5

LastPass is good for storing and using username-password pairs for websites.

Some websites (such as for banks) have more complicated login procedures which don't fit the standard LastPass system.

For these websites, more information must be stored, such as security questions, multiple passwords and grids of characters.

LastPass has a Secure Notes feature, which allows such data to be stored.

Google Keep also allows such data to be stored. I find Google Keep quicker and easier to use and would prefer to use it if there was no security disadvantage.

  • I stay logged in to LastPass all the time in Chrome, as I do to my Google account.

  • I have 2FA enabled on both my LastPass and Google accounts and have a strong password for both.

  • I have an Android phone which requires fingerprint or pattern login. Once logged in, Keep can be opened without further authentication while LastPass requires further fingerprint or password login. This is the only advantage I can see that LastPass has - Keep can be accessed with just the pattern whereas LastPass requires my finger or its password.

Is there a security reason to use LastPass Secure Notes rather than Google Keep?

P.S. I think that a pattern login is less secure than a password login. Please give me reasons other than this.

Improve this question
5
  • There are some pretty significant problems with pattern lock including ease of shoulder-surfing and small keyspace. See security.stackexchange.com/questions/49265/… And fingerprint unlock has an additional set of problems. So even without discussing the other disadvantages of Keep, the additional authentication required to access LastPass on Android is a very useful security mechanism on pattern locked phones.
    – Owen
    Oct 13, 2017 at 17:01
  • What are the other disadvantages of Keep?
    – cja
    Oct 13, 2017 at 17:07
  • @Owen "LastPass requires further fingerprint or password login" sounds like that would only matter if they found the phone already unlocked. If they know the password or can replicate the fingerprint once they can probably do it twice.
    – AndrolGenhald
    Oct 13, 2017 at 18:31
  • If it is like the iOS version, fingerprint unlocking is optional. Also, LastPass can be set to require re-confirmation of passcodes for certain tasks or entries.
    – Julian Knight
    Oct 15, 2017 at 22:02
  • If you keep LP open, you will never trigger 2FA. Better to have a timeout. Of course, on a mobile, your 2FA is also likely to be on the same mobile!
    – Julian Knight
    Oct 15, 2017 at 22:04

1 Answer 1

Reset to default
5

LastPass encrypts everything locally on your PC and only sends the encrypted blob to the LastPass servers. Even if someone hacks into LastPass's servers, your data is safe, even your "secure notes" data.

That's not the case for Google Keep. If they manage to get access to Google's servers, presumably they will have access to anything you've stored in Keep.

This also means it would be harder for a disgruntled employee to leak your data, or a government/criminal organization from forcing/bribing/blackmailing someone into doing the same.

Additionally, I assume (perhaps wrongly) that secure notes can be obscured by default, whereas Google Keep leaves everything wide open for shoulder surfing. I'd rather "reveal" one security question at a time for a few seconds rather than have all of them for every site displayed on my monitor or phone for anyone to see.

I'm actually a little surprised LastPass doesn't integrate well with security questions and the like. Other password managers can store these and auto-fill them like passwords. I only know about KeePass (which takes a significant amount of setup to allow this) but I'd guess many of the managers offering form-filler features would allow this as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .