Thread: Protecting a PC - time for an update from the wise heads?

Originally Posted by damian

I installed lastpass ...... I have not heard of any breaches.

Here's one for you, less than 12 months ago.

Google Warns LastPass Users Were Exposed To ‘Last Password’ Credential Leak

Originally Posted by Moti

Here's one for you, less than 12 months ago.

Google Warns LastPass Users Were Exposed To ‘Last Password’ Credential Leak

But if you look in the details, that's not a breach of the "credential store" itself, just an "interesting" way that a credential to one site could have been exploited (with a long sequence of dependencies - which just makes it less likely to be exploitable). I think the second largest concerns any user should have with any cloud-based data storage (be it your photos, your documents, or your passwords) is the theft of the whole data (for me the largest concern is my own access to that data, longer term). Someone having access to one of your photos isn't probably that big a deal, but if all your photos were stolen that's a bigger issue - same consideration with passwords, and this credential leak isn't affecting all passwords.

I think this was a data breach that lastpass had LastPass Hacked - Identified Early & Resolved - The LastPass Blog Importantly again the details show that individuals master passwords were not affected, nor were encrypted vaulted passwords (however master password reminders were).

Yes, using a system like this exposes you to the technicalities that the vendor needs to be doing right. There's many sites comparing the bigger players, like Password Manager Showdown: LastPass vs. 1Password or LastPass, 1Password and other password managers can be hacked: What to do now | Tom's Guide, but ultimately you need a password manager (because you shouldn't use the same password) and you have to put some faith in apps/vendors that have shown how they keep your credentials safe and deals with issues. Lastpass is from LogMeIn, a company you've probably heard of before (or used their services), and have been my personal choice, but I would also be comfortable with 1password or some of the others - importantly you want one that works how you want to use it, on browsers and devices that you use.