6

If LastPass does not store your master password, then how can you login to use their web app?

Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and then compared with what in their DB, like any other login scheme on the web.

2 Answers 2

5

No, The LastPass website does not normally know your login credentials.

On their website, they supply JavaScript code to do in-browser decryption. So, yes, we still need to trust LastPass that this code is implemented correctly, but the password isn't sent to their servers.

Note: Trusting lasspass means that we need to trust them not to give you a non-standard version of their website javascript for certain special IP addresses at the behest of the NSA if they use a National Security Letter.

Resources:

1
  • thanks! didnt see all of this lastpass documentation! ill read through it.
    – tau
    Apr 10, 2014 at 1:26
4

Also see How safe are password managers like LastPass?.

I had concerns about its security integrity and the fact that your passwords are saved on servers that are located in the USA. Even though they only store encrypted data, LastPass is obliged to give this data to the USA government when requested (due to the PATRIOT Act).

Since I realized this, I moved to KeePass Password Safe, an offline password manager with protection against keyloggers.

3
  • i use keepass too; its awesome and much simpler than lastpass.
    – tau
    Apr 11, 2014 at 17:02
  • 1
    +1 for recommending KeePass. I have been using it for more than a year now and it is a brilliant piece of software. Not to mention its OSI certified and peer reviewed by many cryptanalysts and security experts alike. And all this is free. Mar 25, 2015 at 23:41
  • Couldn't agree more! Mar 26, 2015 at 10:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .