Comment by illumin8 | Hacker News Reader

Comment by illumin8 | Hacker News Reader

Parent Full thread

The MtGox breach inspired me to switch to LastPass. I used to do what you did, and MtGox was part of my "medium security" tier.

Now, I've decided that there is no real effective solution other than randomly generated passwords unique to each site.

I also turned on 2-factor auth for Gmail a couple months ago - their SMS system is really effective.

I do have to credit Google for being extremely awesome when it comes to security... They noticed a few "your password has been changed" emails incoming to my inbox yesterday and immediately put a security flag on my account, requiring me to re-auth with 2-factor and change my password. Google is really proactive when it comes to security. The fact that they can recognize a high number of password change emails arriving as an indicator of possibly account hijacking is just amazing.

I think LastPass is probably as good of a solution as any. They only store your encrypted password database in the cloud. With a strong enough master password and optional 2-factor authentication with Yubikey, it seems quite secure.

My reason for not using LastPass is because it is proprietary. In fact, there has been an XSS attack on them in the past which was somewhat successful. I use KeePassX because it allows me to avoid laying trust on any proprietary entity. At present if LastPass were to have another security flaw (and hey, security flaws on web-facing servers are all too common) you'd be out of luck. With KeePassX security is local. The worst case for me is someone stealing my database and trying to bruteforce the password (hah, like that'll happen). This requires them to have physical access to my computer. Anyone can take a guess at your password because it's a web based service.

KeePassX is still vulnerable to a keylogger on your local machine.

LastPass with 2-factor auth should be more secure than KeePassX, however, your point about it being proprietary is well taken.

I also think LastPass has a very good reputation for full disclosure - when the salted hashes of master passwords were compromised in 2010 it was very refreshing to see the CEO come forward and give immediate full disclosure to the public about the implications, and why you should change your master password.

I also find it refreshing that if you have a strong master password, even someone compromising their entire database should not give you reason to worry - it would be similar to someone getting a copy of your KeePassX database - it's still encrypted with high-grade encryption.

_The fact that they can recognize a high number of password change emails arriving as an indicator_

They do not. Mt. Gox contacted google and gave them all the gmail accounts that were leaked.

Reply on news.ycombinator.com