When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that use used when logging in locally on e.g. a PC.
At LastPass How It Works it says:
Local-Only Decryption
All sensitive data is encrypted and decrypted locally before syncing with LastPass. Your key never leaves your device, and is never shared with LastPass. Your data stays accessible only to you.
But when I have given the "Master Password" up front when creating the account, it appears to me that the keys is actually shared with LastPass, so LastPass have the required password to decrypt my passwords.
The relevant part of the HTML form is show in this image:
And based on my understanding on HTML forms, that will send the "Master Password" to LastPass when the form is submitted.
Can anybody explain if I am wrong about this?