Hacker News Reader

Comment by colechristensen | Hacker News Reader

I was under the impression that basically lastpass knew your password, 1password does not. Lastpass owned the whole key. With enterprise organizations though we can still reset a users password if they forget so 1password might “know” your password too. Maybe older versions or individual versions are more secure.

View on HN

It would probably be more accurate to say that LastPass has the information to decrypt your vault if they can guess your password. By contrast 1Password would need to both guess your password and guess your personal secret key. The latter is effectively impossible assuming the key generation was well-implemented. The trade-off is that users must keep track of their own secret keys.

What if in lastpass you have 2FA?

2FA has nothing to do with the encryption, if that data is leaked.

My understanding is some of the key strength was to low. If 2FA increases the key strength, that should have an impact no?

2FA does not increase the key strength. The key is solely derived from the password. 2FA limits access to somebody who already has the password to get in. The LastPass leak was of a backup, though, for which 2FA does nothing.

I see, that's unfortunate.

How does that work with sharing vaults between devices?

You have to provide the secret key to each device on initial setup. After that, you just need your password.

What if you're in a foreign location and your devices are all stolen or lost?

You'd have to contact someone to get the secret key from your 1Pass emergency kit, wherever you stored it. That is, unless you can memorize long strings of numbers really well.

Then you have a much bigger and immediate problem at hand.

Not really. The biggest, most immediate and most threatening problem in this scenario, is inability to access your passwords, and therefore inability to use banking and means of electronics communication.

What do you mean?

There's a tourist experiencing this scenario probably every minute.

This is why 1Password provides an emergency kit where you can record your secret key and store it securely.

How you choose to safeguard it depends on your preferences and your "threat level".

For example, you can keep it in a bank vault or print multiple copies to store it under your pillow, taking a picture, or save it in your email, etc.

Reply on news.ycombinator.com