LastPass Got Hacked, Time to Switch to KeePass

In this video I discuss the recent security incident where LastPass got hacked and had their proprietary source code and company information stolen, I also discuss a better, safer alternative to LastPass called KeepassXC which gives you control over your passwords as well as how you can sync your keepass database with syncthing.
LastPass blog post
blog.lastpass....
₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿
Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436
Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV
Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079
Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF
Dash
Xh9PXPEy5RoLJgFDGYCDjrbXdjshMaYerz
Zcash
t1aWtU5SBpxuUWBSwDKy4gTkT2T1ZwtFvrr
Chainlink
0x0f7f21D267d2C9dbae17fd8c20012eFEA3678F14
Bitcoin Cash
qz2st00dtu9e79zrq5wshsgaxsjw299n7c69th8ryp
Etherum Classic
0xeA641e59913960f578ad39A6B4d02051A5556BfC
USD Coin
0x0B045f743A693b225630862a3464B52fefE79FdB
Subscribe to my KZbin channel goo.gl/9U10Wz
and be sure to click that notification bell so you know when new videos are released.

[@wiger_]

> removes all features > becomes paid > gets hacked > refuses to elaborate > dies

[@bloozism]

gigachad energy

[@TheCatVtuber]

@@bloozism *gigavirgin and go broke energy

[@CulturedThugPoster]

One password to rule them all .. what could possibly go wrong ?

[@niklas8565]

@@CulturedThugPoster in this case it is safer to use one password. It has to be secure (long and many types of characters) but it decreases the attack vector since you use a different password for any other site. If any other website gets hacked only the data of the one website gets leaked.

[@CulturedThugPoster]

@@niklas8565 Unless you have a court order or some other big stick to threaten the CEO with.

[@NotThatUser]

It’s almost as if having your personal log in information stored by some big company is a risky thing to do!

[@northpoint1039]

What the heck, I mean everyone likes putting their personal stuff on the cloud anyways right? :)

[@eliarossini5037]

I would love not to give my credentials to this companies, but I don't really have the time to install KeePass to all my PCs rip. Is there another way to have passwords throughout all my devices (genuine question, really)?

[@component9008]

@@eliarossini5037 yeah, bitwarden is free and open source, and along with being able to self host, you can use their servers, but as opposed to last pass you know what they’re doing with your data

[@justadude8716]

like ur pfp

[@aerialdarkguy]

@@component9008 I like Bitwarden but we do have be frank that that still requires trust. Even open source and well audited it is not immune to data breaches (however limited) and trust that server configurations/infrastructure are setup properly.

[@bigsyrup8567]

>The virgin password manager >The chad “write my shit down in a book and store it somewhere safe” Ayy lmao

[@savag]

4channers in a nutshell:

[@IlIllIIlllIIIIIIlllIll]

@@savag 4who ??

[@aihamkadiri4992]

u can leave it on ur disk without context and noone's gonna know what it is or where to even use it

[@stevejones69420]

@@aihamkadiri4992 good ol' note.txt

[@tdgchan]

My fucking head is the book and theres nowhere safe form the fog.

[@ComradeRachel]

The reason why Keepass is good is because you handle the database file yourself and what type of security you use on it. Rather then trusting that LastPass cloud or another companies cloud.

[@NotEvenDeathCanSaveU]

Yeah, great thing is that it can be, or I think by the default it is, mostly offline. No one will be able to get to your db unless they get it from your computer directly. The software I trust the most is the one that doesnt need to connect to the internet.

[@hubertmikua8787]

@@ioneocla6577 "hosted" is problematic part, imho none of it should be running when You don't need it

[@hgbugalou]

That can also be a weakness for none technically people.

[@ioneocla6577]

@@hubertmikua8787 you can use cloud hosting but you Can also Host it on you server for free

[@LedoCool1]

@@hgbugalou this sounds to me as "I spend a grand on this car why I even have to learn to drive it?"

[@ndl5783]

I keep all my passwords in my head, Security gets better with age. Once the dementia update kicks in, Even i won't be able to get my passwords lol.

[@kaiduwu]

This guy has the strats

[@gasun1274]

lmao i just realized that i dont remember my bank account password, only my two thumb muscles know it

[@kaiduwu]

@@gasun1274 I don't know my phone password, I just know where to press on the mobile keyboard to get the result of my password (I use an alphanumeric password and offset the letters of it in a mostly random direction on the keyboard)

[@youremom5463]

@@gasun1274 me with the helicopter cheat code in gta5

[@luszczi]

That's the beauty of offline password managers. Before you even begin to hack one, you very likely need to get through some password authentication first.

[@r4lfxd]

But the whole point of these managers was to have them in a place that can't burn down and can be with you at all times.

[@TarlukLegion]

@@r4lfxd Yeah, exactly. I'd rather put a bit of trust into a cloud company than risk all my passwords being lost because of a reformatting, hard drive bricking, or other unforeseen disaster, or having to do the entire process all over again for my laptop, phone, etc.

[@Brancliff]

The virgin freemium cloud vs. the chad self-hosted lad

[@--i-am-root]

@@TwizzElishus and keep the paper in your boxsprings.

[@holymegadave]

@@TwizzElishus chad high capacity image memory. Got premature Alzheimer.. lost all his passwords..

[@yeahgirl11]

Hey man, nothing wrong with being a virgin. Virgins were the ones who founded the basis of science and technology today. That's pretty Chad if you ask me.

[@SunIsLost]

Yes.

[@dexwrex7594]

@@TwizzElishus 100% hackers blocker

[@8bitsloth]

Ah yes, the company that thought they could make money by starting to charge their users for using a simple password manager. I'm shocked they had any users left.

