this post was submitted on 06 Sep 2023
116 points (99.2% liked)

Technology

60076 readers
4079 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
 

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious…

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 6 points 1 year ago (1 children)

it's a bad idea to have all your passwords centralized but for me it's still an upgrade in security compared to remembering a few different passwords. I understand security is very important but I want to be able to appreciate convenience and not have to write all my random passwords on a book that I would have to bring with me all the time and look at every time I want to type a password. there's no such thing as bulletproof security. I'm quite happy to have reduced my attack vectors to nearly one single point so I can focus on defending that one single point.

[–] [email protected] 2 points 1 year ago

Password vaults are great! Giving them to a central authority is... a little risky though. LP has a pretty decent history other than this, so I don't fault anyone for using them. But after that breach, it's probably good to consider those creds burned and recycle them.

A good self-hosted alternative might be something like Keepass on Syncthing. Though a downside of that is that you might be even less likely to know of a vault exfil than a service like LP.

Either way you go, it's good to recognize the limiations and act accordingly.