Questions tagged [lastpass]
A freemium password management service which seeks to resolve the password fatigue problem by centralising user password management in the cloud.
64
questions
1
vote
0
answers
25
views
How could the contents of multiple LastPass vaults be compromised?
According to this newly published article:
Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies.
...
Nick Bax, director of analytics at ...
0
votes
0
answers
49
views
LastPass hack - risk for federated accounts on 100,100 PBKDF2 iterations
I'm trying to get a reasonable understanding of the possibility that our vaults could be brute forced in a viable timeframe.
We have LastPass federated to Azure AD. Skimming through https://assets....
- 1
4
votes
2
answers
202
views
LastPass - Can MFA stop hackers from cracking a local vault?
After the recent LastPass security incidents (where old backup copies of users' encrypted vaults have leaked), I was wondering if an account had MFA configured at the time, it makes a difference for ...
- 141
4
votes
1
answer
915
views
What is the math behind iterations in PBKDF2-SHA256 for lastpass users?
I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica.
Lastpass has admitted ...
- 143
0
votes
1
answer
88
views
Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)
Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
- 415
0
votes
2
answers
250
views
Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?
I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
6
votes
1
answer
375
views
How does LastPass know that I used the same passphrase with another service?
So today I switched from Lastpass (chrome extension and iOS app) to bitwarden.
So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is ...
- 163
5
votes
1
answer
962
views
Relative security of 'offline' vs 'online' password managers
I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
- 51
1
vote
2
answers
352
views
Are password managers still effective on a cloud PC (virtual machine)?
I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
- 162
3
votes
1
answer
155
views
Is it safe to share a LastPass master account?
I just found out my company started using LastPass Enterprise for service accounts. (databases and web applications that our whole team needs access to) I immediately switched my team over to it ...
- 33
0
votes
1
answer
149
views
iPad stolen with LastPass, Should I be worried?
Unfortunately my iPad was recently stolen and I had LastPass installed on it. Both the iPad and the app are protected with TouchID and passcodes. However, LastPass keeps an encrypted offline cache of ...
- 101
8
votes
1
answer
7k
views
LastPass installer scary message about sideloading
I've been using LastPass for years, generally through the original Chrome extension.
In recent months, certain features of the extension have been totally broken, such as the ability to share ...
- 315
2
votes
0
answers
522
views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
2
votes
1
answer
831
views
How can you discover a password shared via LastPass?
I'm trying to set up a personal accountant with access to some of my financial accounts. I would like to use LastPass sharing to give them access to the accounts without giving them access to a ...
1
vote
1
answer
196
views
Lastpass - Can I use my old master password to decrypt local data?
I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
- 11
-2
votes
2
answers
473
views
What are most dangerous vulnerabilities of users of password management? [closed]
Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how?
Basically, I sort of know the typical vulnerabilities ...
- 121
1
vote
1
answer
1k
views
iOS 12 built in password manager vs third party apps like Keepass
On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
- 25
11
votes
4
answers
2k
views
Why should we prevent users from saving their passwords in their password manager?
I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account.
I noticed ...
- 1,254
17
votes
2
answers
5k
views
is LastPass SMS Recovery a security risk?
According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords.
LastPass encrypts your Vault before it goes to the server using
256-bit AES encryption. Since the ...
- 295
1
vote
1
answer
607
views
How to brute force Last Pass local storage extension? [closed]
I need to brute force Last Pass since I forgot my master password.
Anyone know how is the format of the local storage of the extension?
I was logged into it so it must have local data.
I see words....
- 111
2
votes
1
answer
1k
views
How does LastPass decrypt passwords?
I am a web developer, not a security expert, but I know a little bit about security because I need it as a web developer.
According to LastPass,
LastPass encrypts your Vault before it goes to the ...
2
votes
1
answer
2k
views
How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]
I wish to evaluate two different password security options which at first seem to be distinctly different:
a cloud-based password manager
a local (non-cloud) password manager
However, the twist is ...
- 340
8
votes
1
answer
341
views
How does Lastpass decrypt my mobile vault after restart with just the fingerprint?
So my vault (on mobile device) is encrypted with my Master Password. Without the Master Password, the decryption cannot happen.
There is an option to enable Fingerprint Authentication on the mobile ...
- 183
5
votes
1
answer
21k
views
Is Google Keep more secure than LastPass Secure Notes?
LastPass is good for storing and using username-password pairs for websites.
Some websites (such as for banks) have more complicated login procedures which don't fit the standard LastPass system.
...
- 1,619
2
votes
3
answers
191
views
LastPass - maintaining security on foreign devices
So I've recently started using LastPass to generate and store secure passwords for me (previously, I was using the same password for every service). I am in the process of changing all my passwords to ...
