Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially curious about Lastpass.

They write on their homepage:

LastPass is an evolved Host Proof hosted solution, which avoids the stated weakness of vulnerability to XSS as long as you're using the add-on. LastPass strongly believes in using local encryption, and locally created one way salted hashes to provide you with the best of both worlds for your sensitive information: Complete security, while still providing online accessibility and syncing capabilities. We've accomplished this by using 256-bit AES implemented in C++ and JavaScript (for the website) and exclusively encrypting and decrypting on your local PC. No one at LastPass can ever access your sensitive data. We've taken every step we can think of to ensure your security and privacy.

How can I be sure that the bolded part is true? Is the method they describe capable of actually doing what they promise, can it prevent them from accessing my passwords? And how could I verify that they're actually doing what they're promising and not transmitting my password in any form they can access to their servers?

share|improve this question
2  
Ultimately one can't which is why I would recommend alternatives like keepass2, where you control the files and the keys, though for this to work one does need a file server of some kind (dropbox and similar work here). It's all about how much you trust lastpass. One could decompile the code and check the encryption routines etc, however any kind of code analysis is not 100% secure. –  ewanm89 Jun 8 '12 at 11:33
    
Just a comment; 256-bit AES implemented in C++ -- this an amusing phrase, but technically true, I suppose, since their website is powered by PHP which compiles into C++ binaries... but still, I won't fully trust LastPass as an authority on security until they receive some outside accreditation and/or prove themselves against the test of time. –  Matt Jun 8 '12 at 16:41
3  
@Matt - They published the code they used to encrypt your information on their website. If Steve Gibson trusts LastPass I trust LastPass because Steve Gibson has proven to be somebody I trust. –  Ramhound Jun 8 '12 at 17:42
    
@Ramhound Cool, didn't know that; thanks. Googling more now... –  Matt Jun 8 '12 at 17:46
3  
@Ramhound Don't be overconfident in Steve Gibson, or in some of the stuff he peddles. See e.g. Errata: Steve Gibson –  nealmcb Jun 10 '12 at 1:28
show 1 more comment

3 Answers 3

There is a way to see if LastPass is doing what they're saying.

Use the Non-binary Chrome, Firefox, Opera, or Safari extension. This is 100% JavaScript and open in the sense that you can see it -- you can use network sniffing with a proxy (e.g. Paros) to see that the sensitive data is encrypted with AES-256-CBC from data generated from a key created with the number of rounds of PBKDF2-SHA256 you have setup on your account: http://helpdesk.lastpass.com/security-options/password-iterations-pbkdf2/ and this is done locally on your machine only.

Then simply don't update/upgrade your extension until you want to audit it again. You could also audit the way we interact with the binary extension to decide if you trust that.

That's a bit extreme for most people, but a number of people and organizations have audited LastPass and liked what they found. LastPass is always helpful to anyone wishing to audit, feel free to contact us if you'd like help.

LastPass knows that it's perfectly reasonable to trust but verify, and encourage you to do so. There's a reason we tell people to utilize the extensions rather than the website: the extensions can't change as easily as the website could thus making them more secure.

Source: I work for LastPass.

share|improve this answer
1  
+1. I'm impressed with your company's response last May: blog.lastpass.com/2011/05/lastpass-security-notification.html –  Matt Jun 8 '12 at 23:36
    
This answer is not satisfactory, IMHO. The question was about proofs, but your answer requires the user to trust your words. Most users can’t or won’t do security audits themselves. You need to provide a reference to some published audit from a company or person we trust. (Similar complaint here: forums.lastpass.com/…) –  Olivier Cailloux Apr 21 at 2:23
add comment

The only way you can verify it is to look at the code they're sending you every single time you access your passwords. In other words, you can't. However, if they ever sent malicious code to anyone, there's a risk that person would notice, and all it would take is one person presenting that malicious code and everyone would know about it.

share|improve this answer
2  
Actually, the code doesn't get resent every time you access the passwords. Only when you update the browser-addons. –  mniess Aug 15 '12 at 13:25
add comment

Even if you trust a company, you can not fully trust the product/service they provide. A vulnerability in it may be discovered/exploited or the company itself may be compromised. Anytime you make your passwords potentially accessible to a party, consider it known by that party. In the case of the normal registration/login process of a website, you are dealing with people who don't actually value your password as they do not need it. As soon as a third party is involved, this assurance is now out the window.

If you must, use a local password safe like KeePass2 and store to removable media that you control.

Also if a company uses a phrase like "complete security", know that they are already trying to trick you.

share|improve this answer
    
This is true for Keepass as well. There could be an exploite discovered in the Keepass software, it being open source and local doesn't make it immune from potential security bugs. However Lastpass having so many people's password means it is much higher profile target. –  James McMahon Jan 7 '13 at 21:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.