this post was submitted on 07 Sep 2023

979 points (99.0% liked)

Technology

technology@lemmy.world

87,054 readers

15,412 active

4,040 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user (www.theverge.com)

submitted 2 years ago by L4s@lemmy.world [M, B] to c/technology@lemmy.world

185 comments fedilink hide all child comments

More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists

you are viewing a single comment's thread
view the rest of the comments

[–] iHUNTcriminals@lemm.ee 52 points 2 years ago (2 children)

Selfhosted for extra win!?

parent

hideshow 4 child comments

[–] OberonSwanson@sh.itjust.works 18 points 2 years ago (4 children)

Any recommendations on how-to?

parent

hideshow 8 child comments

[–] treadful@lemmy.zip 34 points 2 years ago (1 child)

KeepassXC (desktop)/KeePassDX(mobile) on top of something like Syncthing or Nextcloud.

parent

hideshow 2 child comments

[–] OberonSwanson@sh.itjust.works 3 points 2 years ago (1 child)

Thanks for the suggestion, I’ll try checking out both options. Unfortunately, I have an iPhone, so sadly there’s no KeepassDX. 🤔

parent

hideshow 2 child comments

[–] treadful@lemmy.zip 3 points 2 years ago

I think there's probably a Keepass compatible iPhone app out there but I haven't vetted it. Worth looking for though.

parent

[–] hobbit@lemm.ee 27 points 2 years ago* (1 child)

Vaultwarden is what I use: https://github.com/dani-garcia/vaultwarden/

Their wiki is pretty good assuming you're comfortable with Docker.

Back before I self-hosted, KeePassXC for desktop and Keepass2Android for mobile (along with Synching to sync the database) got the job done.

parent

hideshow 2 child comments

[–] OberonSwanson@sh.itjust.works 4 points 2 years ago (1 child)

Interesting, I’ll check it out, as it looks like it’ll cover what I need. Hopefully it’s simple enough, as always having an iPhone makes things more complicated lol.

parent

hideshow 2 child comments

[–] hobbit@lemm.ee 3 points 2 years ago

I host for my family which has a mix of Android and iPhone. So far, no complaints about Bitwarden on iOS. Hopefully it works out for you. If self hosting becomes a problem, I think premium is only $10/year and family is up to 6 people at $40/year.

parent

[–] Potatos_are_not_friends@lemmy.world 11 points 2 years ago (1 child)

It doesn't have to be difficult.

Download keepass to your computer.
Keep the save file on a USB or private cloud backup.
Done!

As you get more comfortable with it, you'll start using it in more complex ways. Like having a phone app, connected to a self hosted network. But keep it simple for now.

parent

hideshow 2 child comments

[–] OberonSwanson@sh.itjust.works 3 points 2 years ago

This might be a good idea for my family, they definitely prefer a K.I.S.S. approach lol.

parent

[–] whileloop@lemmy.world 6 points 2 years ago* (2 children)

If you wanna use KeePass, you just have to store your database in some secure location. It can be on your local drive or in the cloud, any location you trust really.

parent

hideshow 4 child comments

[–] OberonSwanson@sh.itjust.works 4 points 2 years ago

Guessing it’s suggested to use a small flash drive and keep it hidden somewhere?

parent

[–] Nighed@sffa.community 3 points 2 years ago

You can set the encryption strength though, so I guess you could set it high and could even have it untrusted.

Mine takes a while to open on my phone because of that

parent

[–] Ado@lemmy.world 4 points 2 years ago (1 child)

Self-hosted with yubikey 2fa. Even Santa Claus can't see my info 😎

parent

hideshow 2 child comments

[–] iHUNTcriminals@lemm.ee 1 point 2 years ago (2 children)

I should get around to doing this... But it scares me haha.

parent

hideshow 4 child comments

[–] Ado@lemmy.world 3 points 2 years ago

I started out with the Yubikey, which was such a relief all by itself. Even if you have my password, you need my physical USB key to plug in or NFC confirm for the 2fa. I did later move to self-hosting, but I def have a backup of a backup for that since space is cheap-ish.

parent

[–] olympicyes@lemmy.world 2 points 2 years ago

Not sure about that software specifically but most yubikey 2FA implementations allow you to set up more than one key. That way you don’t lose access if you lose your key. I personally have three keys.

parent