In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being MITMed), what risks do I face by using the LastPass browser extension? I'm assuming that other than the certificate substitution, my connections are only eavesdropped on and that payloads aren't altered.

My current understanding is this: Lastpass client will send a hash of my master password to the lastpass servers. A valid hash will mean the server returns my encrypted password vault. The MITM can replay this hash to get my encrypted vault. Decryption of the vault happens in browser. As such my risks are:

  • MITM gains the ability to capture my encrypted vault (either off the wire or by replaying my hashed password).
  • MITM replaces my lastpass extension with a trojaned version during an update.
  • MITM captures my credentials for other sites when I use them after retriving them from lastpass.

Is my understanding correct? Can I assume that (absent a trojaned extension) my vault as a whole and any credentials I don't use over the MITM connection are safe?

  • I will let someone else answer this. But to mitigate similar attacks you can use multi factor authentication using a token based app. this protects against password capture.
    Commented Jul 24, 2017 at 5:06

1 Answer 1


If an adversary is able to issue arbitrary certificates your browser trusts, then everything you do in the browser can potentially be compromised. On the three points above:

  • If the vault blob is encrypted properly, it should be useless without the master key known only to you. They could use other techniques to intrude though, such as seeing if the file size has changed and correlate that with your web activity to infer that you created new credentials for a site. If they also control your e-mail system, then they may be able to use password reset techniques to enter those accounts.
  • If your browser trusts that CA to sign code, then you should probably not be using the browser for trusted tasks like password management in extensions. The most powerful change they could introduce in the "trojaned" update is to simply transmit your master password to a location they control, and they will have everything. Consider using a non-browser-integrated password management solution if you are concerned.
  • This particular MitM can view the credentials for everysite you authenticate with, LastPass or not, since they are (typically) transmitted as a simple text field over HTTP within the TLS session or a cookie in the HTTP header.

If they are not interested in breaking into the LastPass extension, then they have as much access to your actual database file as LastPass themselves. The bigger problem is them able to snoop passwords you enter for all sites right now. Additionally, any cookies used to automatically authenticate you to sites are also visible and can be used to gain access to those sites.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .