2

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that use used when logging in locally on e.g. a PC.

At LastPass How It Works it says:

Local-Only Decryption

All sensitive data is encrypted and decrypted locally before syncing with LastPass. Your key never leaves your device, and is never shared with LastPass. Your data stays accessible only to you.

But when I have given the "Master Password" up front when creating the account, it appears to me that the keys is actually shared with LastPass, so LastPass have the required password to decrypt my passwords.

The relevant part of the HTML form is show in this image:

enter image description here

And based on my understanding on HTML forms, that will send the "Master Password" to LastPass when the form is submitted.

Can anybody explain if I am wrong about this?

  • 1
    did you actually see the password be sent to the LastPass servers? – Jay Dec 16 '15 at 14:20
  • Please see my update with picture of the relevant HTML form code, which I would think will submit the "Master Password" to LastPass. – EquipDev Dec 16 '15 at 14:31
  • 2
    I think what @Jay ment was, do you have monitored your traffic and if so, can you there see that your local LasPass Masterpassword has been changed? To me this simply looks as if they named a control of their form 'masterpassword', but I might also be wrong ... – Sebastian Dec 16 '15 at 14:52
7

I took a look at their page and it would appear that the password is hashed before being sent on to their servers. They do this with JavaScript/jQuery:

// all validation tests passed - create account
$(createaccountbtn).addClass("btn_disabled");
g_username = username.value = username.value.toLowerCase().replace(/\s*/g, "");
g_fixpbkdf2 = 1;
g_local_key = make_lp_key_iterations( username.value, mpw.value, iterations.value );
document.getElementById("hash").value = make_lp_hash_iterations( g_local_key, mpw.value, iterations.value );
mpw.value=document.getElementById("reenterpassword").value="********";

if(typeof(saveKey)!="undefined") saveKey(); 

var postData = $( lpform ).serializeArray();
var url = $( lpform ).attr("action");

So, if you want some simple end tests: either watch the packets sent with a packet sniffer & you'll see only a hash sent, or disable JavaScript in your browser, and the form submission should fail.

It's essential to look at the included JavaScript of a page when considering form submission, since it's the only way to hash or encrypt values on the client side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.