6

So today I switched from Lastpass (chrome extension and iOS app) to bitwarden. So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is how LastPass knew I used the same passphrase with bitwarden !

Let's say my lastpass passphrase was "CorrectHorseBatteryStaple" and I used the same password on bitwarden (both same email), I after then received a lastpass notification (just after creating my bitwarden account) informing me that my passphrase was used on bitwarden and in case of a breach coming from bitwarden they can't do anything...

How could they know that I used the same passphrase, and are my passwords safe or should I change them all (I already changed my passphrase) ?

Improve this question
6
  • It would be impossible for LastPass to know that you used the same password on Bitwarden. LastPass does not store user passwords and as such couldn't check to compare them with Bitwarden. Could you provide more details on the exact message given in the email?
    – Harrison G
    Feb 19, 2021 at 0:33
  • 2
    @HarrisonG of course Lastpass stores user passwords. How else is it supposed to log you into sites?
    – Conor Mancone
    Feb 19, 2021 at 0:54
  • 2
    Did you login to bitwarden on a browser that was also logged in to lastpass?
    – Conor Mancone
    Feb 19, 2021 at 0:55
  • @Conor Mancone I perhaps should be more specific. I do not believe password managers store your master password in the cloud. You are correct that they store user passwords.
    – Harrison G
    Feb 19, 2021 at 0:57
  • @ConorMancone exactly, yes.
    – L. Faros
    Feb 19, 2021 at 12:37

1 Answer 1

Reset to default
5

This is locally verified by the Lastpass extension so that you don't reuse password manager's master password itself somewhere else. Password managers use credential management API to capture credentials from the webpage.

To derive an encryption key from master password, Lastpass feeds master password into PBKDF2 with 100,100 iterations of SHA-256. One more iteration (that is 100,101) gives login hash for the Lastpass web service.

For every credential that it captures, it feeds entered password to the same key derivation function. After 100,101 iterations, if it produces the same hash as the login hash, that means you have reused the master password. It works locally and also at offline.

Why did my LastPass extension just warn me that I was reusing my Master Password elsewhere?

Improve this answer
4
  • The number of iterations used by PBKDF2 is configurable - it isn't hard-coded to any particular number, so I don't think that mentioning a number of rounds is helpful (or accurate) here
    – Conor Mancone
    Feb 19, 2021 at 9:57
  • @Conor Mancone By default, the number of password iterations that LastPass uses is 100,100 rounds.
    – defalt
    Feb 19, 2021 at 12:32
  • If Lastpass changes their default, are you going to update your answer?
    – Conor Mancone
    Feb 19, 2021 at 18:02
  • The number is just for the reference. I don't have words to replace it so feel free to edit.
    – defalt
    Feb 20, 2021 at 6:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .