I feel like atleast one of these has been hacked at some point in the past, but I cant remember which.
It was LastPass, but the passwords themselves weren’t leaked. All of these encrypt the password.
the passwords themselves weren’t leaked
You're not wrong, but you kinda are. The plaintext passwords weren't released, but the encrypted blobs were stolen. Unfortunately, the LastPass defaults were absolutely shit so people have been able to selectively attack the blobs and decrypt the vaults, leading to millions in crypto being stolen.
I was a long time supporter of LastPass, but they haven't been responsible stewards of sensitive information. The fact that they failed to encourage or force existing customers to update the encryption settings as they updated their defaults is negligent and is disqualifying in my opinion.
There is no excuse for LastPass and it absolutely should not be treated with your passwords or secrets.
Security Now is amazing. For anyone that wants the deep dive tech perspective, plus what it means for everyday people and users, this is a great option.
Ah, alright, thanks. Thats a good thing then, that you cant get to the passwords even if you hack the company.
KeePass doesn't store your stuff in the cloud; it's all local storage. You can sync your encrypted KeePass DB in a number of different ways; personally, I go for SyncThing, but you can use Box or whatever.
I feel like atleast one of these has been hacked at some point in the past, but I cant remember which.
It was LastPass, but the passwords themselves weren’t leaked. All of these encrypt the password.
You're not wrong, but you kinda are. The plaintext passwords weren't released, but the encrypted blobs were stolen. Unfortunately, the LastPass defaults were absolutely shit so people have been able to selectively attack the blobs and decrypt the vaults, leading to millions in crypto being stolen.
I was a long time supporter of LastPass, but they haven't been responsible stewards of sensitive information. The fact that they failed to encourage or force existing customers to update the encryption settings as they updated their defaults is negligent and is disqualifying in my opinion.
There is no excuse for LastPass and it absolutely should not be treated with your passwords or secrets.
This is an interesting and a bit terrifying podcast about it (and other things), from a infosec perspective. https://twit.tv/shows/security-now/episodes/905?autostart=false
Security Now is amazing. For anyone that wants the deep dive tech perspective, plus what it means for everyday people and users, this is a great option.
Ah, alright, thanks. Thats a good thing then, that you cant get to the passwords even if you hack the company.
Lastpass had lots of issues.
KeePass doesn't store your stuff in the cloud; it's all local storage. You can sync your encrypted KeePass DB in a number of different ways; personally, I go for SyncThing, but you can use Box or whatever.