The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially curious about Lastpass.
They write on their homepage:
How can I be sure that the bolded part is true? Is the method they describe capable of actually doing what they promise, can it prevent them from accessing my passwords? And how could I verify that they're actually doing what they're promising and not transmitting my password in any form they can access to their servers?
256-bit AES implemented in C++-- this an amusing phrase, but technically true, I suppose, since their website is powered by PHP which compiles into C++ binaries... but still, I won't fully trust LastPass as an authority on security until they receive some outside accreditation and/or prove themselves against the test of time.