12

I'm trying to find details on the application architecture of the Lastpass browser app for Firefox and Chrome. All that seems to be out there is this security analysis: http://www.grc.com/sn/sn-256.htm

In particular I want to understand how Lastpass persists after your close the browser and you are not using the automatic log-off setting. Is it running as a daemon listening on a TCP port? Is it safe to let it stay in the background? I can completely shutdown my computer and start it back up, and when Lastpass starts it is unlocked and I don't need to enter my master password. This suggests to me that a malicious application on my system could access the unlocked password store.

5

Check out the LastPass FAQ for info. Data stored locally is in various locations based on operating system and browser.

Chrome/Firefox don't have a daemons, nothing should be running in the background.

Location

The data is located in the following places, depending on your operating system and browser(s):

 Windows Vista/7 Internet Explorer, Firefox: %AppData%\..\LocalLow\LastPass\
 Windows Vista/7 Google Chrome: %LocalAppData%\Google\Chrome\User Data\Default\databases\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0\
 Windows Vista/7 Safari: %LocalAppData%\Apple Computer\Safari\Databases\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0\
 Windows Vista/7 Opera: %LocalAppData%\Opera\Opera\widgets\wuid-*\pstorage\*\*\
 Windows XP Internet Explorer, Firefox: %AppData%\..\Local Settings\Application Data\LastPass\
 Windows XP Google Chrome: %AppData%\..\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0\
 Windows XP Safari: %AppData%\..\Local Settings\Application Data\Apple Computer\Safari\Databases\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0\
 Windows XP Opera: %AppData%\..\Local Settings\Application Data\Opera\Opera\widgets\wuid-*\pstorage\*\*\

 Mac OS X Safari: ~/Library/Safari/Databases/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0/
 Mac OS X Firefox: ~/Library/Application Support/LastPass/
 Mac OS X Google Chrome: ~/Library/Application Support/Google/Chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0/
 Mac OS X Opera: ~/Library/Application Support/Opera/widgets/wuid-*/pstorage/*/*/

 Linux Firefox: ~/.lastpass/
 Linux Google Chrome: ~/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0/
 Linux Opera: ~/.opera/widgets/wuid-*/pstorage/*/*/

Firefox on other platforms utilizes the Firefox profile directory.

 Android: /data/data/com.lastpass.lpandroid/ by default, or /sdcard/lastpass/ if memory card is chosen.

Local Security

You can back these directories up and they will contain the latest copy of your data. Be aware that on Windows, Protected Storage is used to additionally encrypt your data so you'll need to ensure that your Windows profile is also backed up. Your data is also backed up at LastPass.com, and a copy is on any other device or computer you use so this isn't required,

Your data is also securely synced with the LastPass servers. When you make updates to your LastPass account, whether in a browser plugin, a mobile app, or the website, the updates are reflected on the LastPass servers as well.

If your hard drive ever crashes, or your laptop is stolen, you can easily regain access to your accounts by reinstalling the plugin (https://lastpass.com/download.php) and logging in with the same email and master password.

  • So on a machine without Windows Protected Storage this is stored unencrypted? Seems like a security vulnerability. – tekumara Sep 14 '12 at 21:13
  • @tukushan: I've encrypted my LastPass settings folder using EFS for extra protection. – SilverlightFox Oct 22 '14 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.