Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I think LastPass is a great consumer product because it allows users to conveniently utilize unique strong passwords for each site they use it with. It does encryption locally, but the fact that I can set it up on one computer/device and then use it on another computer/device seems to indicate that there must be some security trade-off for its consumer-friendliness. For example, the salt element of the password derivation algorithm presumably must reside on their server rather than on my own computer/device. Is my understanding correct? (Pardon me if anything I've said is uninformed, I'm not a cryptographer).

share|improve this question
add comment

3 Answers

If you're looking to compare a cloud service like LastPass to a local application such as KeePass, then yes, there is a security tradeoff.

With an application such as KeePass, where you have full control over the storage of your password database (presuming you're not putting it up on DropBox or something), the only attack surface you have to worry about is your own system and the devices on which your password database is stored. Generally speaking, these are not likely to be subject to targeted attacks (or, as the media likes to call them, APTs). As long as you follow regular security best practices on your system (apply software updates, use antivirus, keep a properly configured firewall and/or router between you and the Internet, etc.), your password database is probably safe from Internet-based threats.

Note that I am not comparing local threats (involving physical access) here, because this is something that affects both options pretty much equally - you must have a local copy of your password database somewhere in order to use it, so you will be equally vulnerable to physical threats regardless of whether you use a cloud-based or local-only solution. That is not to say these systems are especially weak against local threats - protecting the database with a strong password and encryption algorithm largely mitigates this - but that one is not likely to be much better than the other in such scenarios.

In the case of LastPass and other cloud-based password managers, the attack surfaces and associated threats are much larger. Their systems are always on, and are very high-profile and high-value targets. If someone ever totally pwns LastPass, there's no telling what sort of systems they might find access to. While I'm sure they take their site security very seriously, they are likely subject to just as many attacks as any of the other user-trusted services that have been hacked recently. As the saying goes, it's not a question of if they will be hacked - just a matter of when. On top of that, you still have to worry about the security of your own system(s) which synchronize with LastPass.

Are LastPass or other clould-based solutions a tradeoff of security for usability, compared to locally-managed options such as KeePass? Absolutely. Is it worth it? That's for you to decide.


EDIT: To clarify on the issue of what is stored on LastPass' server...

They don't just store data for hashing/salting your master password on their server. Though that is an important, key piece of information to be worried about, the real concern should be that they need to store everything that you want synchronized between your devices on their systems. That is, if someone ever does hack LastPass and cracks your master password from their database, they will be able to access all passwords and other details that you have synchronizing between your devices without ever having to actually touch your own devices.

With a locally stored database, like KeePass uses, you don't have to worry so much about such attacks. That is not to say it would be impossible for someone to break into your KeePass database over the Internet. It's just much less likely they will be trying to, and it is a much easier threat for you to mitigate yourself. (Besides, if an attacker across the Internet can crack open your KeePass database - and you use the same system to log into the things for which the database holds passwords - you're probably pwned enough already that it wouldn't matter anyway.)

share|improve this answer
    
Thanks. How about the specific security issue I asked about? –  Dan Aug 24 '12 at 16:44
    
@Dan I'm not sure what part of your question is left unanswered. Could you clarify? –  Iszi Aug 24 '12 at 17:40
    
Sorry, I guess you did in fact answer, my mistake. Thank you kindly. :) –  Dan Aug 24 '12 at 17:49
add comment

Using LastPass across multiple devices doesn't necessarily make it weaker, although you do not have access to some two-factor authentication methods with some devices. For example, I can't (easily) use my yubikey with my phone. However, there are some countermeasures that help, such as the ability to restrict login only from certain mobile devices or trusted computers.

As for salts, they state that they use a 256-bit salt on the server as well as client-side salts that are stored locally, although they don't clearly state how those are synchronized across devices. Most likely each device has it's own local salt. This could easily be verified as the client side code is all visible in javascript.

Furthermore, as for PBKDF2, they perform a number of rounds locally (using PBKDF2 and SHA256) before sending the hash to the server, where more rounds are performed on the server side. You could argue that the process of splitting this up could make the encryption stronger than local-only solutions. In other words, if someone compromised either your local database or their master database, there would be elements of the hash (for example, the salt or the derived hash of the password) that would not be available. In the case of a server compromise, they would not know the salts or the number of rounds used to create the SHA256 hash sent to the server.

share|improve this answer
    
Looking in to this a bit more, it appears that the client-side salt is actually SHA256(username+password). Here is a page that reveals quite a bit about how the client-side encryption works: lastpass.com/js/enc.php –  Mark Burnett Aug 25 '12 at 0:49
add comment

Against a one-time compromise of their database, LastPass is safer than losers like LinkedIn because they use an appropriate password hash (PBKDF2). This means each password attempt has a certain cost in CPU time, e.g. 1 second on a certain CPU. (They actually let you tune this cost yourself). It would then take roughly 5 CPU-days to guess a 20-character "fully random english" passphrase... and 1.5 CPU-years to guess a 30-character one.

If I understand their system correctly, a persistent compromise of LastPass would be no worse. Which is nice.

Source: http://helpdesk.lastpass.com/security-options/password-iterations-pbkdf2/

If the alternative is to use the same password across a large number of sites, in order to have a hope of remembering it, then LastPass is much better. At least one of those sites will be as clueless as LinkedIn or Blizzard, and can be expected to leak the password at some point.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.