is the reason I highly recommend KeePass instead. It being open sourced means that people have checked the source code to ensure that there are no back door.

I understand what you are trying to say, but sometimes open source is a double-edged sword.  Open source means anyone can look at the program used to encrypt passwords before it is even compiled.  So holes can in some cases be found a little easier than trying to reverse-engineer a proprietary code.  Having the source code out there is basically laying all the cards on the table, and in security stuff, that is not always a good thing.  But in all honesty, most people aren't exactly protecting anything that someone would want to go to the trouble of stealing unless it was easy... which would be people who are sloppy and use the same passwords on everything, or a pass like 12345.  I like Lastpass, but I am not exactly Sony Online or anything... so it works great for me; (and most people as I said).  Its not worth debating what program to use more important that people realize that these programs make life easier and safer.  And it's free.  Just like anything else, people will have their personal preference... thats why there are so many kinds of cherry mx switches! heh

[mashby]

I use 1Password with multiple vaults and can't recommend it enough. It's not free, but it works brilliantly through my multiple Macs and mobile devices. For work, we use  PassPack and have been very happy with it as well. We're able to get by with the free version.

[Zapheo]

Thanks!

I will definitely check this out. 

[RedRoboHood]

I understand what you are trying to say, but sometimes open source is a double-edged sword.  Open source means anyone can look at the program used to encrypt passwords before it is even compiled.  So holes can in some cases be found a little easier than trying to reverse-engineer a proprietary code.  Having the source code out there is basically laying all the cards on the table, and in security stuff, that is not always a good thing.

I disagree. Think of it this way: having the software open source makes it easier/faster for someone to come along and exploit a bug, but it also makes it easier/faster for someone else to come along and fix the same bug.

Let's say there's a bug in an encryption implementation in an open source project. Some malicious hacker finds and begins exploiting the bug 1 month after it is created. Another person finds and fixes the bug 2 months after it is created. For 1 month, at least one person has been exploiting the bug.

Now consider a closed source project with the same bug. A malicious hacker finds and begins exploiting the bug 1 year after it is created. One of the people who is allowed to view the source code finds and fixes the bug 2 years after it is created. In total, the bug has been exploited for 1 year by at least one person.

Obviously, these examples are extremely contrived, but the concepts still apply. In fact, the closed source case will probably be even more exaggerated, because there is a limit on the number of people who are potentially trying to fix bugs, but there is not a limit on the number of people who are potentially trying to exploit bugs.

[whizzard]

It can go either way.  I personally would rather try to exploit something that I have a blueprint of,  and I know the web is run on open source software for the most part (linux).. and it is constantly being hacked and updated.  Seems like hackers like targeting open source quite a bit or just as much as proprietary.  And I don't really hear of proprietary stuff going down (google, amazon for instance)...  but I am sure it happens. 

I like open source for EVERYTHING but when it comes to security I can push the other way knowing a group of peoples livelihood relies on them not screwing up.

Open source is OPEN and that word alone pushes me to private software in regards to security.  I would use keypass regardless but I just have a preference like anyone else and I don't blame anyone for using an open source solution.

Lastpass is my preference, and it is just as free as open source stuff, plus I think it is more useful than most open source stuff out there and I liked it... so I shared it..  thats all. 

I used keypass years ago, but abandoned it because it was just one more app running in the notification tray, winking at me, and didn't seem to make a big difference timewise.   Don't know if it is still like that but I just was really happy when someone invited me to Lastpass.  I was just being lazy but when someone from Iran logs into your email you wake up.   Rambling over

[RedRoboHood]

Fair enough. Like you said, it can go either way. I really like LastPass myself, but everyone has their own "best" option. I'm glad you created this thread, because just using some sort of password manager is a really good thing in general.

[whizzard]

I was just impressed because with Lastpass, once you set it up.. it is a lazy security person's dream.  It is auto-fill on speed and even thinks up passwords for you.  I never have to sit there typing a password every time I log into a site after closing my browser.  Thats why I really liked it, and hope people try it because I know if they are at all like me, they will find it super handy.  Its not so much that I am being dilligent, I was kinda forced to take security seriously and ended up having something that keeps me from being an easy target PLUS be lazy! haha

[whentheclouds]

i used Lastpass for a long time as a FF addon, but the upgrade to 3.xx made it so much more prone to memory leaks. it got pretty bad at one point and downgrading didn't fix the issue, so i replaced it with Keepass as a standalone program and use Keefox extension to sync it automatically with Firefox. the autofill function doesn't work as smoothly as Lastpass but i'm happy with it

also please check your PMs whizzard 

[abenntt]

http://fieldnotesbrand.com/

[TacticalCoder]

A master password, on a connected device, able to generate/reproduce/remember every single of your passwords?

