<story><title>LastPass Security Notice</title><url>https://blog.lastpass.com/2015/06/lastpass-security-notice.html/</url></story><parent_chain><item><author>pdabbadabba</author><text>But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting &lt;i&gt;numerous&lt;/i&gt; third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1&amp;#x2F;3rd, etc.) is compromised along with it.&lt;p&gt;I agree with you that an offline password manager is better in theory. But the problem is that I am aware of no such service that is easy to use across numerous devices, so much so that none has struck me as a viable option given my patterns of usage. Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud-based service. But, for me, the inconvenience is simply too much.&lt;p&gt;So the choice once more, for me, becomes cloud-based password manager or no password manager at all.&lt;p&gt;(Though if you&amp;#x27;ve found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?)</text></item><item><author>jjarmoc</author><text>While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk.&lt;p&gt;If you don&amp;#x27;t use a password manager, you&amp;#x27;ve got 99 problems, but a centralized store of your credentials for everything that&amp;#x27;s a huge target by virtue of having thousands of similarly centralized users ain&amp;#x27;t one.&lt;p&gt;Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which you have no control seems inherently risky.  Lastpass is a huge target, and while I believe they generally take reasonable security measures, for many the risk of compromise may be greater than an encrypted stand-alone password database.  Use a password manager, please, but keep it offline and don&amp;#x27;t aggregate it with loads of other people&amp;#x27;s databases.&lt;p&gt;This is one area where I feel strongly that the conveniences of &amp;#x27;Cloud&amp;#x27; are outweighed by the risks.</text></item></parent_chain><comment><author>tbabb</author><text>My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify&amp;#x2F;salt in a way that&amp;#x27;s predictable (to me) across sites, such that each site&amp;#x27;s credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it&amp;#x27;s simple enough to remember. I don&amp;#x27;t use any password manager, because like OP, that seems like too much of an eggs-and-baskets risk for my taste.&lt;p&gt;A catastrophic compromise would require an attacker to see actual credentials (not just the hashes) across many sites, and on top of that reverse engineer my specific permutation scheme. This seems much less likely to me than a very public, high-profile centralized cloud service forgetting to cross a T somewhere and getting hacked.</text></comment>
<story><title>LastPass Security Notice</title><url>https://blog.lastpass.com/2015/06/lastpass-security-notice.html/</url></story><parent_chain><item><author>pdabbadabba</author><text>But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting &lt;i&gt;numerous&lt;/i&gt; third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1&amp;#x2F;3rd, etc.) is compromised along with it.&lt;p&gt;I agree with you that an offline password manager is better in theory. But the problem is that I am aware of no such service that is easy to use across numerous devices, so much so that none has struck me as a viable option given my patterns of usage. Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud-based service. But, for me, the inconvenience is simply too much.&lt;p&gt;So the choice once more, for me, becomes cloud-based password manager or no password manager at all.&lt;p&gt;(Though if you&amp;#x27;ve found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?)</text></item><item><author>jjarmoc</author><text>While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk.&lt;p&gt;If you don&amp;#x27;t use a password manager, you&amp;#x27;ve got 99 problems, but a centralized store of your credentials for everything that&amp;#x27;s a huge target by virtue of having thousands of similarly centralized users ain&amp;#x27;t one.&lt;p&gt;Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which you have no control seems inherently risky.  Lastpass is a huge target, and while I believe they generally take reasonable security measures, for many the risk of compromise may be greater than an encrypted stand-alone password database.  Use a password manager, please, but keep it offline and don&amp;#x27;t aggregate it with loads of other people&amp;#x27;s databases.&lt;p&gt;This is one area where I feel strongly that the conveniences of &amp;#x27;Cloud&amp;#x27; are outweighed by the risks.</text></item></parent_chain><comment><author>JadeNB</author><text>&amp;gt; (Though if you&amp;#x27;ve found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?)&lt;p&gt;I don&amp;#x27;t know if it meets but your needs, but I love PasswordMaker (&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;passwordmaker.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;passwordmaker.org&lt;/a&gt;).  There is no need for sync&amp;#x27;ing, because the password is &lt;i&gt;generated&lt;/i&gt; from a master password and configureable per-site data (by default, the web-site address; but you can add more data sources if you don&amp;#x27;t like that).  It has an extension for Firefox that auto-completes passwords (configureably, remembering the master password per session so that you don&amp;#x27;t ever have to type it); there are widgets for Windows and Mac OS; there are Android and iOS apps; and, always, there is the fallback web page, which you can use anywhere that you have a web browser.&lt;p&gt;EDIT:  Since I am trying to indulge in quite a bit of advocacy here, I want to make it clear that I am in no way affiliated with the project.  I just stumbled on it a long time ago, and have been delighted with the way that it fills my needs.</text></comment>