LastPass vs. Xmarks: Password Synchronization

Since Xmarks announced that they were being bought by LastPass, I decided to give LastPass another try.  In the past week I have done so.  Here are my thoughts.

LastPass Vault

Last time I tried the LastPass Firefox extension, I was put off by the requirement to log in every time I started the browser.  Subsequently, I've taken a different posture with regard to the security of my sensitive data on computers, and in particular on laptops.  I have now taken the tack that sensitive data needs to remain secure, even if a data thief has access to the hard drive.  As such, I started using KeePass to store my non-web passwords (whereas before I kept them in a plain text file), I created a TrueCrypt vault in my Dropbox folder in which I keep tax records and other sensitive documents, and I have started encrypting the passwords stored in the browser.

Initially, this meant that I had to swallow the enter-a-password-whenever-you-start-the-browser pill.  I didn't like this, but I adjusted my behavior to minimize instead of close the browser, and I used suspend or hibernate whenever possible instead of shutting down.

Well, with LastPass, you don't need to keep your browser running in order to stay logged in.  They have a desktop app which stores your logged-in state at the OS level, and communicates with all of your browsers.  That means you sign in once in Firefox, and you're automatically signed in in Chrome.  If (for some unknown reason) you are compelled to use MSIE for something and you're logged in there too.  (LastPass also supports Safari and Opera, but I don't currently use those.)

This scores major points with me in the trade-off between security and convenience!

LastPass Menu

Since I'm comparing LastPass to Xmarks, I should mention the basics.  Both services are ways of synchronizing your passwords between all of your web browsers on each of your computers.  Both services encrypt your data on your computer before transmitting it to their servers.  Xmarks uses your browser's built-in bookmarks database (which can be encrypted with a password or not), while LastPass uses its own encrypted vault to store the passwords.

The premise behind LastPass is that the password that encrypts your data could be "The Last Password You'll Have to Remember!"  If you only need to remember one password, then it can be a strong password, with different character types and such.

They certainly do go a long way towards making it possible to not type in (or even know) your passwords for any website.  LastPass can (optionally) create strong passwords for you that it will auto-fill and auto-login when you visit the appropriate site.  They have excellent browser support across all the major platforms, including smartphones, which brings us to their business model: LastPass is a freemium service.  They give you basic functionality for free, and when you're ready to be a power user, you can pay for the next level of service.  In the case of LastPass, this next level comes in the form of their smartphone apps, which, as I am not a premium member, and do not have a smartphone, are beyond the scope of this review.  I did, as promised, pay for Xmarks Premium, however.

Bookmarklets

So what happens when you can't install the LastPass extension?  As it happens, I'm not allowed to install the LastPass extension on my work computer.  That's OK though, because LastPass has some very excellent bookmarklets that allow you to fill in login information, form data, or simply log you in (as in automatically fill login information and submit).
A bookmarklet is a piece of Javascript that is stored in a bookmark.  You drag a link to your bookmarks bar or right-click to add it.  LastPass creates bookmarklets especially for your account (probably because it's more secure that way), so you'll need to log in to get them.  Instructions are here.

Anyway, at work, I stuck the "LastPass Login!" bookmarklet in my bookmarks toolbar, logged in to LastPass, and viola!  Instant access to my passwords.  (Okay, I had to add lastpass.com to my third party cookies whitelist, but that isn't necessary unless you block third party cookies.)  You can't add login information or form data to the LastPass vault with the bookmarklets, but you can do that with the website.

LastPass behaves much like your browser's normal password saving feature.  When it detects something it can do, a bar will pop down from the top of the browser until you take an action or dismiss it.  LastPass puts its logo inside form and password fields that it wants to interact with.  You can also access the LastPass menu from a button installed in your toolbar.

If you choose to save some information, you are presented with more options:

Saving a site's login information with LastPass

More things that LastPass can do:

Stored Mint.com password

•  Store and fill shipping and contact information, credit card data, or any other specific form on the web.  After installing the plugin, LastPass had collected much of this information from saved form fields (not credit card numbers though, obviously).
• Store passwords and other form data for sites that normally prevent your browser from storing the information.  One such site that blocks normal password saving is Mint.com.
• Import passwords from browsers and just about anywhere they're stored (including KeePass).  It will export to Firefox if you decide to stop using it.
• Store, retrieve, and print secure notes - something that might come in handy should the need arise.
• Share selected passwords with another user - this is useful if I want to be able to log in to Google and Facebook on my wife's computer and we each have separate accounts (or if we share access to a credit card account and the credentials change).  If I update the password in my LastPass account, the correct password shows up in hers as well.

LastPass confused by a Facebook form

LastPass isn't perfect, but it's pretty good, and I've decided to use it going forward.  One drawback of Xmarks' password syncing was that if you had more than one saved password with the same user ID (or no user ID) for a site, Xmarks would refuse to sync your passwords until you had either deleted one of the passwords or created separate profiles for each of the passwords.  One reason you might have two passwords with no username is on sites such as live.com, which save your username, but don't create an auto-filled form field for it and ask you to just re-enter your password.  LastPass handles this situation by giving you the option to select which credentials you want to use from a drop-down menu, or using keyboard shortcuts.

No More Xmarks: Now What?

Update: Xmarks is not dead after all.  Crisis averted.  Yay!  I'm keeping the post as-is below both for historical reasons and because it's still good information.

Xmarks just announced that they are closing up shop because they can't find a sustainable way to make money.  Earlier, I did a post on this blog comparing Xmarks and Firefox Sync.  It appears that now the option has been taken away from us.

What I ended up doing between the two services was using Firefox Sync for keeping everything in sync between my Firefox installations (bookmarks, passwords, etc.), but using Xmarks to keep bookmarks non-Firefox browsers synced, and also to share a few bookmarks folders.

As noted on the Xmarks shutdown page, there isn't a good replacement for inter-browser sync out there.  The closest I can think of is Delicious, but that site is built around sharing, not synchronization.

On the other hand, Delicious does an excellent job sharing bookmarks.  Since I was only really sharing one folder on the web with Xmarks, I installed the Delicious add-on for Firefox and imported that folder's bookmarks.  I made them public and gave them a unique tag, so that they could be shared as a collection. 

I've used Delicious for a while, mostly to collect links that I consider share-worthy.  I did this using the bookmarklet.  For a while, I was importing them into Facebook.  This appears not to be working anymore.

The Delicious add-on didn't work in Firefox 4 beta (which is what I'm running on my laptop).  I installed it, and (after banishing the toolbar and other annoying features) attempted to "import" the folder in question according to this guide.  It simply didn't work.  Literally nothing happened.  The "Import to Delicious" button was in black text on a mostly black toolbar at the top of the window, so they clearly haven't started integrating with Firefox 4.

I still have Firefox 3.6 installed, so I loaded it up, selected the folder, and clicked the button.  Nothing appeared to happen, but this time the bookmarks were uploaded.  Annoyingly, the "imported" column still shows nothing for those bookmarks, but at least it worked.  Well, sort of.  It didn't upload any of the tags I have assigned to the bookmarks locally to the cloud.  It just tagged them "imported".  Maybe this is expected behavior.  If so, there should be an option to upload the tags as well. 

Clearly, I'm not going to be using the Delicious extension for a while, but I don't know that I'll ever use it to keep all of my bookmarks in sync.  Delicious wants you to adopt their system of organization and interaction, and I'm not ready to do that.

At this point without Xmarks, I'm without a good solution to the following problems:

• Cross-browser syncing - Google will sync Chrome; Firefox Sync will sync Firefox; Windows Live Mesh will sync MSIE; but only Xmarks syncs between all three.Bookmarks profiles - Some bookmarks only need to be on certain computers.  Profiles allow you to selectively unsync the ones you don't need on computer A and B, while still keeping them on computers C and D.
• Bookmarks history - Xmarks allowed you to restore bookmarks from any point in your account history.  This came in very handy when I deleted more than I thought I had while cleaning up and only found out about it months later.
• Bookmarks sharing - Yeah, Delicious will let me share collections of bookmarks, but, at least currently, it's a pain to do so.  I've disabled the Delicious add-on.  I intend to keep the list up-to-date, but I will have to do so on the Delicious website, not from my bookmarks collection in the browser, and the two versions of the list will become out of sync.  The Delicious bookmarks also aren't sorted, and there's no way to store an introduction to them: the tag is just a tag, and contains no meta-data.
• Bookmarks favicons - It seems nit-picky, but it's a huge inconvenience if you re-install operating systems a lot.  Hopefully, the Firefox Sync developers will solve this one.  It's most annoying for toolbar bookmarks, because for me those are icon-only.  With Xmarks, all favicons are synced along with the bookmarks.  When you first sync with Firefox Sync, the toolbar icons all look the same.  In order to get the favicons to load, you have to visit each link.
• Bookmarks browsing from non-synced machines - I don't sync my bookmarks at work.  I can't access my bookmarks from other people's browser installations with Firefox Sync.  Xmarks gives me access to all of my bookmarks on the web, and I can even make changes and re-organize using the web interface.

My letter to Groupon after creating an account

Dear Groupon,

I like what you do.  Thanks for being there and doing it.

I signed up in order to take advantage of a recent deal.  In my e-mail inbox, there was a welcome message with the following: "Every morning, you'll find one exclusive deal waiting in your inbox. We can't wait to help you discover huge discounts on all the cool things to do in your city."

Wait, what!?!  No.  No no no no no no.  Nowhere in the account-creation process did I knowingly authorize you to send these deals to my e-mail address, much less every single day.  That's a horrible default behavior, and if I let companies do that my inbox would become an impenetrable pile of junk.

Now, I realize that many people who sign up aren't familiar with RSS readers, or Twitter, or other, more organized methods of receiving periodical offers. E-mail is fine for those people.  It is NOT fine for me.  My inbox is precious.  No offense.

Now relax.  I do know that I can unsubscribe from your e-mails, and I have done so using the link provided in the fine print of the aforementioned e-mail.  What upsets me is that I needed to do this.  I thought surely there would be a setting in the "My Account" preferences to easily manage this.  Nope.  Surely it's in the FAQ?  Alas, no.  Sticky forum post?  Apparently not.

In fact, unsubscribing using the legally-mandated link in the e-mail was the very last thing I tried, because I shouldn't have to do it from there.

Maybe I made a mistake, and I simply missed the checkbox in the sign-up process.  If that's the case, then the checkbox needs to be bigger, and other options, such as RSS, Facebook, and Twitter need to be offered.  More to the point, you need to start thinking of your business as more than a mailing list. 

Violating my trust by signing me up for a mailing list is not the best way to begin a customer relationship.  Please, rethink your account sign-up process and default behavior.  The "How Groupon Works" page made me think I would get to choose how I would be notified of new deals.

Meanwhile, keep offering those great local deals.  I look forward to an increasingly net-savvy Groupon.

Phishing? Probably not, but still...

If you got this e-mail, what would you do?

I hadn't made any changes to my account.  The e-mail headers looked legitimate.

Notice: Changes have been made to your Qwest^® customer profile.

Our records show you recently made these change(s) to your customer profile, either by contacting a Qwest representative, or through your MyAccount page at qwest.com.
Email Address Changes
*The e-mail address you provided for us to reach you.
For Qwest account ending in:####
At Qwest, we value the security of our customers’ information and are sending this notice as a confirmation. As long as this change was made intentionally, no action is necessary. However, if you feel this change has been made in error, please contact Qwest immediately at 1 866-450-6152(Residential) or 1 800-603-600(Small Business).
Thank you for helping us maintain the security of your account.

The first thing to do, of course, is to make sure that the account number matches up.  My Qwest account has been inactive for almost a year, so I didn't have that readily available.  I entered the phone number provided in quotes into Google.  Others had gotten this same e-mail, and they hadn't made changes to their account either.

I certainly wasn't going to call the number and give whoever it was I was actually calling any information so they could "pull up my account".

I pulled up the Qwest website, called the customer service number listed there, and told them about the e-mail, and how suspicious it looked.  The guy was unable to pull up my account because it wasn't active.  He said he would pass my concerns on to his supervisors.

Nickels, Dimes, and Two Dollar Bills

Today I spoke with an AT&T customer service representative about my bill.

On June 30th I had 24KB of data usage in a single instance.  The purpose of this usage was to test my data connection at the request of an AT&T customer service representative who was restoring data service to my phone.  Data had stopped working after I had requested that data be disabled on my parents' numbers.  I had not asked for them to do the same for my number.  I don't use "data" per se, but I do upload Multimedia Messages, which are charged to my Messaging plan along with SMS Text messages, but MMS rely on the phone's data capability.  My parents and wife don't use Multimedia Messaging, and had become annoyed at the few cents charged every time they hit the wrong button.  Getting rid of those charges was the motivation for blocking data on Elizabeth's and my parents accounts, especially since Shoshana had taken to mashing buttons on Elizabeth's phone.

When I got the bill, I called to see what the $2.00 charge was for.  I had previously been on a $0.01/KB pay-per-use plan, but since that plan was no longer available when they added it back, I was now being charged $2.00/MB.

I had begrudgingly come to accept the few cents that I was charged almost every month when I accidentally hit a button or menu item that launched a web service.  These buttons and menu items are, naturally, featured prominently everywhere on the phone.  It's difficult to avoid them. 

But this $2.00 for-the-first-byte thing crossed the line.  This, I would not tolerate.

I called.  I was told that my options were to block data on my phone or just pay the charges:  the plan I was on before was no longer available.  I told them that was ridiculous.  I had not asked them to change the plan.  They had changed the plan by mistake.  I would not pay for their mistake.  I would most certainly not pay month after month.

They told me it was impossible to enter the old code into their system.  I laughed and told them that they were wrong.  Perhaps they did not have the right permissions to do it, but it could be done.

I asked for a supervisor.  They gave me a higher-ranking customer service agent who told me that they would refund the $2.00 as a one-time courtesy, but in the future I would either need a data plan or pay the charges.

I asked for a real supervisor.  They told me they would probably say the same thing, but ok.  I waited on hold for a while.  The supervisor came on and told me that she could have a case written, and they would get back to me.  She warned that if I did that, she couldn't have the $2.00 charge removed as a courtesy.  I told her that it didn't scare me.  She also warned me that I couln't appeal whatever they decided.  I laughed and said I didn't believe her, but just to put it through.

They said I would hear from them by the afternoon of July 30th.