Hacker News Reader

Comment by arjie | Hacker News Reader

I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so.

It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.

View on HN

That's not an apt comparison.

Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass.

The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews.

1password has more recommendations by security engineers, and has been reviewed in significant depth.

Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.

Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.

I like the idea that you are just walking around asking security engineers for password managers

That comment is not wrong.

1password has changed recently. Are security experts recommending their newer cloud subscription service or the older version that stored the vault on Dropbox or another storage service (or both)?

How do you tell that LastPass has been vetted better than the alternatives? "Experts looked at X and found no major issues" normally doesn't get very much attention, and potentially isn't published at all, or just reflected in recommendations.

(some of it is of course also depends on the threat-model: something with no (or with more caveats, an explicitly activated browser integration) is way less likely to be vulnerable against attacks launched from a website, reviewed or not)

I do not know this. If you're informed, I would appreciate your advice.

Reply on news.ycombinator.com