PasswordManager
Latest
You need a password manager -- right now
Who loves dealing with passwords? No one. Password managers help by saving all your passwords in one, secure place. Let's break down how they work and the best password manager apps available now.
Collection 1 data breach covers more than 772 million email addresses
If you're signed up for one of the many services that alerts you to data breaches when they're discovered (if you're not, you probably should be) then you likely have an email waiting for you. Troy Hunt runs Have I Been Pwned where he makes it his business to dig up these files as they're being passed around by hackers, and has alerted the world to "Collection #1," which claims to combine usernames and passwords from thousands of databases.
Mozilla tests a password manager for Firefox on iOS
Test Pilot for Firefox is a program that allows users who have downloaded stable build browsers to try out experimental features without having to take the risks of using a beta version. Today, the team at Mozilla announced that Test Pilot is now coming to mobile, and there are two new features that users can try out.
LastPass rolls out Android Oreo autofill to the public
No need to sign up for LastPass beta anymore if Android Oreo has already made it to your device. The password manager has started rolling out autofill to the stable app for Google's latest mobile platform, according to the company's director of engineering, Anatoly Ivasyuk. If you've already been testing for LastPass, though, take note that you won't be able to uninstall the beta version of the app yet.
Apple's iOS 11.3 may use iCloud as a single sign-on for websites
You might not to log in to your favorite websites one at a time in the near future. The 9to5Mac team has found code in the iOS 11.3 beta hinting at a single sign-on option for the web based on your iCloud account. It's not certain just how it would work, but you would be giving sites permission to access "personal iCloud data" (possibly your name and email address) in return for the convenience. It wouldn't be a password manager, then -- you'd be handing your Apple ID to the sites in question and avoiding much of the login process.
Windows 10 included password manager with huge security hole
There's a good reason why security analysts get nervous about bundled third-party software: it can introduce vulnerabilities that the companies can't control. And Microsoft, unfortunately, has learned that the hard way. Google researcher Tavis Ormandy discovered that a Windows 10 image came bundled with a third-party password manager, Keeper, which came with a glaring browser plugin flaw -- a malicious website could steal passwords. Ormandy's copy was an MSDN image meant for developers, but Reddit users noted that they received the vulnerable copy of Keeper after clean reinstalls of regular copies and even a brand new laptop.
LastPass Premium now costs twice as much
LastPass announced a restructuring of its plan pricing and packaging today and the cost of its premium tier is doubling to $24 per year. Some features are also being taken away from the free plan. Those include unlimited sharing and emergency access, both of which are now only available to LastPass Premium and Families subscribers.
LastPass Families can manage passwords for a household of six
It's hard enough keeping track of your own passwords, let alone your family's. Unless you plan on outfitting your brood with biometric rings, your best bet is to sign up to a password managing tool. That way you can keep track of the logins your clan is racking up, and even reference them to create unique passwords in the future. Most popular services, such as 1Password, already offer family plans. And soon that small list will include LastPass too.
The war for the soul of the password
Obviously, whoever invented the password system was a jerk. And whoever started adding all those little rules for password creation is a sadist. Not the kind of sex-positive sadist with a flag for their kink and a set of consensual negotiation rules that ensure password creation is hot for everyone involved. No, we're talking about the kind of sadist that simply likes watching people suffer as they're told to add special characters, but not dollar signs or exclamation points because... reasons.
Critical security flaws found in LastPass on Chrome, Firefox (updated)
Last year Google Project Zero researcher Tavis Ormandy quickly found some "obvious" security problems in the popular password manager LastPass, and now he's done it again. Last week Ormandy mentioned finding an exploit in one version of its extension for Firefox, before following that up with a new bug that affected both Chrome and Firefox, and finally a third vulnerability that could allow "stealing passwords for any domain."
The best password managers
By Joe Kissell This post was done in partnership with The Wirecutter, a buyer's guide to the best technology. When readers choose to buy The Wirecutter's independently chosen editorial picks, it may earn affiliate commissions that support its work. Read the full article here. If you're not using a password manager, start now. As we wrote in Password Managers Are for Everyone—Including You, a password manager makes you less vulnerable online by generating strong random passwords, syncing them securely across your browsers and devices so they're easily accessible everywhere, and filling them in automatically when needed. After 15 hours of research and testing, we believe that LastPass is the best password manager for most people. It has all the essential features plus some handy extras, it works with virtually any browser on any device, and most of its features are free.
LastPass is now free across all your devices
Password manager and two-factor authenticator app LastPass has always had a quirky pricing scheme. While it was free on mobile, syncing all your passwords and logins across devices -- one of the key features of a password manager -- required a subscription to use. Starting today, however, multiple-device access to LastPass is completely free.
Google wants to standardize Android password managers
Security is more important than ever, but people still don't love typing passwords into phones. As such, Google is teaming with Dashlane and other password managers on the "Open YOLO" (You Only Login Once) project. The idea is to create an API that lets Android developers access password managers so that you can log into apps automatically with no typing or insecure autofill. Dashlane is spearheading the venture in cooperation with other password managers, though it hasn't said which are involved.
LastPass is the first password manager extension on Edge
Microsoft is getting closer to releasing its big Windows 10 update this summer, but Windows Insider beta testers with the latest build have a new element to try out today. That's because LastPass has officially released its first browser extension for Edge (after it leaked out temporarily a week ago), saying it's the first password manager extension on the platform. Support for extensions is necessary if Edge will try to snag users from the Chrome or Firefox browsers they're used to, and after AdBlock, password management is a big one.
Password app developer overlooks security hole to preserve ads
Think it's bad when companies take their time fixing security vulnerabilities? Imagine what happens when they avoid fixing those holes in the name of a little cash. KeePass 2 developer Dominik Reichl has declined to patch a flaw in the password manager's update check as the "indirect costs" of the upgrade (which would encrypt web traffic) are too high -- namely, it'd lose ad revenue. Yes, the implication is that profit is more important than protecting users.
LastPass is now free on mobile, but cross-device syncing costs extra
If you've been wanting to play around with LastPass on your mobile device without paying the $12 annual fee for premium support, today is your day: the password manager just added mobile to its free tier. What's the catch? You only get it on mobile. Starting today, LastPass users will get unlimited use of the password manager on desktops or smartphones or tablets -- but if you want to sync passwords between your devices, you'll have to pony up for a subscription.
Time to change your master password, LastPass was hacked
Password-management service LastPass announced today that it "discovered and blocked suspicious activity" on its network on Friday. While the company says that there is no evidence that user vault data (a user's stored passwords) was taken or that accounts were accessed, it did acknowledge that user email addresses, authentication hashes, password reminders and server per user salts were compromised. LastPass is confident that its encryption is strong enough to make attacking those stolen hashes with any speed difficult. But yeah, if you're a LastPass customer you should change your password. Even though LastPass recommends you change your password if you have a weak master password or use that password on multiple sites, you really should change your master password -- and switch on multifactor authentication -- just in case.
1Password for Android can now be your only account manager
For the longest time, AgileBits' 1Password for Android was just a pale shadow of its desktop and iOS counterparts. Besides the ancient interface, you couldn't add anything -- if you signed up for a service, you had to turn on another device just to put the new account behind 1Password's secure walls. As of today, though, the app has caught up. The redesigned 1Password 4 for Android has both a modern interface and true independence; you can add passwords, credit cards and other sensitive info without touching any other hardware. Data syncs like it does on other platforms (including to folders, if you dislike the cloud), and there's a built-in browser if you want to log in as quickly as possible.
LastPass for Android can now fill your app logins in for you
You may know LastPass, the cross-platform password manager, as a safe haven for website login details and common form info. Now, as well as playing nice with Chrome for mobile devices, the latest version of LastPass for Android can fill in app login data for you, too. Once it's updated and you've authorized this new feature, loading up an app with a username / password prompt will trigger a pop-up with suggested login credentials you can choose to inject. Chances are, however, you'll need to tell LastPass which of the logins stored in your vault the mobile app wants -- you can also share your selection if you'd like to help it learn common associations. Because apps are often mobile portals for services you'd load up inside a browser on your computer, it makes sense. Then again, we can't say we sign in and out of apps enough to justify $12 per year for the premium service LastPass' mobile apps require.
Apple unveils Keychain for iCloud, confirms 300 million iCloud accounts
Apple today at WWDC announced some changes to iCloud, including a new iWork for iCloud and a keychain feature that'll sync your logins across all your iOS devices. The keychain is a cloud-connected password manager that ties into Safari on the desktop and Safari on the iPad and iPhone. It'll save passwords as well as credit card information and more. Tim Cook also confirmed that iCloud now has 300 million accounts, making it the fastest-growing cloud service ever (even faster than Facebook). More than 300 million iOS owners use iTunes in the cloud and these folks have downloaded their content 35 billion times. Cook also confirmed that 240 million users are on Game Center and blew us away with stats on iMessages that confirm the service has transferred 800 billion iMessages and sent 740 trillion push notifications.
