Author Topic: LastPass - What are your thoughts? (Read 42,776 times)

Josh · « **on:** January 21, 2011, 07:29 PM »

As a refugee of the latest roboform drama, I have begun testing LastPass. I wanted to seek the input of the community here at DoCo. I am an avid fan of Roboform but have had to move due to their latest actions against long-time users.

Right now, my only complaints with lastpass are as follows:

A. No offline-only mode (No synchronization). This could be used on closed networks with no access to the "commercial internet".
B. The GUI/Toolbar leaves a bit to be desired but it is usable.

I have made mention of these things at my recent feedback topic at the lastpass forums.

What do you think? Is LastPass a worthy swap for RF?

allen · « **Reply #1 on:** January 21, 2011, 07:53 PM »

LastPass is an excellent password manager with very good form filling capabilities. The GUI is awful, as you've observed, but for the most part with LastPass you don't need to interact with the gui -- it eats passwords and spits them out. It also has applications for most mobile/smartphone platforms.

I use Passpack, myself. It is basically the opposite of LastPass in that its form filling is inferior as it's strictly bookmarklet/web based with no native browser helpers. I can't automatically pull your username/password as entered. On the upside, a great deal of attention has been paid to its interface and its workgroup/sharing capabilities are unrivaled. The other up-side to Passpack is that there's an AIR-based app for it that can be used offline. Because it's a standalone air app, you canot use it to film forms automatically but it does give you access to your accounts offline.

In both cases, you have a secure web-based solution that is extremely portable in that you need only the Internet to use them -- no software, no thumb drives. Lastpass is probably a better fit for a roboform refugee, though, as you're no doubt quite accustomed to a browser extension automatically remembering your accounts and filling your forms.

Bamse · « **Reply #2 on:** January 21, 2011, 08:19 PM »

No Lastpass is not a worthy swap because 1. RoboForm 7 has initial attempts to provide log-in to applications like you log-in to DC and 2. A very much improved secure notes feature which goes hand in hand with log-ins. LastPass does not know about applications and has poor note feature. What this means of course depend on what program is used for. RoboForm is a program (eventually system wide), Lastpass a plugin (browser only). The question of what supports which browser the best will probably even out over time. I am not advanced user but read of problems with this browser on this page etc. - they are both supported and will mature, like over and over

hpearce · « **Reply #3 on:** January 21, 2011, 08:30 PM »

Lastpass has the advantage of working in almost all browsers ... including opera.

I personal never found roboform that useful.

40hz · « **Reply #4 on:** January 21, 2011, 09:46 PM »

I am not the least bit comfortable with any password utility that I don't have complete control over.

So the simple fact LastPass stores anything anywhere but on my local hard drive is an absolute deal breaker for me. If they ever decided to release a version that did not require web access, I'd be much more interested.

And yes, I'd also be willing to pay a reasonable price for it if I decided to use it.

Since LastPass already caches your PWL locally, there is nothing technically preventing it from being a purely disk-based solution. It's simply a business decision not to allow it to work that way...

bscott · « **Reply #5 on:** January 21, 2011, 09:58 PM »

I have Roboform 6 but have been using Lastpass for the past few weeks as a potential replacement since I don't intend to pay to upgrade toRoboform7.

I must say that I have been pleasantly surprised by Lastpass. The features I use most are Sites, Secure Notes and Generate Secure Password and each of these I find works just as well as in Roboform 6. One feature that I found very usefull in Roboform was the form filling but I am not sure yet how well this works in Lastpass. Regardless of the form filling capabilities I will stick to Lastpass and if I needed any of the Premium features I would gladly pay for them.

I wasn't totally comfortable with having my passwords stored remotely but then I have Roboform data on a laptop and on a USB stick both of which I could lose.

I haven't used Roboform since installing Lastpass and will shortly delete it.

Although I was 100% happy with Roboform 6 I took exception to having bought a 'lifetime' licence and then being told that I must pay to upgrade to Version 7.

Bamse · « **Reply #6 on:** January 21, 2011, 10:11 PM »

From what I know of RoboForm the strength of encryption rely on your master password. Same way as with Firefox master password. Encryption is done on your computer, before sending off any data and why you don't have to worry about all those Roboform files, and if you can't remember password all is lost since RoboForm have no clue of password = also not content. That setup is supposed to shut up those who do not trust anything "cloudy"

How online database work I have no clue about but would expect it do equally secure. Have not tried new Everywhere thingy but old RoboForm Online did not reveal everything just because you could log in, if entry was set up with master password required nothing was shown until that was punched in. Was synched with preferences of "offline" RoboForm. Lastpass has same features.

allen · « **Reply #7 on:** January 21, 2011, 10:28 PM »

Quote from: 40hz on January 21, 2011, 09:46 PM

I am not the least bit comfortable with any password utility that I don't have complete control over.

Curious, what do you use that you have complete control over it?

40hz · « **Reply #8 on:** January 21, 2011, 10:37 PM »

Keypass and KeePassX

Very secure and totally local. I even get access to the source code.

allen · « **Reply #9 on:** January 21, 2011, 10:44 PM »

I'm totally sold on the convenience of being able to access my passwords from absolutely anywhere (though I also have means of accessing them locally in the event of a loss of Internet). As far as my data goes, I am sufficiently confident in my password + encryption key (two separate, required items) that I'd be comfortable putting my data on a public ftp site, let alone a secure server. On top of that, when not on my own machine a Yubikey is required to access my account -- but honestly, that's just overkill.

mwb1100 · « **Reply #10 on:** January 21, 2011, 10:52 PM »

Quote from: allen on January 21, 2011, 07:53 PM

I use Passpack, myself.

Thanks for reminding me of this - I tried this briefly a few years ago but couldn't remember the name when I was looking into password managers again. I'll have to take another look at these guys.

As far as 'having complete control' over my password storage, I also lean toward this point of view and I'm planning on also evaluating the community version of Clipperz running on my own little server.

But my laziness is a major force against running Clipperz on my own (I'm world-class lazy as well as a champion procrastinator - it'll be amazing if I manage to finish up this post)... I think that as long as I keep my banking passwords out of an online manager like LastPass or Passpack I could probably live with a major screw-up that resulted in a leak. Not entirely sure though.

superboyac · « **Reply #11 on:** January 21, 2011, 11:09 PM »

Quote from: 40hz on January 21, 2011, 10:37 PM

Keypass and KeePassX

Very secure and totally local. I even get access to the source code.

I haven't tried KeePassX, but I've tried Keypass. I find Roboform to be way easier to use. Am I missing something? When I say easy, I'm referring to mainly its integration with browsers (FF, IE for me). It seems like all of these softwares are equally "easy" in their ability to store passwords and whatever confidential information. The key feature that makes or breaks it for me is the browser integration. Neither Keepassx or Keypass brag about their browser integration ability in their "features" list. If it was indeed a focus or strength of theirs, I'm almost certain it would have been very prominently displayed in their features list. No? That's why I continue to stick to RF despite the recent events.

Actually, last time I used Keypass, I found it rather klunky compared to RF. I understand that one is free and the other isn't. however, if they were both the same in that department, I have a feeling that nobody would even be debating roboform vs. kee/key, no? I may be wrong here, I admit I'm not that familiar with the others.

Josh · « **Reply #12 on:** January 21, 2011, 11:54 PM »

LastPass featured on betanews

40hz · « **Reply #13 on:** January 22, 2011, 01:06 AM »

Quote from: superboyac on January 21, 2011, 11:09 PM

Quote from: 40hz on January 21, 2011, 10:37 PM
Keypass and KeePassX

Very secure and totally local. I even get access to the source code.
I haven't tried KeePassX, but I've tried Keypass. I find Roboform to be way easier to use. Am I missing something?

Nope.

Quote

When I say easy, I'm referring to mainly its integration with browsers (FF, IE for me). It seems like all of these softwares are equally "easy" in their ability to store passwords and whatever confidential information. The key feature that makes or breaks it for me is the browser integration.

Bingo! It's the difference in the weight we assign to convenience and how we define it.

For me, being able to carry my password list on a USB key (and needing to open it and do a cut & paste to handle a particularly hellacious password) is a fair trade off.

Browser integration is less important to me because my PWL mostly contains network access codes and server administrative credentials. These passwords are very log (25+ chars) and truly random. Because of the length and complexity (and the number of them) they're impossible for me to memorize. And because the bulk of them are not for my own network assets, I don't dare store any of them on a repository I don't personally control.

For personal stuff I like Password Depot as suggested by fellow DCer BethUK in the Roboform thread. I could see using that to handle low security things like forums and website logins. I do memorize all my financial institution passwords however.

Guess I'm just a little more concerned about security (i.e. paranoid) than most people. (Must be my old hacker roots showing.

)

Oh well...

Perry Mowbray · « **Reply #14 on:** January 22, 2011, 04:20 AM »

I too am in the process of moving from RoboForm to LastPass. One reason I didn't even look at LP previously was I'd paid for RB and RB Portable.

LastPass has done nearly everything I used RoboForm for, though it does have a few issues with one or two websites. But in the main I'm more than happy with LastPass.

LastPass satisfied my security issues, so I'm happy.

Synchronising RoboForm data was always an issue for me... I had the Desktop and the USB version which needed to by sync'd (and with RoboForm cloud) but the free version of their sync software complained there were too many files. This made me very unhappy. There is of course no sync'ing problems with LastPass

I use KeyPass too, but not for my online password usage: more for other secure stuff I need to remember...

Stoic Joker · « **Reply #15 on:** January 22, 2011, 05:02 AM »

Only thing I use for Passwords is f0dder's fsekrit

It's small, it's portable, it's simple, it works.

CleverCat · « **Reply #16 on:** January 22, 2011, 06:55 AM »

For offline mode try LastPass Pocket - works with a saved encrypted database.

https://lastpass.com/misc_download.php

Deozaan · « **Reply #17 on:** January 22, 2011, 11:40 AM »

I started using LastPass when Gawker allowed my password to get leaked to the world.

It's a little troublesome with the UI, and an offline mode seems like it would be nice (thanks for that link CleverCat, I'll check it out!), but how are you going to login to a website when you're offline anyway?

Other than that I really like it and use it, and even recommend it to others when they ask about something like that.

EDIT: According to the description of LastPass Pocket, it appears as though all browser extension versions of LastPass support offline access to the database:

Quote

Provides backup capability and offline access for your LastPass vault. All extensions have full offline support. LastPass Portable is recommended over using LastPass Pocket.

(Emphasis added.)

Carol Haynes · « **Reply #18 on:** January 22, 2011, 11:54 AM »

LastPass seems a little odd after RoboForm but after a few days I really like it.

Some observations (sorry if they are obvious but I only noticed by accident):

First - the single button approach is neat and compact - but if like me you are used to the RoboForm tool bar you can go into the LastPass options and get a similar toolbar to show easily enough.

Second - my transfer from RoboForm to LastPass went very smoothly. However a few websites don't seem to get picked up LastPass. I think is is because it is stricter on the URLs recognised. If/when this sort of thing happened in RoboForm doing a search was laborious - but in LastPass ust click on the My LastPass link in the toolbar - your entire vault is opened in a new browser window (whether you are online or not) and simply start typing the website you need to find and voila it appears instantly. A little judicious tweaking of the fields fixes the problem permanently. I thought this was going to be a laborious process and timeconsuming but so far with thousands of logins it hasn't really proved a problem at all.

Third - I wanted my passwords on my computers - not just in the ether. That is precisely what I have with LastPass. If I disconnect from the internet I can still access all of my data (so things like notes etc. or access to passwords where my computer is not connected for some reason are still available).

All in all I am impressed with the free version of LastPass and I am considering paying the $12 subscription to have access on my Blackberry and also to store passwords for desktop apps.

allen · « **Reply #19 on:** January 22, 2011, 02:21 PM »

Quote from: Deozaan on January 22, 2011, 11:40 AM

but how are you going to login to a website when you're offline anyway?

Security isn't for websites-only. In my password manager I have stored credit card information, passwords for zip files, fsekret passwords . . .

cmpm · « **Reply #20 on:** January 22, 2011, 03:59 PM »

In LastPass dropdown menu from the button, you can just click
'save all entered data', and it will save site and data to auto fill later if you want to.
That's for sites that don't automatically ask to save or not, or any site really.

rgdot · « **Reply #21 on:** September 30, 2013, 09:38 PM »

(Yes I know there are more recent threads mentioning LastPass but the thread title got me here

)

I have always used KeePass (or my brain) but I think I need something across browsers and devices.

On a scale of 1 to 10 how comfortable is everybody with LastPass these days?

Deozaan · « **Reply #22 on:** September 30, 2013, 10:29 PM »

Since my last post in here (almost three years ago!) I've used LastPass very extensively and have even become a paid subscriber. It's not perfect, but I really like it and it works very well for my needs across all my devices (Windows PCs and Android phones/tablets). I'd highly recommend it.

Carol Haynes · « **Reply #23 on:** September 30, 2013, 10:38 PM »

Use it all the time across all of my devices Windows, Android and Blackberry. As Deozaan says, it isn't perfect but it works pretty well and I have subscribed.

x16wda · « **Reply #24 on:** September 30, 2013, 11:53 PM »

Same here, I'll third Dezoaan & Carol. The browser plugins all behave a little differently and I've had some issues with Firefox not dropping down the menu when I want it occasionally, but other than that no issues.