I am not a big fan of cloud services, and this is before Amazon, Sony and LastPass issues. The work that I do needs 99.9999% or better availability, at least as far as internet connectivity. That's a little over 5 minutes of downtime per year. Systems need very close to 100% uptime.
I have been piloting LastPass for about a month, with pretty good success (our legacy PW manager is Roboform). It's a great product and a good little company. I know it's little since one of their top people emailed me a response to an inquiry within an hour. I hope the company doesn't end up getting a huge black eye because of this, as they are a good little company with huge upside potential.
Cloud based services have their limitations, so you always need a backup or contingency plan. And they are not the cure-all for data center problems.
Image courtesy Flickr user bobu.
For the last several hours, I’ve been watching LastPass melt down and talking with many of its panicking users. It has not been pretty.
Here’s what’s going on. LastPass is a password aggregator, that, by all accounts, is a best-of-breed product.
See also: Five Windows tools to keep your digital life in sync
LastPass bills itself as the last password you’ll ever need, and they do this by storing all your passwords in a highly encrypted format, and then using a single, master password to give you access to all your sites. All you need to do is remember one password, but all your sites can have unique, complex passwords.
Of course, the possible point of failure is that one, master password.
Last night, the operators of LastPass noticed some anomalous behavior in their systems. Their concern is that a hacker had somehow penetrated their system and exfiltrated master passwords.
So, today, they told users to change their master passwords. All heck ensued.
First, the company didn’t email each user. Instead, it posted a blog entry. This infuriated many users.
Next, LastPass decided to force all users to change their master passwords. The database of ancillary passwords is encrypted based on a “salt” from the master password, so changing the master password changes the encryption for all the other — a very smart move.
Unfortunately, the LastPass site and the company’s various password management tools apparently can’t handle the load of millions of users trying to change passwords all at once.
Some users are locked out, and can’t change their passwords. Some users are locked out after having changed their passwords. Some users changed their passwords and are now being told their passwords are invalid.
