Ask HN: How (un)secure are the passwords saved at my browser?
Lastpass is zero-knowledge but subject to any number of attacks on the client. As the old adage goes: If you can&#x27;t attack the crypto, attack the client! My personal setup is an always updated version of KeePass. I gave up using 1Password when I realized the loopback is cleartexted when autofilling passwords, and a host of other vulns like the .opvault format not used as the default, and too many other vulns to count. The master password is also a single point of failure and once you get that, you get everything. A chain is only as strong as its weakest link and all that. With KeePass even if they have the master password, they also need a second key &#x2F; keyfile, and a machine ID so a copy of the KDBX file is useless to an attacker (unless they can emulate your machine UUID).<p>You can read more about that 1pass vuln here: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11212002" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11212002</a>