- 121
7
votes
3
answers
640
views
Is storing my LastPass password in LastPass a security risk?
While categorizing my accounts in LastPass, I had a dumb thought cross my mind.
Can I store my LastPass password in LastPass?
Initially I thought this would be a completely pointless thought ...
- 1,535
0
votes
1
answer
352
views
Is my authentication strategy secured?
I want to implement an authentication system by following good practices, i want it as simple as possible and secured (im not going to implement some magic hashing function or something to feel a hero....
- 11
2
votes
1
answer
745
views
How secure is lastpass if TLS is MITMed?
In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being ...
- 121
5
votes
3
answers
772
views
Is there a password manager that combines a "master password" solution with a keystore solution?
There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools.
The general idea is that a function hash("my_master_password", "...
- 153
5
votes
2
answers
704
views
LastPass vulnerability: Should LastPass users change all their passwords?
Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
- 6,864
8
votes
1
answer
1k
views
LastPass's use of client-side Salt
The LastPass Team states the following in their FAQ:
Do you use a salted hash for logging in?
Yes, we first do a 'salt' of your LastPass password with your username on the client side (on
...
- 201
2
votes
2
answers
638
views
Is LastPass' Formfill inherently compromised?
Is there any sort of documentation to verify that the user info inputted with automatic formfill on "Secure forms" is protected from theft by a keylogger or trojan collecting clipboard data?
I ask ...
- 43
1
vote
1
answer
170
views
Know LastPass fishing apps? Ways to protect?
I am a LastPass user, which I use with the browser extensions.
Lately it occurred to me that it should not be too hard to create a fishing browser extension that
would replace LastPass upon install,...
- 13
1
vote
0
answers
350
views
LastPass Secure Notes Leak? - Is Spell Check and Typing Telemetry of LP Secure Notes a Significant Leak in Windows 10 Edge Extension
LastPass is the first and only password manager extension for Windows 10 Edge in the Microsoft Store (Fall 2016). The LP Secure Notes appears to use the standard Msft spelling engine and dictionaries. ...
- 219
1
vote
1
answer
4k
views
Why LastPass logs me out periodically? [closed]
I'm using LastPass password manager extension in Google Chrome. I have to input your MASTER password (LastPass's password) to login and get all the functionality of the manager such as autofill ...
- 163
1
vote
0
answers
187
views
Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?
A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites.
Now, there are some people who are obsessive about not leaving it out to a ...
- 381
1
vote
1
answer
155
views
Erasing Lastpass Preminum from mobile phone [duplicate]
This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap.
I use Lastpass Premium to to store all my passwords,...
- 119
5
votes
1
answer
572
views
How does the security of a GPG2 hybrid-encrypted file compare to a LastPass vault?
While discussing LastPass, a colleague told me about
trousseau, a GPG-based method
of sharing key-value stores between developers on shared sites/cloud
drives/etc. How do the two compare in terms of ...
- 153
1
vote
1
answer
381
views
Can LastPass local password store (on a Android device) be brute forced in a usual way?
I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device.
...
- 113
2
votes
1
answer
361
views
What is the benefit of using lastpass authenticator on android compared to other similar applications?
Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
- 243
0
votes
1
answer
290
views
Inadvertent clickjacking on page causes LastPass login dialog to appear.
I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit).
Today I found that viewing a certain page with "...
- 6,864
14
votes
2
answers
10k
views
Is LastPass secure enough? [closed]
They said:
Private Master Password:
The user’s master password, and the keys used to encrypt and decrypt
user data, are never sent to LastPass’ servers, and are never
accessible by LastPass.
...
- 259
0
votes
1
answer
138
views
Why does LastPass give me one password without needing my MFA key?
I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (...
- 1,455
3
votes
1
answer
2k
views
How does the "emergency access" feature of LastPass work?
How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods.
How can I be sure that LastPass is not keeping a copy of my master-...
- 171
3
votes
2
answers
5k
views
How many characters should a password be? [duplicate]
I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
- 47
4
votes
2
answers
1k
views
Why does LastPass store password hashes on the server at all?
While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
- 1,132
4
votes
1
answer
520
views
LastPass Key Derivation Security Question
I have done some research about password managers and of course stumbled upon LastPass. There are plenty of questions and answers about the security of LastPass, but as far as I am aware none of them ...
- 1,017
2
votes
3
answers
534
views
Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired
There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
- 381
0
votes
2
answers
1k
views
Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?
I started to use LastPass a few months ago and imported passwords from my browsers.
Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
- 381
2
votes
2
answers
2k
views
Do cloud-based password managers invalidate even the most secure architecture?
Can an online password vault, like LastPass, be defended through a security assessment that demonstrates the value they provide outweighs the risks of being a high value target?
A valid answer should:...
- 131