[@DrewryPope]

people who never switched / barely used it && businesses who's execs got them buried in relying on their ACLs

[@DirtyChungus]

I hated that change, requiring me to pay for "Premium". They also lock off their "advanced" security checks for your account behind it. It's a very obvious money grab

[@xeon39688]

@@DrewryPope I switched to Bitwarden

[@jayarmstrong]

Shocking concept: professional developers charging for their services

[@xeon39688]

@@jayarmstrong yes but when they were free , premium still existed

[@logicalfundy]

Looking at the incidents where master passwords were allegedly stolen - it appears to be either credential stuffing (using passwords from other hacked websites), or something client-side to try to nab the password before it's encrypted (usually a vulnerability in a browser plugin). Should be noted that things like keyloggers can nab passwords from both cloud and local password managers - so a huge part of your own security is ensuring your own systems aren't compromised. In the case of the incident reported by BleepingComputer in 2021, there was apparently a bug in a system LastPass was developing to warn of possible credential stuffing.

[@dealloc]

While that's true, the chance of you getting a keylogger on your computer, compared to some rogue browser plugin or even some malicious link in a phishing attack is less likely. Unless you of course download every Excel file with macros and execute them. Then you're an outlier in the statistic.

[@mynamesnotimportant6941]

good thing to point out

[@CasualTS]

Yeah I was concerned too, like if Lastpass had let hackers breach master passwords I think I would've heard about it! That wikipedia entry is "technically true" that users were notified their master password was compromised, but in the end it was an overzealous security notification system to blame for the warnings.

[@deang5622]

@@CasualTS Because once the hackers have got a copy of your LastPass vault, it can't be hacked right?

[@CasualTS]

@@deang5622 Err, the vault contains all of your website passwords. The master password is used to gain access to the vault. If a hacker has your vault, then they've already got all your passwords.

[@jsan2548]

I deal with LastPass/LogMeIn’s support staff on a regular basis and can attest that if LastPass says everything is fine, everything is most assuredly as far the fuck away from fine as possible.

[@terminalvelocity4858]

Also worth a mention, KeyPassXC has a browser integration addon by the developer too so you wont even have to copy/paste passwords if you don't want.

[@dannydogs4385]

Be careful using that though. Sometimes scripts can steal that information if they know where to look for the auto filled username and password. They generally don’t recommend using this because of the security risk that comes with it. There are slightly better integrations of this that doesn’t just put in the username and password the moment you are on the website but instead waits until your input, but still a risky thing to do nonetheless.

[@terminalvelocity4858]

@@dannydogs4385 For sure. Security first, but a nice option for those of us who want to do that instead of copy>past user/pass every time.

[@terminalvelocity4858]

@@HQbaracuda Interesting! Would you mind elaborating a bit? I'm on Arch Linux so this would be something to look into. Thanks! :)

[@ChiefMasterGuru]

@@dannydogs4385 You can simply make it so it doesn't autofill unless its the correct domain name (also the version I use doesn't fill it automatically, you have to press a button beside the user/pass)

[@jamesedwards3923]

Brower Addons. I am aprehensive about those. I gladly copy and past almost all my passwords. It is a chore, but works.

[@deadcrypt]

We need an alternative software list video. First RustDesk, I2P and now KeePass. It would be helpful to have all these in 1 video so viewers can make decentralized choices first, rather then as they watch more and more videos👍

[@geeshta]

I use Bitwarden but I might have switch to self hosted

[@thebeatconnect1]

Vaultwarden self hosted and don't expose it to the internet.

[@thebeatconnect1]

@@UnixOath Keep it locally in your network. My vaultwarden only syncs when I'm at home. And bitwarden keeps a local copy of your passwords on your device. So, even if you are not connected to your vaultwarden instance at home you still have access to your passwords.

[@maathimself9024]

@@UnixOath Don't open ports to it on your router, and don't point a publicly resolvable domain to it.

[@TitanTubs]

@@maathimself9024 I'm no sec expert but is my port forwarded plex server, Minecraft server fine? There's no way to get into my home network from that?

[@Blood-PawWerewolf]

I feel like these “password managers” are all vulnerable. And yet they “claim” that writing passwords on paper is “extremely unsecure”. Yeah… if they claim something that everyone is doing for decades is suddenly “unsecure” is all just to get you to “buy the solution” and make storing passwords “easier”

[@holymegadave]

Exactly they produce the fake need for something. You need to get the jab and suddenly the common flu dont exists anymore haha.

[@windowsxseven]

funny how it says there are two replies to this but there's only mine

[@tunguska2370]

Make that 3

[@SlideRSB]

Writing your passwords on paper can be secure if you're smart about where you keep that list but most people aren't that smart about it. Most regular people will keep that list out in plain view were anyone passing by can glance at it or within view of a webcam or something.

[@raiden72]

Why does KZbin not display some comments? Is this a shadowban, or is this an actual setting that the creator can change?

[@xx4248]

I agree with most of your points here. I disagree with the assumption that open source code is actually looked at by a lot of eyes. Several security issues have arisen and affected a vast majority of projects because that's exactly what's not happening

[@ChaoticNeutralMatt]

I wouldn't expect it to get looked at UNLESS the software looked at getting audited. I mean I'm sure it happens but it feels more effective to make sure it's up to snuff by going to people.

[@mrmarkom]

I agree with this comment as well. There seems to be a presumption that all open source software is more secure by default. In reality often this is not a case. LastPass has a huge incentive to make their software secure - what they sell is not password manager but the trust in their product. I do love and believe in open source, but I would not bet that some actor could not register as contributor to an open source project and then gradually add a security backdoor to it.

[@carbonlight5783]

Idk why the Linux community are so dumb in terms of cybersecurity. In open source stuff we have somewhat of a bystander effect which loosely translates to 'if it's open source, someone will look at it'. In theory Open source might be secure,,,,,, but reality is much different. Open source is much lacking in security. Ex- Linux Distros, Telegram, Firefox, NPM modules(for spreading malware), PHP, Wire, F-droid and many many more are insecure mess and open source at the same time. Some secure proprietary stuff are - Chrome, Macs, ChromeOS, IOS and many more. Secure Open source stuff- Signal, Android, QubesOS(there are limitations to Qubes as well but it's secure), Keepass, Veracrypt, BSD, OpenWRT and many many more

[@gianni50725]

Exactly. People wanted to believe the triviality of heartbleed was a one-off thing, and then we got an even more trivial and harmful bug with log4j last year. Even open source projects that are used the world over don't get many eyes looking at them.

