LastPass

Bob: “You were an idiot to use LastPass. Now the hackers have your LastPass password!”

Alice: “No, they don’t. They have a hash generated with at least 5000 rounds of SHA-256. They still need to crack that or brute force your password, which isn’t likely unless they’re the NSA. And they have to crack it before I get around to changing my master password.”

Bob: “Well, I still don’t like that your passwords are all on someone else’s server where they can be stolen.”

Alice: “Except they’re all encrypted with AES-256, which is believed secure.”

Bob: “What if someone can crack it though?”

Alice: “If you’re worried there’s someone who can crack AES-256 then you’ve already lost, because that’s what keeps the most secure HTTPS connections secure. Anyone who can crack AES-256 doesn’t need to attack LastPass, they can just sniff the data as it goes across the Internet and steal your keys as you log in.”

Bob: “But LastPass can decrypt your passwords and steal them.”

Alice: “No, because they’re encrypted on your local machine. LastPass don’t have the keys to decrypt.”

Bob: “They could be taking a copy and not telling you.”

Alice: “Firstly, that would destroy their business as soon as anyone found out. And secondly, pretty much any other password manager could just as easily be doing the same thing, so what’s the better option?”

Bob: “You could use an open source password manager.”

Alice: “Sure, as long as you compile it yourself from source, and verify that your compiler and libraries haven’t been tampered with and don’t have any security weaknesses. Perhaps you’re actually capable of doing that, but 99% of people aren’t and will need to trust someone else. A company whose core business is password security is a pretty good choice.”

Bob: “OK, so what about script injection on the web page? I could just grab your master password when you enter it.”

Alice: “You don’t unlock and use LastPass via a web page. It uses a browser extension.”

Bob: “Well, I could still grab passwords from LastPass using script injection on the web site you’re logging into, so that it grabs the password as soon as LastPass puts it into the password field.”

Alice: “Yes, and again, that same vulnerability applies to every other web password manager, so what better alternative are you proposing?”

Bob: “A non-web password manager. One that doesn’t interface with the browser at all.”

Alice: “That’s a major pain. Now you have to copy the password to the clipboard manually, and then paste it in, assuming the web site in question hasn’t disabled paste. And sure, you might prevent automatic password grabbing, but you can still have the password stolen if you can be fooled into pasting it into the site, so the actual security you’ve gained is minimal. Plus what about malware that steals everything that you copy to the clipboard?”

Bob: “Fine, do what I do and just memorize your passwords.”

Alice: “You’ve got to be kidding. A secure password these days is at least 12 characters randomly chosen from uppercase and lowercase letters plus numbers and punctuation. There’s no way I can memorize even half a dozen of those, let alone the 100+ I would actually need. Because remember, you should never use the same password for multiple sites or re-use an old password.”

Bob: “Well, you should use a paper password manager then.”

Alice: “Hmm… I’ll have to look up web sites manually, which is not too bad. The problem is, with secure passwords like YuCe%nie4A&ng9 it’s going to be really tedious and time-consuming to painstakingly re-enter the password, retrying if I make even a single keystroke error. I can’t help thinking that I’ll be tempted to use short insecure passwords.”

Bob: “But you won’t have to trust someone else with your security.”

Alice: “True. But I’ll have to carry my book of passwords everywhere, and if I lose it I’ll lose all my passwords and someone else will get hold of them.”

Bob: “Well, instead of a plain book, make each page a password grid.”

Alice: “So now I have to remember 100 sets of a color and a symbol? Plus, are you going to explain that to my mother? She can’t even do Sudoku.”

Bob: “At least it’s actually secure.”

Alice: “Well, unless there’s keylogging malware on your system. Which is still vastly more probable than hackers who can break LastPass’s encryption.”

In the real world, computer security is not absolute. All commonly used personal computer systems have security holes. Passwords themselves are inherently flawed.

So it doesn’t matter that LastPass isn’t perfectly secure. What matters is that it’s better than many of the other options, when you take into account how human beings actually behave.

Sure, criticize LastPass for being vulnerable to a particular attack — but only if you have an alternative that is substantially more secure against that and other likely attacks, when used by a normal human being. Otherwise you’re not actually contributing anything useful to the discussion.

Speaking of which, some actual useful advice to go with your password manager: Use two factor authentication, via a phone app or a YubiKey.

I have no business connection with LastPass, other than as a customer. I used to use KeePassX, syncing my password database via SpiderOak and using copy and paste. That’s an OK solution, but I there’s no two factor authentication involved. I decided that 2FA, plus the dramatically better usability of LastPass, outweighed the risks of trusting LastPass the company.

Got a better solution? Argue for it.