Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to find details on the application architecture of the Lastpass browser app for Firefox and Chrome. All that seems to be out there is this security analysis: http://www.grc.com/sn/sn-256.htm

In particular I want to understand how Lastpass persists after your close the browser and you are not using the automatic log-off setting. Is it running as a daemon listening on a TCP port? Is it safe to let it stay in the background? I can completely shutdown my computer and start it back up, and when Lastpass starts it is unlocked and I don't need to enter my master password. This suggests to me that a malicious application on my system could access the unlocked password store.

share|improve this question

2 Answers 2

Check out the LastPass FAQ for info. Data stored locally is in various locations based on operating system and browser.

Chrome/Firefox don't have a daemons, nothing should be running in the background.

Location

The data is located in the following places, depending on your operating system and browser(s):

 Windows Vista/7 Internet Explorer, Firefox: %AppData%\..\LocalLow\LastPass\
 Windows Vista/7 Google Chrome: %LocalAppData%\Google\Chrome\User Data\Default\databases\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0\
 Windows Vista/7 Safari: %LocalAppData%\Apple Computer\Safari\Databases\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0\
 Windows Vista/7 Opera: %LocalAppData%\Opera\Opera\widgets\wuid-*\pstorage\*\*\
 Windows XP Internet Explorer, Firefox: %AppData%\..\Local Settings\Application Data\LastPass\
 Windows XP Google Chrome: %AppData%\..\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0\
 Windows XP Safari: %AppData%\..\Local Settings\Application Data\Apple Computer\Safari\Databases\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0\
 Windows XP Opera: %AppData%\..\Local Settings\Application Data\Opera\Opera\widgets\wuid-*\pstorage\*\*\

 Mac OS X Safari: ~/Library/Safari/Databases/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0/
 Mac OS X Firefox: ~/Library/Application Support/LastPass/
 Mac OS X Google Chrome: ~/Library/Application Support/Google/Chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0/
 Mac OS X Opera: ~/Library/Application Support/Opera/widgets/wuid-*/pstorage/*/*/

 Linux Firefox: ~/.lastpass/
 Linux Google Chrome: ~/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0/
 Linux Opera: ~/.opera/widgets/wuid-*/pstorage/*/*/

Firefox on other platforms utilizes the Firefox profile directory.

 Android: /data/data/com.lastpass.lpandroid/ by default, or /sdcard/lastpass/ if memory card is chosen.

Local Security

You can back these directories up and they will contain the latest copy of your data. Be aware that on Windows, Protected Storage is used to additionally encrypt your data so you'll need to ensure that your Windows profile is also backed up. Your data is also backed up at LastPass.com, and a copy is on any other device or computer you use so this isn't required,

Your data is also securely synced with the LastPass servers. When you make updates to your LastPass account, whether in a browser plugin, a mobile app, or the website, the updates are reflected on the LastPass servers as well.

If your hard drive ever crashes, or your laptop is stolen, you can easily regain access to your accounts by reinstalling the plugin (https://lastpass.com/download.php) and logging in with the same email and master password.

share|improve this answer
    
So on a machine without Windows Protected Storage this is stored unencrypted? Seems like a security vulnerability. –  tukushan Sep 14 '12 at 21:13

I happen to listen to this podcast a while ago but hoping this might help. Steve is a very talented in security space and he shares some great insights on LastPass as well as Skype.

Notes from the podcast: http://www.grc.com/sn/sn-256.pdf

Podcast page: http://www.grc.com/securitynow.htm - It's episode 256.

share|improve this answer
2  
Welcome to IT Security! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Sep 14 '12 at 14:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.