Password manager LastPass goes titsup: Users LOCKED OUT

[Ponting]

Popular password management service Last Pass went on the blink today, leaving users locked out of their accounts.

Reg reader Tim Stephenson, head of IT at Liftshare, told us that the firms employees had experienced timeouts trying to access the site, browser plugins werent responding and users couldnt authenticate themselves or access their credentials.

We started using LP for secure password management about a year back and have a number of systems that accept LP Single Sign On for convenience. Very, very annoying and currently LP seem to be saying nothing whatsoever to their users. Disappointing as a paid-for enterprise customer, he said in an email.

Customers also took to Twitter to complain about the service, with some claiming that the password-memory-bank had been down and out for over four hours.

Last Pass seemed to be ignoring repeated tweets about the problems earlier this morning, but finally issued a message on Twitter around 2.12pm BST, two hours after Stephenson first contacted El Reg.
Unhelpfully, both the LastPass support pages and status page online also appear to be down, leaving folks with very few ways to contact the company. ®

Update

Since the publication of this story, LastPass has been in touch to tell The Reg that the problems had been caused by one of its data centres going down at 8.57am BST this morning.

We immediately started taking action to migrate the service to run entirely on a different data centre - in the meantime, a percentage of our user base did experience connection errors with the LastPass service, spokesperson Amber Gott said in an email. We have been engaged with our provider the entire time and have been working with them to resolve the issues. We have done everything we can to minimise impact and are working to get the redundant data centre up as soon as possible.

Source: http://www.theregister.co.uk/2014/08/12/lastpass_outage/

[Ponting]

Update:

Now LastPass is working fine :d

[dcs18]

This is not the first, it happened - this is not the last time it happens,

Last time, glad I was on RoboForm - this time, glad I am still on RoboForm.

[AlexCross]

That's why I'm using a stick for my passwords ;)

[Ponting]

That's why I'm using a stick for my passwords ;)

Do you mean Sticky Password? :unsure:

[CODYQX4]

I thought something was screwing up my devices, what with all the privacy blocking, but I guess it isn't.

[axarad]

I'm a PasswordBox user and I'm very satisfied with it!

[AlexCross]

That's why I'm using a stick for my passwords ;)

Do you mean Sticky Password? :unsure:

Nope, USB stick ;)

[Ponting]

Nope, USB stick ;)

In plain text file,encrypted .xls file or how?

[AlexCross]

Nope, USB stick ;)

In plain text file,encrypted .xls file or how?

I worked in a bank and the IT guy gave me a sealed USB stick for this purpose, which i wear it in my keychain. The security of it is a SIM.

[totoymola]

Nope, USB stick ;)

In plain text file,encrypted .xls file or how?

KeePass or LastPass Pocket on a USB drive perhaps? Or maybe a YubiKey?

I'm a PasswordBox user and I'm very satisfied with it!

I have that too, but I think it has some serious issues.

1. No REAL desktop program, it is only a browser plugin
2. No way to EXPORT passwords
3. Importing passwords does not always work flawlessly. Sometimes it does not import ALL the accounts from the CSV.
4. It cannot detect if the account you are importing is already saved in your PasswordBox database.
5. No way to delete duplicate entries
6. No way to delete multiple accounts at once. So if you have 100 accounts that you have to delete, you will have to delete all those accounts individually, that would total to 300 mouse clicks.

[GRiM]

..meh Firefox built in manager plus big master password for me. Also use Mozbackup to make backups of entire FF profile (passworded).

[axarad]

Nope, USB stick ;)

In plain text file,encrypted .xls file or how?

KeePass or LastPass Pocket on a USB drive perhaps? Or maybe a YubiKey?

I'm a PasswordBox user and I'm very satisfied with it!

I have that too, but I think it has some serious issues.

1. No REAL desktop program, it is only a browser plugin
2. No way to EXPORT passwords
3. Importing passwords does not always work flawlessly. Sometimes it does not import ALL the accounts from the CSV.
4. It cannot detect if the account you are importing is already saved in your database.
5. No way to delete duplicate entries
6. No way to delete multiple accounts at once. So if you have 100 accounts that you have to delete, you will have to delete all those accounts individually, that would total to 300 mouse clicks.

That's unfortunately true :unsure:

[totoymola]

That's unfortunately true :unsure:

Oh, I forgot to mention that there is no way you can access your passwords online without installing their plugin. What if you just want to see your passwords and don't want to (or cannot) install any plugin?

I think those are serious issues and I am waiting for them to resolve those. But on the other hand, they are the first to offer the "legacy locker" feature, and now, the cardiac rhythm authentication. And I also like how fast it fills the passwords on webpages and how quickly it detects password fields.

I still use LastPass primarily, and I personally experienced the authentication trouble earlier today. But I am keeping my PasswordBox because I have an unlimited account, and I am really hoping they will do something about the flaws I mentioned.

[axarad]

That's unfortunately true :unsure:

Oh, I forgot to mention that there is no way you can access your passwords online without installing their plugin. What if you just want to see your passwords and don't want to (or cannot) install any plugin?

I think those are serious issues and I am waiting for them to resolve those. But on the other hand, they are the first to offer the "legacy locker" feature, and now, the cardiac rhythm authentication. And I also like how fast it fills the passwords on webpages and how quickly it detects password fields.

I still use LastPass primarily, and I personally experienced the authentication trouble earlier today. But I am keeping my PasswordBox because I have an unlimited account, and I am really hoping they will do something about the flaws I mentioned.

I have an unlimited account too :D

[AlexCross]

The main advantage of the PasswordBox being a plugin is that you don't have to worry about portability, basically you can plug in to any operation system, from Windows to Linux. I used to use it before, it's quite good. I also have unlimited account there.

[avmad]

I heard Lastpass was hacked again!

Just kidding :lol:

[FreeRyde]

RoboForm Everywhere free 1 year license

[Misaki2010]

I find PasswordBox to be much more useful than LastPass, they are also working on a Windows Phone app since they already released iOS and Android apps :) The best part is that, on desktop, the plugin is compatible even with Internet Explorer 11!

[Holmes]

What is the encryption like with passwordbox and what is the strength..

[smallhagrid]

Storing credentials at a 3rd party 'service' has always seemed highly undesirable to me - I'd rather keep mine to myself.

There was once a self-hosted app that I knew of which allowed stuff to be stored upon one's own hosting - but I lost track of that one and forgot to try it myself.

[totoymola]

What is the encryption like with passwordbox and what is the strength..

Local Encryption

We use AES-256 encryption, the strongest available, in addition to having all our code reviewed by external experts. We encrypt your passwords on your own computer or mobile device, so readable passwords are never sent over the Internet, not even to our own servers.

[CODYQX4]

Storing credentials at a 3rd party 'service' has always seemed highly undesirable to me - I'd rather keep mine to myself.

There was once a self-hosted app that I knew of which allowed stuff to be stored upon one's own hosting - but I lost track of that one and forgot to try it myself.

1Password can do this.

[shorty6100]

I'm sticking with Last Pass. I've used it for years and find it the best of all that I've tried (Roboform, Keepass, etc.)

[hpwamr]

Here Sticky Password 7 Desktop (Offline version + USB portability). :rolleyes: