Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why not!? So they mess up. I figure all the other password managers either have similar issues and either weren't disclosed, or fixed before the issue was publicly found. No software is bug free.

While they have issues -- at least this is an issue I know that's been addressed.



That's fallacious logic.

"This password manager is bad, so all the others must be just as bad"... yeah.

Other password managers, like 1Password, are more frequently recommended by security engineers.

They're also not built entirely as browser extensions and interfaces, which massively increases attack surface.

Maybe the reason other password managers aren't tire-fires is because they're designed better and are more secure, not because they have more unknown issues.


There are tradeoffs to all software.

I use lastpass with a yubikey for 2fa and I feel safe enough. I briefly looked at other password managers when I was evaluating lastpass, but convenience won out for me. I haven't looked at moving out of lastpass, but 3 years ago no other password manager came close to the mobile and platform support that lastpass had.

I considered keeping my passwordDB local, but the inconvenience of needing it and not having it wasn't it worth it to me. Do I know I'm making a tradeoff? Yes.

I also have a nasty habit of setting things up on a local server and then never updating it. Instead I decided that lastpass was worth the $12/year so I wouldn't have to manage anything locally.

So while lastpass may not be perfect security, I'm a lot better off than I was three years ago when I used the same few passwords everywhere.

It also helps me share passwords with my wife, so that's nice.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: