TL;DR: Last Pass is broken. All passwords at the time of the breach were taken. They also got internal secrets from a laptop and can now probably throw computational power at anything they want to decrypt.

Switch. Do not use. Change everything you have if you were using it. Treat everything as breached.

  • edge [he/him]
    ·
    2 years ago

    You need to be able to access randomly generated passwords (which all your passwords should be) from any device. Password managers lose a lot of usefulness if they aren't online.

    • tagen
      ·
      edit-2
      1 year ago

      deleted by creator

      • edge [he/him]
        ·
        2 years ago

        No? All your passwords absolutely should be randomly generated and unique per website, something you can't keep track of on your own. The solution is a password manager that syncs to all your devices.

    • darkcalling [comrade/them,she/her]
      ·
      2 years ago

      What you do is use one that has locally encrypted/decrypted databases and authentication and store the database as an encrypted file in a cloud storage service. The service itself therefore no longer matters, only keeping your master password safe matters and the file online is useless without your master password. The service therefore never holds even so much as keys for your database and it is impossible without compromising your end devices to access your passwords.

      • edge [he/him]
        ·
        2 years ago

        That's the same as a password manager but much less convenient. Password managers don't store keys in their database, your master password is the key.