I was wondering how the concept of shared folders work with Lastpass. As I understand from their site, Lastpass has a master password, which acts as the encryption key (say MK) for all data stored in Lastpass. However this key is only available on the client side. In addition the users can generate their own key pair (PKI). What is the relationship between the MK and the PKI? When a folder is shared by a user, I am wondering how the recipient would be able to decrypt the data that is being shared as the MK is not available for the recipient. Any thoughts?


From https://lastpass.com/support.php?cmd=showfaq&id=2456:

Every LastPass user generates a public/private key pair once (client side). The public key is sent to the server, the private key is encrypted (with their standard local encryption key) and sent to the server. Roles and shared folders are implemented a little different, but they both follow the same general model -- When you want to share data with someone else, you pull their public key and use that to encrypt the data. The other person is the only one that can decrypt it (using their private key). All this ensures that users can securely access the information stored in Shared Folders.

  • So if I understand the above statement, a copy of the folder is made for the recipient user and is then encrypted with the recipient users key. So if the original folder changes then these copies would have to be synchronized again. – mithrandir Nov 5 '13 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.