Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

A freemium password management service which seeks to resolve the password fatigue problem by centralising user password management in the cloud.

0
votes
1answer
108 views

How to brute force Last Pass local storage extension? [closed]

I need to brute force Last Pass since I forgot my master password. Anyone know how is the format of the local storage of the extension? I was logged into it so it must have local data. I see words....
2
votes
1answer
249 views

How does LastPass decrypt passwords?

I am a web developer, not a security expert, but I know a little bit about security because I need it as a web developer. According to LastPass, LastPass encrypts your Vault before it goes to the ...
2
votes
1answer
935 views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
8
votes
1answer
163 views

How does Lastpass decrypt my mobile vault after restart with just the fingerprint?

So my vault (on mobile device) is encrypted with my Master Password. Without the Master Password, the decryption cannot happen. There is an option to enable Fingerprint Authentication on the mobile ...
3
votes
1answer
6k views

Is Google Keep more secure than LastPass Secure Notes?

LastPass is good for storing and using username-password pairs for websites. Some websites (such as for banks) have more complicated login procedures which don't fit the standard LastPass system. ...
3
votes
3answers
105 views

LastPass - maintaining security on foreign devices

So I've recently started using LastPass to generate and store secure passwords for me (previously, I was using the same password for every service). I am in the process of changing all my passwords to ...
4
votes
3answers
333 views

Is storing my LastPass password in LastPass a security risk?

While categorizing my accounts in LastPass, I had a dumb thought cross my mind. Can I store my LastPass password in LastPass? Initially I thought this would be a completely pointless thought ...
0
votes
1answer
286 views

Is my authentication strategy secured?

I want to implement an authentication system by following good practices, i want it as simple as possible and secured (im not going to implement some magic hashing function or something to feel a hero....
1
vote
1answer
320 views

How secure is lastpass if TLS is MITMed?

In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being ...
4
votes
3answers
399 views

Is there a password manager that combines a “master password” solution with a keystore solution?

There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools. The general idea is that a function hash("my_master_password", "...
5
votes
2answers
491 views

LastPass vulnerability: Should LastPass users change all their passwords?

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
8
votes
1answer
304 views

LastPass's use of client-side Salt

The LastPass Team states the following in their FAQ: Do you use a salted hash for logging in? Yes, we first do a 'salt' of your LastPass password with your username on the client side (on ...
3
votes
2answers
347 views

Is LastPass' Formfill inherently compromised?

Is there any sort of documentation to verify that the user info inputted with automatic formfill on "Secure forms" is protected from theft by a keylogger or trojan collecting clipboard data? I ask ...
1
vote
1answer
108 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
1
vote
0answers
191 views

LastPass Secure Notes Leak? - Is Spell Check and Typing Telemetry of LP Secure Notes a Significant Leak in Windows 10 Edge Extension

LastPass is the first and only password manager extension for Windows 10 Edge in the Microsoft Store (Fall 2016). The LP Secure Notes appears to use the standard Msft spelling engine and dictionaries. ...
1
vote
1answer
840 views

Why LastPass logs me out periodically? [closed]

I'm using LastPass password manager extension in Google Chrome. I have to input your MASTER password (LastPass's password) to login and get all the functionality of the manager such as autofill ...
1
vote
0answers
75 views

Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?

A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites. Now, there are some people who are obsessive about not leaving it out to a ...
1
vote
1answer
92 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
5
votes
1answer
263 views

How does the security of a GPG2 hybrid-encrypted file compare to a LastPass vault?

While discussing LastPass, a colleague told me about trousseau, a GPG-based method of sharing key-value stores between developers on shared sites/cloud drives/etc. How do the two compare in terms of ...
1
vote
1answer
179 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
2
votes
1answer
256 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
0
votes
1answer
229 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with "...
12
votes
2answers
9k views

Is LastPass secure enough? [closed]

They said: Private Master Password: The user’s master password, and the keys used to encrypt and decrypt user data, are never sent to LastPass’ servers, and are never accessible by LastPass. ...
0
votes
1answer
83 views

Why does LastPass give me one password without needing my MFA key?

I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (...
1
vote
1answer
851 views

How does the “emergency access” feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
4
votes
2answers
4k views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
4
votes
2answers
738 views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
4
votes
1answer
205 views

LastPass Key Derivation Security Question

I have done some research about password managers and of course stumbled upon LastPass. There are plenty of questions and answers about the security of LastPass, but as far as I am aware none of them ...
2
votes
3answers
429 views

Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired

There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
0
votes
2answers
938 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I started to use LastPass a few months ago and imported passwords from my browsers. Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
1
vote
2answers
2k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like LastPass, be defended through a security assessment that demonstrates the value they provide outweighs the risks of being a high value target? A valid answer should:...
2
votes
1answer
240 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
2
votes
1answer
317 views

LastPass authentication grid hacked on June 15?

I wonder how safe LastPass's grid authentication is. I take it that they have a copy of the authentication grid on their server. You are supposed to print the grid and carry it with you to any device ...
1
vote
2answers
123 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
7
votes
2answers
512 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
5
votes
2answers
360 views

Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?

Normally LastPass servers won't send out encrypted passwords unless the client proves it knows the master password. With the hashes leaked, does it become possible for an attacker to retrieve ...
17
votes
1answer
578 views

Lastpass hack - risks for abuse

I use Lastpass. Today I got an email from them telling me that their servers were hacked, and a database with email addresses and recovery hints was probably copied. Dear LastPass User, We ...
7
votes
2answers
617 views

LastPass - Best practices on foreign devices

I am a new user to LastPass and have been reading the literature to better understand how it works. What I do not grasp is how to best use LastPass on other computers. In the case where you only want ...
8
votes
3answers
3k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
6
votes
2answers
867 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
8
votes
2answers
395 views

Protecting my high-value passwords against offline attacks

Summary I'm a LastPass user, but I have concerns about storing high-value passwords, like my bank password, online. I've read some posts on this topic but still have questions. How safe are ...
4
votes
3answers
580 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
15
votes
1answer
2k views

Security of LastPass' password generator

I currently use LastPass for all of my password generation and management. After reading Diceware, I realized that LastPass' password generator might be insecure, as somebody could potentially ...
27
votes
5answers
5k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
30
votes
4answers
7k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...