More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user

Researchers found that almost every victim was a LastPass user.

More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists

load all comments

saltynuts420 57 points 3 years ago

instead of using a password manager managed by a PRIVATE ENTITY people should start using bitwarden ... its opensource, free and much more secure and reliable

save

path: 0 3242895, hotness: undefined, score: 57, children: 14

forbiddenlake 20 points 3 years ago

But who is running the bitwarden server? Bitwarden the private company.

I self host vault warden, but it's really not something everyone can do.

save

path: 0 3242895 3248885, hotness: undefined, score: 20, children: 2

InvertedParallax 9 points 3 years ago

Vaultwarden is incredible, and runs easily on freebsd.

save

path: 0 3242895 3248885 3249867, hotness: undefined, score: 9, children: 0

bnjmn 5 points 3 years ago

Or should, for that matter

save

path: 0 3242895 3248885 3258069, hotness: undefined, score: 5, children: 0

yetAnotherUser 18 points 3 years ago

I personally use KeepassXD on my phone, although it hasn't had a security audit. There is also KeepassXC for desktop, which has had an audit

save

path: 0 3242895 3253954, hotness: undefined, score: 18, children: 0

RaivoKulli 14 points 3 years ago

Bitwarden, the host, is a private entity

save

path: 0 3242895 3267374, hotness: undefined, score: 14, children: 0

PlexSheep 13 points 3 years ago

I prefer local password managers. Synchronisation is achieved with a syncing service of our choice.

save

path: 0 3242895 3252932, hotness: undefined, score: 13, children: 1

anyhow2503 3 points 3 years ago

That's pretty much what Bitwarden does at its core. It will only synchronize the encrypted password vault and each client keeps an offline copy of it.

save

path: 0 3242895 3252932 3267430, hotness: undefined, score: 3, children: 0

itsdavetho 6 points 3 years ago

How does bitwarden encrypt their passwords? Im just realising that since it works on both my laptop and phone with no configuration it can't be overly nuanced

save

path: 0 3242895 3252335, hotness: undefined, score: 6, children: 3

tony 13 points 3 years ago

It's encrypted on the client and bitwarden themselves can't decrypt it (we assume, but there have been audits that seemed to confirm that).

If you want to you can just run your own server then they can't see the traffic at all.

save

path: 0 3242895 3252335 3252790, hotness: undefined, score: 13, children: 2

IverCoder 1 point 3 years ago

Private entities are more reliable for personal data than companies whose stocks have gone public.

save

path: 0 3242895 3274107, hotness: undefined, score: 1, children: 0

A2PKXG 1 point 3 years ago