<story><title>The situation at LastPass may be worse than they are letting on</title><url>https://twitter.com/cryptopathic/status/1606416137771782151</url></story><parent_chain><item><author>sacnoradhq</author><text>Bitwarden, Keeper ($ but trusted at megacorps), and good ol&amp;#x27; PasswordSafe are the safest solutions.&lt;p&gt;I run BW with Yubikey 2FA and a local hosted sync server.&lt;p&gt;KeePassX&amp;#x2F;C perhaps. Vault for secrets management.&lt;p&gt;Never touched LastPass, 1Password or any of these other mickey-mouse commercial apps that invariably claim &amp;quot;military-grade encryption&amp;quot; or &amp;quot;unhackable&amp;quot; when their fundamental constructions are crap.</text></item><item><author>ddejohn</author><text>For anybody else left wondering, Bitwarden &lt;i&gt;does&lt;/i&gt; encrypt (nearly) everything in your vault:&lt;p&gt;&amp;gt; At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1]&lt;p&gt;I haven&amp;#x27;t used LastPass in years, but the recent news made me wonder how Bitwarden was handling URLs.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bitwarden.com&amp;#x2F;resources&amp;#x2F;zero-knowledge-encryption-white-paper&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bitwarden.com&amp;#x2F;resources&amp;#x2F;zero-knowledge-encryption-wh...&lt;/a&gt;</text></item></parent_chain><comment><author>bee_rider</author><text>I see a lot of people mentioning bitwarden around here; is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?).&lt;p&gt;There’s very little room for failure and learning in the online password safe field, so I generally assume these companies are in one of two states:&lt;p&gt;* has unknown bugs waiting to be revealed&lt;p&gt;* out of business</text></comment>
<story><title>The situation at LastPass may be worse than they are letting on</title><url>https://twitter.com/cryptopathic/status/1606416137771782151</url></story><parent_chain><item><author>sacnoradhq</author><text>Bitwarden, Keeper ($ but trusted at megacorps), and good ol&amp;#x27; PasswordSafe are the safest solutions.&lt;p&gt;I run BW with Yubikey 2FA and a local hosted sync server.&lt;p&gt;KeePassX&amp;#x2F;C perhaps. Vault for secrets management.&lt;p&gt;Never touched LastPass, 1Password or any of these other mickey-mouse commercial apps that invariably claim &amp;quot;military-grade encryption&amp;quot; or &amp;quot;unhackable&amp;quot; when their fundamental constructions are crap.</text></item><item><author>ddejohn</author><text>For anybody else left wondering, Bitwarden &lt;i&gt;does&lt;/i&gt; encrypt (nearly) everything in your vault:&lt;p&gt;&amp;gt; At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1]&lt;p&gt;I haven&amp;#x27;t used LastPass in years, but the recent news made me wonder how Bitwarden was handling URLs.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bitwarden.com&amp;#x2F;resources&amp;#x2F;zero-knowledge-encryption-white-paper&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bitwarden.com&amp;#x2F;resources&amp;#x2F;zero-knowledge-encryption-wh...&lt;/a&gt;</text></item></parent_chain><comment><author>int_19h</author><text>When it comes to password management, trust should not even be a thing.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.lesspass.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.lesspass.com&amp;#x2F;&lt;/a&gt;</text></comment>