What could possibly go wrong?

[whizzard]

A master password, on a connected device, able to generate/reproduce/remember every single of your passwords?

What could possibly go wrong?

Someone could go through a S-load of trouble to hack a difficult system just to steal my password after somehow divulging my Lastpass username and master password of 20 random characters..  along with hacking my two factor authentication.. or they could phish and get hundreds off people who just use the same one on every site they ever visit.  I am truly that important. 

This was a heads up and offer telling people there is an simple and free way to avoid being an easy target that also saves time and hassle.  I don't see why people think hackers go for a tough mark when there is a sea of rubes out there. 

I didn't realize nobody wants help, ideas or suggestions here.  Now I know, so I will never do it again... hint taken.  This thread is just annoying the piss out of me now.  /unwatch

[mashby]

I think talking about security is always good, so I'm glad you posted the thread.

Security is a balancing act with convenience, but I think there are some really good options out there in the market place. Everyone has their preference, but I'd rather debate my choice to see if someone can convince me otherwise if for no other reason than to confirm that I've made what I believe to be the right choice.

To lighten things up a bit, has everyone see this comic about password strength?

[uzoc]

Does anyone else have trouble trusting these companies?  Imagine if they were compromised... law enforcement agencies or cyber criminals, I don't know which would be worse

Yes, that's why you should use KeePass. Checkout all the plugins, also. Printing the passwords (very small fonts) is great, also.

[davkol]

Hello, three-letter-agency shill. Your "arguments" about the "downsides" of freedom in terms of security are laughable. There are countless examples why. You can start with InterBase.

[whizzard]

Hello, three-letter-agency shill. Your "arguments" about the "downsides" of freedom in terms of security are laughable. There are countless examples why. You can start with InterBase.

Just couldn't help myself, had to check responses again.

This is gonna be hard to say, but I am gonna come out with it.  I have been caught.  I was hired by the CIA in a joint operation with the DoD and FBI to sign up on different nerdy message boards and try to get people to hate open source software.  Our plan to take over the world hinged on it.  I know I didn't mention it in my original post, but I knew it would come up.  davkLOL must have somehow found out about "Operation Nerdout".
-end sarcasm

For F*$# sake get over yourself dav.

Excuse me for finding a program I like and trying to tell others about it.  Heres an idea.. uninstall windows and every other thing on your computer that spys on you because it is not open source.  Who needs a password app when they have spyware built into your ram and OS.  Get over yourself nobody cares about the tranny porn you whack to.

After seeing how things go on this board when people don't like your opinion I am gonna probably stop posting regularly.  I will come here to grab a key or a group buy but just being friendly with some of you and trying to contribute to the community and learn is not worth the headache and douche-chills.  Most on the board have been more than nice and helpful... but the internets sh*# side is here too, with a nice share of elitist trollish know-it-alls.  And with people like davkol, posting 3000 or more times, I cant handle reading elitist big headed horse$##* that many times.

All of you normal folks, this doesn't apply to you.... all you elitist trolls who think you got it all figured out... go outside there is a whole world out there to be a dweeby douchebag to.

/REwatch
 

[davkol]

Recommended reading:

https://www.schneier.com/blog/archives/2013/09/how_to_remain_s.html
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565
http://en.wikipedia.org/wiki/Nothing_to_Hide:_The_False_Tradeoff_Between_Privacy_and_Security

[whizzard]

dav, I don't care.  I don't think I am important enough to need to do more than just be safe and not make myself an easy target.  That was the main point of me posting this.  TRYING TO HELP AND MAKE SUGGESTIONS.  If you read the whole thread you would see that.  Calling me a shill pisses me off.  Nobody cares.  And I stand by what I said.  GET OVER YOURSELF.

[davkol]

That's why you should read at least the essay.

Besides, I like offending people. People, who get offended, should be offended.
-- Linus Torvalds

[whizzard]

That's why you should read at least the essay.