[@JTKroll12]

it's looked at by more eyes than proprietary software

[@eddiethehead7466]

I adapted using password managers a few years ago. Before that, I was the kind of person who would save them in browser. LastPass was the one I chose, because let's be honest, it is the Chrome of that realm, majority who uses a password manager, is most likely using LastPass. But I never liked the UX personally and was looking for an alternative that works for me, open source or not. So like just after a month of adapting to the password manager ways of things, I made a switch from LastPass to Bitwarden and was it an upgrade in every possible manner. It is FOSS and it's UI/UX is crazy simple that works for me. Never looked for an alternative ever since because I don't see anything being better than this, not at least for me personally.

[@raiden72]

Thank you for pointing out that open source code is more secure than proprietary code! I wish more people would understand this when they go to the voting booth!!!! We will never have any ways of knowing that our vote has ever counted if we don't have access to the source code!!

[@kitsunedude]

Can't say I agree with that generalized statement. If a open source project doesn't get love and attention from skilled people to point out and harden against vulnerabilities, it's less secure in that case.

[@PvtAnonymous]

@@kitsunedude yes, but kinda no. Who can guarantee that CSS will get love and attention? I guess 90% of apps out there "somehow work" but a majority of them has some sort of security flaw that no one is ever gonna fix. Even to the smallest level, I deeply believe that OSS is the way to go in terms of security.

[@duncanw9901]

@@kitsunedude security is _ontological,_ not _empirical._ The process of security is about reducing the number of people or devices that you must trust, and closed source software therefore _cannot be secure,_ even if it is impossible to hack, because it is impossible to remove the developers from the ring of trust.

[@dealloc]

This is a fallacy. "more secure" is not measurable. There's many factors that are either difficult or outright impossible to measure; target audience, severity of security bugs/exploits, age, review processes, auditing, number of contributors, maintainers and code owners. One could argue that proprietary software could be more secure because there's money being put towards it, and able to hire people who specialize in those areas. And that since the code is proprietary there's a less likely chance that an attacker can find or even utilize an exploit as it requires probing that can be monitored and likely prevented. I'm not here to point out the number of exploits that have not only been found in open source, but that also has had global impact in terms. The matter of fact is that most proprietary software nowadays also uses open source software, which adds to the surface area of bugs and exploits. I am not saying all proprietary software is more or less secure-it would mean that every company follows the best practices to a tee, which is obviously not the case. I am stating that it's impossible to measure what "more secure" is.

[@QuantumConundrum]

Wrong.

[@dreamhollow]

This is exactly why I don't trust "Password Safekeeper" programs that keep all your passwords locked away in one place. You never know when something will go horribly wrong.

[@alex15095]

I've had an experience with LastPass I can only describe as outraging. I tried to copy a password one day, only to realize the password I copied actually wasn't my password, it was a corrupted Unicode string. Some other passwords had the same issue. I was locked out and unable to log in to some services that I really needed to log into to do some work. I contacted support and they told me the engineers are aware of the issue and it will be fixed in a WEEK. This is on the level of installing a smart door lock for your home, the servers malfunctioning, and support telling you to sleep outside for a week as the engineers try to fix the servers.

[@OurFreeSociety]

You should NEVER use smart devices & LP is an evil corp. I have to move from them because even though I've been paying for years, & using them since 2009, they are NOW REFUSING me support because I'm on Win 7 & was on Brave. They've always had bad support since LogmeIn bought them out although even prior to that support was lacking, but at lesat the software used to work back then 95% of the time. Then logmein bought them out (now sold) & ruined the app.

[@somethingelse401]

I use Bitwarden. Stopped using lastpass after they started removing the features and putting them behind a paywall.

[@gw1814]

So your cheap?

[@EvoX180]

@@gw1814 what does that have to do with been cheap? Imagine using a feature that has never been behind a paywall and now they put it behind a paywall what sense does that make? Fuck lastpass

[@Shajirr_]

Just pointing out that for like 99.99% people, if your solution to this problem is "host a server yourself", it will be waaaay less secure than just about any service you can use, including LastPass, and your server will have way more chances to get broken into.

[@dannydogs4385]

Then just store them locally

[@urnoob5528]

except u wont have every hacker in the world trying to get into it remember the safest places are often the most dangerous place

[@mrgrimmeh]

I think the target audience here is technically competent. But it’s still a stretch to handle all this yourself.

[@Shimpriv]

I use bitwarden but passwords i store there aren't complete anyway. I add an easily remembered pin codes based on the resource name to the end. This way even if my passwords are stolen they're useless, it should also be pretty hard to complete them without knowing what symbols i use in pins and how many. Sure, it adds the step of manually adding pins every time but since they're based on resource name it's manageable.

[@xB-yg2iw]

I do the same thing, except with a 30 character string I remember, and specific offset in the string I insert information related to the resource.

[@sm_stormzy1075]

@@xB-yg2iw 30 characters jesus

[@xB-yg2iw]

@@sm_stormzy1075 trains my memory 😅

[@tylernol1566]

Cool idea!

[@CeasiusC]

With Encryption usually it's OK if the algorithms become known, in fact the more scrutiny the better, as long as the private keys remain secure.

[@TravellerHD]

Hacks are exactly the reason I've never used a cloud password manager. Way too big of a target. Until now I've been using randomly generated passwords that I store on an encrypted note, but KeePass + Syncthing sounds like perfection. I'll definitely be switching to that.

[@CubicsLetsPlays]

Hey man, just wanted to say I appreciate u bringing this type of stuff to the public. Thanks!

[@jesuschristislord6790]

You can like this comment when mental Outlaw makes the "KeePass Got Hacked, Time to Switch to the new thing" video at some point.

