Password Manager

[Night]

Ispod su dva linka sa jednom i drugom stranom priče, ali LastPass je u zadnje vrijeme jako sumnjiv servis i bilo bi ga pametno napustiti dok se još može bez većih problema.
Isto vrijedi i za Authy i sve ostale servise koji ne nude export podataka, seedova i svega ostalog potrebnog za korištenje drugog servisa.


https://alternativeto.net/news/2022/...pricing-plans/
https://unitednewspost.com/news/tech...words-hostage/

[The Exiled]

LastPass developer systems hacked to steal source code

Password management firm LastPass was hacked two weeks ago, allowing threat actors to steal the company's source code and proprietary technical information. The disclosure comes after BleepingComputer learned of the breach from insiders last week and reached out to the company on August 21st without receiving a response. Sources told BleepingComputer that employees were scrambling to contain the attack after LastPass was breached. After requests for information, LastPass released a security advisory today confirming that the company was breached through a compromised developer account that was used to access the company's developer environment.

While LastPass says there is no evidence that customer data or encrypted password vaults were compromised, the threat actors did steal portions of their source code and "proprietary LastPass technical information." LastPass has not provided further details regarding the attack, how the threat actors compromised the developer account, and what source code was stolen. LastPass is one of the largest password management companies in the world, claiming to be used by over 33 million people and 100,000 businesses. As consumers and businesses use the company's software to store their passwords securely, there are always concerns that if the company was hacked it could allow threat actors access to stored passwords.

However, LastPass stores passwords in 'encrypted vaults' that can only be decrypted using a customer's master password, which LastPass says was not compromised in this cyberattack. Last year, LastPass suffered a credential stuffing attack that allowed threat actors to confirm a user's master password. It was also revealed that LastPass master passwords were stolen by threat actors distributing the RedLine password-stealing malware. Due to this, it is vital to enable multi-factor authentication on your LastPass accounts so that threat actors won't be able to access your account even if your password is compromised.

Izvor: BleepingComputer

[SPLiFF]

Evo jedne dobre alternative, SafeInCloud koristim 8 godina, bazu držim na svom cloudu, desktop app je free a iOS se plaća jednokratno, lijepo izgleda, ekstenzije rade dobro i ima jako puno mogućnosti personalizacije unosa poput KeePass-a.

Inače paralelno koristim i Dashlane ali samo zato što nisam bio svjestan da SafeInCloud ima 2FA + ne plaćam ga (uvalio se u family).

[Night]

Autor The Exiled

LastPass developer systems hacked to steal source code

Izvor: BleepingComputer

Fino, sad ćemo znati koliko je siguran kad netko temeljito analizira taj kod. Ako je sve pravilno dizajnirano i implementirano onda curenje koda ne bi trebalo imati nikakav utjecaj na sigurnost korisničkih podataka. Ali ako nije ...

[The Exiled]

Nastavak priče dodatno potvrđuje da LastPass i sigurnost nemaju veze s vezom.

Lastpass says hackers accessed customer data in new breach

Izvor: Bleeping Computer

[prileee]

Ako (uopce) postoji jos netko tko nije migrira na bitwarden ili neku drugu opciju - vrime je.

[Libertus]

Imate Mozilla Sync tj. Firefox Sync.
Vaše lozinke kriptirane vašom glavnom lozinkom. Mana, ako ju zaboravite, bye bye lozinke.

[The Exiled]

Da, u ovom trenutku sve je bolje od LastPass i sl. pizdarija. Firefox Sync sam složil mami za njezine sitnice, a glavna lozinka je još dodatno spremljena u KeePass.

[Neo-ST]

Najbolja alternativa Lastpass-u ?

[vlatko27]

Bitwarden. Ili Keepass ako hoćeš malo više DIY.

[Neo-ST]

Autor vlatko27

Bitwarden. Ili Keepass ako hoćeš malo više DIY.

Po čemu je npr. Bitwarden bolji od Lastpass? Oboje koriste istu metodu enkripcije koliko vidim, zero-knowledge.