Besides, I like offending people. People, who get offended, should be offended.
-- Linus Torvalds

Thanks for making my point for me.  You are a jerk, and like being a jerk.  I appreciate you clarifying that for everyone.

[davkol]

Good riddance.

[whizzard]

reccomended reading: http://www.urbandictionary.com/define.php?term=troll

your not rid of me.  I just like weeding out the trolls so I know who to ignore.  Hopefully others see you admitted you are a troll.

[SL89]

Whizzard, Davkol has a valid point. I work in IT and agree with him a bit. We just had a whole office get compromised from abuse of LastPass and what it does. LassPass is great, but it can be insecure. I think you should be a bit more tolerant to anyone who disagrees. Discourse is a natural part of discussion. That being said I'm personally looking into getting a lastpass account with a yubikey, but i am very uncertain about trusting a for profit company to store my passwords on their servers.

[uzoc]

Recommended reading:

https://www.schneier.com/blog/archives/2013/09/how_to_remain_s.html
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565
http://en.wikipedia.org/wiki/Nothing_to_Hide:_The_False_Tradeoff_Between_Privacy_and_Security

KeePass = http://keepass.info/
Only you are able to see your ID's and passwords.
Multiple platforms and always secure (only you have access to it).

[whizzard]

There is disagreeing and there is being a jerk.. he calls me a shill because I have my own opinion.  KeePass and any other damn app like it IS NOT FOOLPROOF and nothing is.

There are people who have ideas and create things.  Good ideas and bad ideas come from the same genesis.  There are people who create things (good or bad) and there are people who just criticize others trying to feed their own ego and never contribute a thing.  Dav calls me a shill when I was not rude, because he didn't agree with me.  That is a little out of line and I am going to stand up for myself.

He is a jerk and a troll, he basically said he likes offending people.

And to be honest, I dont really give a flying crap what anyone uses... I SAID THAT MULTIPLE TIMES.  I just said people should use some type of security to avoid being an easy target.  How many times must I repeat that?  Screw Lastpass and every other application in the world, I don't care.  I don't care how much people think they know about computers because I don't measure people by thier e-****.  I measure people by the way they treat others, especially strangers.  Its called being a decent person.

Calling people names and criticizing people who are trying to help or make suggestions is a great way to stop them from ever trying.  Resulting in a crappier community for us all.  Is that what you want?

[SL89]

Dude, get off your soapbox. I agree with you on most of that, but the way your going about it makes it hard to take you seriously.

[whizzard]

Take me as serious as you want, I stand by what I said.  Basically I read what you just posted as.. I agree, but shut up.  For someone who is all about "discourse" that is a funny thing to say.  Makes it difficult for me to take you very seriously.

[SL89]

If you are going to make assumptions about what i said instead of considering my actual words then you missed my point.

To be explicit, what i was saying was:

I agree, but the way you conducted yourself was (in my opinion) lacking manners.

I suggest you just end this. I'm sorry if i added to any sort of grief, that was not my intent. Do with that what you will.

[whizzard]

I am not griefed, I just defend myself when I am called a name.  It is difficult to tell someones emotional state through words on a screen.  If you go through the thread you will see that out of nowhere he calls me a shill.  Just because he has been here longer than me and has 3000 posts doesn't give him the right to crap on me.  I don't like being called a name and I don't think anyone else does.  So I let him know how I felt about that.

Dav was lacking manners.  Period.

[SL89]

Whizzard, I'm not sure what you want me to say to any of that. This thread has gone vastly off topic and I have no intention of keeping it going. Best of luck to you.

[whizzard]

This will put an end to it, I don't like negativity going on and on.. and I certainly dont want u to think I am trying to pick on you SL.  This will sum up the thread for everyone:

I posted an application that I found useful enough to tell others.


It devolved into an argument about open source or private security solutions.  I made an argument that wasn't popular, but I did it anyhow.

I got frustrated that my main point was lost, that SOMETHING is better than NOTHING no matter what program people use, and that I dont care what people use in the end, as long as they protect themselves.

Dav calls me a schill for a "three letter organization"

I got pissed and told him off... even though he is an "old timer" here, because I thought it was out of line.  I am not upset with anyone or anything else.

Its over now.

OK.. back on topic now.

[MrRooks]

I much prefer using keepass. I really don't like the idea of someone else storing my passwords on their site like LastPass. I also don't trust dropbox so I host my own cloud storage and I keep my keepass on that.