[@holymegadave]

Luke Smith Maneuver haha

[@shinnou1]

There are brute force tools to hack KDBX files so those should be secured by you. He probably should have been more clear on that.

[@ralphmiranda2077]

A LOT of people are trying to sell "self-hosting" in response to this news when they're failing to make the points made in this video-it's closed source.

[@wumwum42]

right. some people cant stop promoting complicated alternatives to beginners who struggle to use PCs. Those who like lastpass likely wont like keepass. Thats like when someone ask how to get away from windows, is really motived to switch and you suggest gentoo... thats how you get them to stop caring. every sane human would suggest ubuntu, mint or PopOs instead, since there they have a high chance of leaning it. There is a very good nearly 1:1 alternative to lastpass: bitwarden. It provides pretty much the same features IN ONE APPLICATION, is Open source and proven themselve as secure (I am not aware of ANY notable hack). When you ask some to get away from whatsapp, they say OK and ask you what they should use instead, you would suggest signal in a hearthbeat, but this is like suggesting setting up a own matrix server instead.

[@dannydogs4385]

Switched to keepass xc months ago. Took a lot of time resetting a ton of password to safe randomly generated ones given by it but I believe it was worth it overall. Have it on my desktop, laptop, and soon android phone. Pretty upset though that Apple iPhone doesn’t have it. Edit: Thank you for showing the iPhone version. I didn’t know there was one compatible with an iPhone application of keepass.

[@pikaa-si9ie]

Self hosting is the future

[@Qunia]

At this point I’m convinced it’s literally safer to just write your passwords on a notepad or something. Like, I write all my passwords on a notepad file, I should find a way to encrypt it though

[@dannydogs4385]

I recommend transferring those to keepass or a fork of it like keepass xc.

[@terminalvelocity4858]

Actually, that's just about as bad, if not worse since LP is an encrypted service (by their statements). Make sure you ALWAYS encrypt your passwords no matter what, especially with excellent free solutions like KeePass, no excuse.

[@harrygenderson6847]

keepass xc is local, so you can use that. I just use pass, which is command line based.

[@arkdirfe]

You can just stuff the txt file into an encrypted archive. It's probably not the most secure but it's better than a bare file.

[@2treeman435]

The only thing safer than using an exisitng cloud based password manager is hosting one yourself.

[@SimausMasaqer]

Whole situation sounds like "nah, stealing user data is too easy, let's steal the source code and prepare something awesome".

[@wildmanjeff42]

Switched to Keepass and KeepassXC years ago. Keeping your own passwords on 2 usb keys and a computer for backup reduces your risk to you giving up your password and Keyfile. Use both and put 500 random SSH Keys on a usb key, and.....good luck, if I loose it very few people that will ever be able to break encryption. Thanks for the video and heads up !

[@EnglishLaw]

Can it easily be backed up? I've had even sandisk usb keys give up.

[@wildmanjeff42]

@@EnglishLaw yes, very easy..it is a single file, and auto saves if you make any changes in the database in the program. There are win and Linux versions and all use same database file

[@serpantinthewild]

@@wildmanjeff42 I use keypass XC on linux and keep the keyfile on cloud with AES 256bit encryption in 7z format. The entrophy for the password on the 7z file is 196.79 bit, do you think it's safe? Let's say the cloud is compromised and someone got hold of the encrypted file containing the keyfile.kdbx, would they be able to crack the pass?

[@wildmanjeff42]

@@serpantinthewild I don't know if it would be feasible to try to break it, or even possible, but with tech evolving and supercomputers, if they wanted to dedicate the horsepower, a big agency might could. All we can do is make as hard as possible, and hope. Your method sounds well thought out, and safe to me but I am not at the pro level with encryption knowledge.

[@dherokbattleborn]

My advice use an open source password manager for passwords that aren’t super important but commonly used and write down and hide the important ones somewhere. That way if your computer gets compromised and your master password is leaked the most important ones are still safe

[@thechair6519]

I swear people be like "hurr durr you can get hack!!" without realizing that the only way to get hacked is by BEING CONNECTED TO THE INTERNET

[@EvanOfTheDarkness]

Not true. A _very_ dedicated the hacker could also look up your address, break into your house, and physically hack your pc without ever using the internet!

[@hopelessdecoy]

@@EvanOfTheDarkness or use Trojan software in whatever device you connect to it. I doubt many here are off grid on KZbin for obvious reasons.

[@_shadow_1]

I only keep all of my most important passwords in my head or on a paper in a secure physical location (with no context on the paper that would indicate what those passwords go to). Sure it takes more time to insert my passwords as I have to type them out manually, but keeping them stored in an air gapped way rather than on a server I have no control over is the best option and the only way something could possibly get my info unless they hacked the servers for the account itself or through my device as I type it if it's been hacked.

[@SMJSmoK]

The problem with that is that you probably aren't making the passwords as secure as a password manager would. I mean who would want to type long random strings of letters, numbers and special characters all the time.

[@blocksource4192]

This is why I don’t trust sponsors. I think we can all remember the commetary youtuber nord vpn fiasco where they were saying you would get your bank details stolen at coffee shops like any bank sites don’t use https in 2022.

[@VenturaPiano]

I agree with all points except one, the concept that opensource is more secure than proprietary. Although I would agree that the code quality is likely better in opensource solutions, that doesn't necessarily translate to less discovered vulnerabilities. The fact of the matter is, opensource code bases can be inspected by bad guys too, and those bad guys might have significantly more interest in finding a vulnerability than the overall community. There aren't THAT many qualified software devs that will think about security and decide to audit opensource code especially if it's their spare time. My point is, even if proprietary code is likely to be much poorer quality, it would take stolen source code to be leaked for the wider internet to make the comparison fair. I'm not saying those things don't happen, but I don't think it's as common place.

