In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being MITMed), what risks do I face by using the LastPass browser extension? I'm assuming that other than the certificate substitution, my connections are only eavesdropped on and that payloads aren't altered.
My current understanding is this: Lastpass client will send a hash of my master password to the lastpass servers. A valid hash will mean the server returns my encrypted password vault. The MITM can replay this hash to get my encrypted vault. Decryption of the vault happens in browser. As such my risks are:
- MITM gains the ability to capture my encrypted vault (either off the wire or by replaying my hashed password).
- MITM replaces my lastpass extension with a trojaned version during an update.
- MITM captures my credentials for other sites when I use them after retriving them from lastpass.
Is my understanding correct? Can I assume that (absent a trojaned extension) my vault as a whole and any credentials I don't use over the MITM connection are safe?