When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites.

How does it know? Are these hard-coded into LastPass, or is there some markup or HTTP header or something on Live.com that specifies its credentials can be shared with other domains?

  • when you go to microsoft.com (as of Aug 31 2015) the "sign in" link at the top right takes you to a sign in page that has a URL beginning with "login.live.com" Is this what you see? if not please confirm that the URL of the sign in page is something other than login.live.com
    – Owen
    Aug 31, 2015 at 16:46
  • This is a vendor-support question, not an InfoSec question.
    – schroeder
    Aug 31, 2015 at 17:16
  • @schroeder: Whether a question is "vendor support" or not shouldn't depend on the answer. The answer here happens to be "they hard-coded it," but I had no way of knowing that without knowing the answer. It could very easily have been an HTML or HTTP feature I wasn't aware of. Aug 31, 2015 at 18:38
  • Either way, there is no InfoSec impact. If it was HTML or HTTP, then the question should be asked on another site, like SuperUser, or such.
    – schroeder
    Aug 31, 2015 at 18:57

1 Answer 1


Lastpass uses a preconfigured and extensible set of site aliases to make two or more domains equivalent.

Here is a snapshot from my account settings page. YMMV.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.