[@macktheripper7454]

Open source is more secure because of the concept of getting caught doing stupid shit ..its not that companies don't but are less likely to with open source. Even if no devs look at a project, the threat of discovery is there. With closed source its all reverse engineering and binaries. I respectfully disagree. Peace ✌️

[@VenturaPiano]

​@@macktheripper7454 I agree to disagree :) peace ✌️

[@russellhltn1396]

@@macktheripper7454 Open source is more secure only if someone else comes along and checks it. I mean really checks it. There's a certain Kitty Genovese effect going on here. "It's open, someone else will check it." Meanwhile, no one (at least no one with the required understanding of encryption) looks at it. Case in point: Heartbleed. The bug was introduced 1 Feb 2012 and not discovered until 2 years later. It many have been exploited for 5 months prior to discovery. Bottom line, neither proprietary nor open source is superior to the other. It's all in the implementation.

[@freedustin]

Exploits are not exactly jumping out at you while looking at source code. Open or closed source is kinda a moot point to hackers who use stuff like Ghidra to find exploits. The benefit to open source is anybody who can make a patch...can get that patch submitted. They don't have to get a job at some company to fix a problem. Or risk enrolling in a slow bug bounty program that leave the exploit alive for a year while they try to decide if they wish to pay for that or not.

[@alexruedi1995]

I guess there is a reason why NIST strongly advises against "security through obscurity". just one example: Encryptions like RSA are well-known but still secure. Would you trust some closed-source encryption - built by let's say apple or huawei? i think most people misunderstand what open source really is. It is about owning it, beeing able to understand the concepts, modify or reuse parts of it, propose changes or discuss future enhancements and collaborate with anyone that thinks it's good. and one last thing: if you save your notes on an android phone. Do you think the version from playstore with ads, or the open-source version from f-droid is more secure?

[@aland7236]

Been using regular KeePass and keeping the DB in my onedrive for years now. It's handy enough and easy to access a credential when go somewhere since most places have Windohs installed.

[@gaminggamingtm]

Can't we just write our passwords on paper and then memorize them?

[@awndolznmowdlzkwndznwua]

Remember to eat the paper afterwards

[@carsoccerpain]

Copying and pasting is just more efficient

[@salsamancer]

@@awndolznmowdlzkwndznwua Password Management via osmosis

[@tonysolar284]

A boomer move, but they don't memorize.

[@DeusTex-Mex]

if you can memorize hundreds of unique passwords you're better than me...

[@BlindMango]

It has always blown my mind that people would put all their passwords on some third party company's servers, because this exact thing will happen with certainty if you give it enough time

[@maximilianschaffler9981]

Better than using the same password on every login i guess

[@russellhltn1396]

@@maximilianschaffler9981 I have a different password for every site. My "password manager" is a sheet of paper. Granted, it's not secure from "the evil janitor" but totally secure against hackers.

[@maximilianschaffler9981]

​@@russellhltn1396 Yes but i login and out of so many sites that this is just not an option for me. I really like 1Password and as i researched it there is no way for a hacker to steal my information because the login key (which only the user has) is on a sheet of paper. I find this equally as secure and easier to use. I totally understand the "pen and paper" solution though

[@mrultrainstinct7417]

imagine using the cloud to store passwords

[@mysteryY2K]

for real, even when i was 11 years old and they started doing this i could smell this coming

[@savag]

desi srbine

[@davidt01]

The passwords are encrypted with your master password.

[@ganeshkumar269]

@@davidt01 "encrypted" 🤡

[@terminalvelocity4858]

@@ganeshkumar269 Can you prove otherwise, or just going with the trend train?

[@foxtailedcritter]

That's why i just write my long af passwørds on a piece of paper instead and store it in the safest place that no man, woman or blackhat would ever access... in my underwear. Alternatives are just storing it offline or in pgp encrypted txt.

[@hutch1010]

smart but dumb 💀

[@laniusdev]

I switched from LastPass to KeePassXC 2, maybe 3 years ago and haven't really ever looked back. Syncthing sounds pretty interesting, but I guess since I already use a self-hosted ownCloud instance, I don't really need that, but it would be for sure an overkill if was made only for this single file... which absolutely wasn't the main reason why I started my own cloud instance.

[@gitgudchannel]

Just host Vaultwarden on your home server frens

[@MrGhostTube]

I'm thinking this.

[@lior_haddad]

Honestly, the only reason I was using lastpass was for the cloud because I don't trust myself with not losing stuff. Definitely switching, however, thanks for the recommendation.

[@mitchzer0iii919]

"Use a password manager" they said I didn't listen

[@tocraft573]

I'm so happy that this happened, its honestly just such a bad idea to use online password services, just use local password storing solutions

[@humanname6534]

What specifically are people talking about when they mention an offline solution?

[@tocraft573]

@@humanname6534 The video has one in the name, KeePass

[@lussor1]

@@humanname6534 keepasskc

[@csolisr]

And then there's me, self hosting Vaultwarden (a Rust reimplementation of Bitwarden) for maximum security

[@Unmixable404]

This is me.

[@AJ-po6up]

Same here, been doing that for 2yrs now since I moved from LastPass.

[@larion2336]

Already been using KeePass for 5+ years now. I remember back when I decided to get a password manager, I did some research & dismissed online options like this LastPass specifically because I didn't really trust their security long term. Ahh... the sweet vindication of a past choice well made.

[@ichibanmanekineko]

It wasn't hacked, one of its development account was compromised and no customer data or PII was exposed to the internet...

[@zUltra3D]

So hacked

[@myentertainment55]

I always was shocked that people use something on a cloud to save passwords. I mean if you worrying about your data getting hacked in one place but you trust other place with the same (or barely better) protection but not one password , but all of them (so there would be way way way way more incentive to try to hack it). Lol Yeah, I was proved right. After being interested in IT for several years and working here for one year I already can see how insecure it is.

[@davidt01]

As long as you use a super-strong master password you have nothing to worry about. Do you think your passwords are stored in plain text? The data is encrypted so even if it gets hacked nobody can read your passwords without spending lifetimes of computer resources required to crack the password.

[@swankydanky8025]

password managers are a single point of failure, not worth using

[@davidt01]

@@swankydanky8025 When you weigh the cost of not using one (weaker passwords that you can remember or write easily), with the chances that it's going to fail (which I've never heard of happening), it's pretty obvious that a password manager makes things safer overall.

[@myentertainment55]

@@davidt01 I hope I don't talk to a bot or overworked LastPass employee or some gentleman or lady from 3rd world country Last Pass PR team hired to clear this up. (If so, hi, I hope weather is great today for you). You are correct. But let's go to master code itself. What makes it inherently more secure than any other site that I log in on the internet. Obviously my password are unique, very long, with many types of characters and randomized. But sites are getting hacked via different holes in security regardless of your password. But yeah, it's good first step.

[@davidt01]

@@myentertainment55 I am a 21 year old guy from the US. I don't work for LastPass. I prefer Bitwarden to them anyway. Using a password manager itself doesn't make anything secure, the security comes because it makes it really easy to generate and save super-strong passwords that otherwise you would have to simplify in order to write down, memorize, or reuse. When a website gets hacked, the (hopefully) encrypted passwords will get shared with hackers who try to crack them. The weakest passwords are quickly broken and discovered, but the strong ones are never revealed. So then they will try the weak ones on other websites with different variations. But not all websites properly encrypt or hash their user's passwords. Password managers usually are much better with this and their encryption details are usually available to the public. They use very strong encryption on their passwords that make it take much, much longer to crack. The weak point is your master password.

[@lovebaranus9800]

I think the guys in the comments talking shit about how "every password manager is not secure, better use notes/store in *plain text* " are way to extremists and kind of ignorant too, since they miss the biggest advantages of a password manager: 1.- You can make every single one of your passwords insanely long and complicated (im talking about +120 characters with every kind of ASCII) and it doesn't matter, you only ever memorize 1 or 2 at most. 2.- If you use an *offline* password manager it's the same as having a paper in your office, since they need to get access to your drive, much like how they need to break in your office if it was paper, but with the difference being that your database is encripted and password protected, unlike your note, and if you use a +100 digit password on your database then it's gg for them. 3.- Another thing is, an offline pm is by extension, decentralized, there isn't a 'server' or 'group' to attack, anf if most people keep their DB in a usb or small ssd, then it's even more unrealistic to "crack" it. 4.- KeepassXC has the 'Health report' feature from bitwarden but for free, and it makes it trivial to know which accounts have been compromised and to save them/delete them *TL;DR* = KeepassXC Is king, pass is way too basic, and normal keepass sucks for the most part in comparison.

[@isaakyhsialf4369]

who cares if ur passwords are as big as the world if their security is actually small as a peanut ur password: *RREAAAALLLYYYYYBIGGGGGGPASSWORRRRROOOOOORRRRDDDDDEEEEEEEGOOOOOOOEEEEESSSSSHEEEEEERE* send to site site storage (that has the key): *ur password is hash format* site gets owned hacker gets both ur hash and the key: decrypts ur password what the hacker prints out: *ur password* **owned** how much time does that take? 3-4h now assuming ur password is as big as 10-12 characters with both lower & upper & numbers, there u go, your password will take at the minimum months to crack which isnt unfallible security, but lets be honest when hacking accs hackers dont wanna waste time brute forcing accs when using methods like owning websites prove much more efficient

[@TheKrausenKid]

I simply remember my passwords. That way only I myself and the CIA know what they are.

[@Jack-qj2pr]

Saw this coming. If people really took their security seriously, why the hell they using LastPass of all things.

[@rdean150]

You should post on update video about this hack. Turns out hackers HAVE exfiltrated encrypted user password vaults. Currently, the only thing keeping LastPass users' entire digital world safe is the strength of their chosen master password. If you use LastPass (which I do), it's hard to imagine a more serious breach than this. If you'll excuse me, I need to go spend the next 6 hours changing every password on every website I have created an account on over the past 8 years.

[@bjornroesbeke]

I've seen countless of ads for Lastpass in KZbin videos and my reaction to them was the same it is now. Why the (expletive) would you store all your passwords on someone else's servers? I bet you'd even lose access to them if you stop paying them (i don't know the costs and terms/conditions of Lastpass, nor do i care). Yeah, just give your passwords to Thieves Inc.

[@terminalvelocity4858]

I've been looking for something like this for years, ditching my other PM immediately. THANK YOU!

[@skaruts]

By the way, your keepass file doesn't need to have a .kdbx extension. You can give it any other extension (or none), to keep it stealthy. The only yellow flag I found in KeePassXC, is that it remembers the last folder you loaded your file from. I presume this could be a potential point of weakness. I mean, I don't know, personally I just don't like the idea of anyone even knowing where my passwords are stored. Other than that, I've been using it for a long time and so far I'm happy.

[@tonysolar284]

That only works if the header of the file is not being searched.

[@skaruts]

@@tonysolar284 yea but that's very unlikely to happen to 99% of the people using it.

[@yosefberger6259]

You can set up your syncthing "server" on a raspberry pi or and old laptop to have it aways on, this way you don't need to juggle making sure you have both your phone and your laptop or both your laptop and desktop on at the same time to sync. Your can also set syncthing to always use encryption for it's communication and syncing.

[@VolcanicDisruption]

How do you do this?

[@yosefberger6259]

@@VolcanicDisruption There are tutorials to make it run on startup in case the pi ever needs to restart for wheeler reason, and the encryption is part of the app settings

[@tikoblocks3224]

I never trusted password managers

[@freaper2048]

I don't trust myself how can I trust a password manager 😂

[@windowsxseven]

@Bully peter GOT DAMN, THANKS BRO HOLY CRĂP I NEEDED THIS.CHANGED MY FOXKE'N LIFE

[@Hola-jp6yh]

@Bully peter you're fat irl

[@ab0uts]

Self hosting=goals

[@AIC_onyt]

You have tiktok linked in your channel info. tell me more about security and privacy XD

[@guacfiend]

@@AIC_onyt and you're using google services to reply to someone else using google services, how is this any different from using tiktok?

[@chrissquid]

@@AIC_onyt all social media has no regard for privacy, sometimes you just gotta accept your data is being tracked lol

[@LiborTinka]

I've used KeePass for many years but after switching to Linux I just use the "pass" script on Linux (using it from terminal) and I've never been happier since. It's simple, free and practically bulletproof. There are very good rememberable password generators too. I don't know why I've used the clumsy GUIs for such a straightforward task for so many years...

You can also combine it with a hardware key/openPGP card to separate the access to your passwords and the key.

[@davidt01]

It didn't "get hacked", a dev's computer or account got hacked and source code was stolen.

[@terminalvelocity4858]

You literally just contradicted yourself...

[@davidt01]

@@terminalvelocity4858 LastPass servers and user data didn't get hacked into.

[@blocksource4192]

@@davidt01 but... LastPass was still hacked....

[@davidt01]

@@blocksource4192 It's clickbait. Getting hacked can mean different things. People read "got hacked" and they think that everyone's passwords were exposed.

[@blocksource4192]

@@davidt01 No, it's not clickbait, it still got hacked, having source code stolen means it got hacked.

[@uniqueprogressive9908]

This is the major reason why I don't and will never use centralized password managers. They are a huge target for hackers

[@aniquinstark4347]

Literally just write your passwords on a piece of paper. Inconvenient? Yes. Absolutely unhackable? Also yes.

[@JohnDoe-nv7bw]

someone will take the paper. hacked.

[@netkv]

encrypt the paper and write password to that to another paper which would be encrypted and had password written on another paper which would be...

[@Shajirr_]

has some vulnerabilities: - search time, good luck sorting through hundreds of passwords - copying time - water - fire - a dog, or any other animal than can shred paper - getting left somewhere to never be found again - accidentally thrown away

[@isaakyhsialf4369]

since u cant read, incovenient, yes, unhackable, yes

[@Zakanuva]

I originally just kept a spreadsheet with all the passwords I used for all the accounts I had, and I only started using LastPass when it became a complimentary service to the anti-virus software I got from Geek Squad; it _was_ handy for the time being, especially since it actively encouraged using different passwords and helped with generating more secure ones than I could've come up with on my own, but I _have_ been working towards transferring what's stored there into a KeePassXC database, and this happening is further incentive to do so.

[@jamesedwards3923]

Do you have any idea how easily spreedsheets can be hacked? Look it up. Countless educational guides on how to do it.

[@groos3449]

I've been using pass (or GNU/Pass) for a while now. It's based on GPG and has a nice git integration, alongside OTP and password generation

[@Jack-om1qw]

GNU Pass is the true redpill

[@groos3449]

@@Jack-om1qw the TRUE redpill is pash from dylanaraps (creator of KISS Linux) but somehow I never tried to use it

[@Jack-om1qw]

@@groos3449 The true redpill is memorising every single randomly generated 30 character password

[@groos3449]

@@Jack-om1qw true

[@pcislocked]

I switched from LastPass to KeePassXC around two years ago, and using Aegis as the choice for 2FA. It even imported my steam authenticator. And It worked great so far, my only complaint being android file manager not playing well with the google drive(I keep keys separate, don't worry.).

[@jenya_hmarko]

KeePassXC also offers 2FA functionality. Including steam codes. Which is great.

[@pcislocked]

@@jenya_hmarko Yeah but I find aegis more easy to use and more similar to the older auth apps(such as lastpass authenticator and google auth) that I'm used to. I was used to store auth codes in keepass too, but not anymore. Keeping both factors in one database doesn't make sense to me.

[@Infinitay]

In their defense, isn't this part of some bigger hack? It doesn't excuse it, but it's not like LP themselves were targeted. I think the attack was dubbed Oktapus or something like that. Your typical phising/SEing hack involving sms 2fa. If it wasn't clear I'd like to reiterate I'm not sure.

[@sliceoflife5812]

If you must worry, just bite the bullet and use Qubes. Then you can use a KP dedicated environment that is void of any network. Also storing your pws in any sort of cloud is just asking for trouble. I could never understand the logic a decade ago and I still can't today.

[@Neucher]

Why would you use LastPass over Bitwarden ?

[@interdimensionaldrift]

Right lol

[@MarigoldAW]

You'd be surprised how unwilling people are to change their current service. The only thing that really moved people from LastPass was the subscription change lmao. It always amazes me how cheap people are about their own security

[@Calslock]

Self-hosted Bitwarden FTW ❤

[@truejeffanderson]

Yubikey works with lastpass. Yubi is USB that looks like a key and goes on your keychain. To open laspass you plug it in and press the lit button. Whenever you update lastpass, it will ask for the yubikey button to be pressed again. So you control access and changes with a usb key held on your personal keychain at all times. You get 2, because it is your only backup when using yubi. It's not a joke. High security. You are responsible to store the backup key in a fireproof vault or similar. If that makes you uncomfortable, then you buy 3 yubikeys. Responsible people can have high security. But you don't need perfect security, just better security then your neighbour. Lastpass is a start.

[@sYd6point7]

cloud storage is a bad idea from the onset.

[@mysteryY2K]

within the context of security/privacy, sure. otherwise it was a great idea

[@banzooiebooie]

Ohh...how this story unfolds a few months later! They used the information they stole on this breach and now in December same year Lastpass told everyone that a Backup site was compromised with all users encrypted vaults.

[@spicymeymey5643]

Why is this cooking channel uploading tech videos ???

[@brien.]

LOL

[@samon53]

Steve Gibson of Security Now podcast had audited Lastpass's code in the past. If you don't trust his word I don't know who you could. Probably switching to Bitwarden at some point myself anyway.

[@BeetleBuns]

I personally realize that the only truly safe password manager is a notebook on my desk, and anyone that thinks ANY online password manager is "secure" is deluding themselves.

[@nicksjacku9750]

Don't do that, and just have your password managers offline

[@BeetleBuns]

@@nicksjacku9750 a notebook is about as offline as it can get, my dude

[@nicksjacku9750]

@@BeetleBuns never leave a paper trial, you can always get screwed up by that

[@BeetleBuns]

@@nicksjacku9750 if there are people getting into my house, I have more pressing concerns than my gmail password.

[@UberPwner09]

Uninstalled LastPass and deleted my account months ago and switched to KeePassXC cuz I was getting increasingly uncomfortable with putting all my sensitive passwords in the hands of a 3rd party - not to mention them wanting to gyp users by making them PAY for password protection. Really feel like I dodged bullet, there.

[@spurdosparde8197]

FUCK I need to delete my last pass right now

[@khmnc]

wow, so i think you just solved 2 major problems i've been having for a few years now, thank you

[@keanu_]

I’ve never used one of this centralised password messanger. Such bullshit

[@RiftWalker111]

Your a godsend chad, I thought LastPass was only hacked once or twice before with minor issues, f**k that I'm switching.

[@connorkinnaman8841]

Nice deleted my last pass account 1 month ago cause it was ao annoying that you could only choose to use it on mobile or pc with the free version

[@midimusicforever]

This is what makes me skeptical of password managers. They are a single point of failure.

[@go_fuck_yourself]

LastPass just keeps screwing up.

[@holymegadave]

Their lastproject? haha

[@uuu12343]

You know what's hilarious Writing your passwords into a text file mapped to a username and a domain writing your key to a key file, Encrypting the password text file with gpg using the command line and automatically inputting the password via command line Decrypting when wanting to read the passwords Is literally more secured than these kinds of Password Managers lmao

[@hopelessdecoy]

Until your hardware fails or is destroyed and then your passwords are gone. Why not just use pen and paper and a custom cipher at that point? Even more secure no one can connect to it or run cracks on it (that's not a serious suggestion I'm pro password managers)

[@truejeffanderson]

What I like about keypassXC is the ability to store 2-factor authentication codes without requiring a phone. The browser extension that allows me to click an icon to fill credentials on webpages. It works just like lastpass without the weak secuirty and cost.

[@davidyoder5890]

I'm all for open source software, and not to throw a wrench in the engine here, but what about the recent security vulnerabilities in the Linux kernel that have been there for almost a decade? How did the "many eyes" mitigate those threats?

[@njpme]

Facts.

[@thebeatconnect1]

With how big the source code is, something will be missed, we are humans and we make mistakes. But that's the best part of open source, a vulnerability is found and it gets patched immediately, and it was found by researchers and if it wasn't open source you wouldn't that it was there for 10 years. And just because one vulnerability was missed doesn't mean there are none that are not getting patched. Nothing is 100% secure and safe.

[@terminalvelocity4858]

Linux is far more secure than Windows/Mac unless a user has no clue how to operate a system, also true for any OS really. I would put 30 years of using multi-os client and server-critical operations on that. Let's talk some details here if you want to elaborate on your specifics a bit? The nice thing also is if you don't like Linux, this software is available on just about every OS and Mobile device.

[@davidyoder5890]

@@terminalvelocity4858 ok. CVE-2022-0847, aka "Dirty Pipe". Been there for a long time, but no one noticed? If your premise is true for any OS, then the same logic applies to a Linux system - in that the user is no more secure than the level of understanding they have of the underlying system. In that regard, I would put my money on Microsoft Windows because they have to design a system in which it's users are woefully uninformed about what happens under the hood. But do tell, let's get specific about the issues...

[@davidyoder5890]

@@thebeatconnect1 Agreed. I'm just stirring the pot a little. But how is that any different than a closed source program with a critical vulnerability left undiscovered for 8yrs? It's really no different. Vulnerabilities are discovered by either ethical hackers or malicious hackers. In the case of ethical hackers, they're reported. In the case of malicious hackers, they're exploited. It doesn't matter whether the software is open or closed source, the outcome is the same. From a security standpoint, there's no legitimate reason to prefer one over the other...

[@logicalfundy]

I'm actually a bit new to KeePassXC, but have been using KeePass for a while. Only recently learned of KeePassXC when I started moving to Linux.

[@livingcodex9878]

おはようございます

[@jackh3242]

Sorry

[@caesarxinsanium]

true first eh??😘👍🏼

[@emme7020]

おはよう！

[@NumbersCanBeFun]

Bro, you're brilliant! I just set up syncthing just the other day and this didn't even occur to me. Thank you!

[@RR-bc6wy]

It's hacked again

[@abe-danger]

imagine using a password manager that stores your data in the cloud

[@not_herobrine3752]

its the cloud guys its totally unhackable /s

[@jonbikaku6133]

I think this channel is becoming a little too extreme of privacy warriors atleast in this case. There are a couple things to note - any good software company will isolate dev accounts to only the repos they need access to. I work in a design focused company and even we get access to code only if we'll be a direct contributor to it. This means there's a big chance that even if the dev account leaked proprietary code, it was probably just a little piece of a very big puzzle. Secondly, the master passwords getting leaked in 2021 doesnt mean they're lying about not storing any passwords, no, it means the third party tracker they used got hacked which inturn provided access to their master passwords. The biggest exploit in any company is humans, and as we see even big security companies fall to this exploit. It doesn't mean everything is ruined tho, as a good company will use non-human tactics to ensure this human exploit cannot be leveraged to give high value returns.

[@Diviance]

I would be self-hosting my own bitwarden instance, myself. I liked KeePass when I used it... like 12 years ago. But there are better options.

[@chrissquid]

I think with the 2021 security breach, regardless of if they had "Zero Knowledge" of the users' master passwords at the time, since there were trackers in the actual app itself the third party would still be able to get the passwords.

[@emmanuelalva6597]

Seems like the safest way to keep passwords safe is to write them on a piece of paper and tape it to your monitor.

[@KogureDevilchan]

Imagine my face right now when I never used any of those password services...

[@thoughtsauce7225]

Been using Dashlane for a few years now and I love it, personally. Hope something like this never happens to Dashlane.

[@startrooper2345]

Dashlane is ok but the free plan is shit