Questions tagged [lastpass]

A freemium password management service which seeks to resolve the password fatigue problem by centralising user password management in the cloud.

Filter by
Sorted by
Tagged with
0 votes
1 answer
28 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
user avatar
0 votes
0 answers
91 views

How safe is LastPass's Remember Password login option when combined with 2FA?

I'm trying to balance ease of use with security on my work computer to use my LastPass vault from a browser extension. I'd like my vault to be inaccessible except when I want to use it. The only way I'...
user avatar
  • 153
0 votes
2 answers
143 views

Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?

I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
user avatar
7 votes
1 answer
298 views

How does LastPass know that I used the same passphrase with another service?

So today I switched from Lastpass (chrome extension and iOS app) to bitwarden. So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is ...
user avatar
  • 173
4 votes
1 answer
643 views

Relative security of 'offline' vs 'online' password managers

I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
user avatar
  • 41
2 votes
2 answers
238 views

Are password managers still effective on a cloud PC (virtual machine)?

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
user avatar
  • 172
3 votes
1 answer
145 views

Is it safe to share a LastPass master account?

I just found out my company started using LastPass Enterprise for service accounts. (databases and web applications that our whole team needs access to) I immediately switched my team over to it ...
user avatar
  • 33
0 votes
1 answer
138 views

iPad stolen with LastPass, Should I be worried?

Unfortunately my iPad was recently stolen and I had LastPass installed on it. Both the iPad and the app are protected with TouchID and passcodes. However, LastPass keeps an encrypted offline cache of ...
user avatar
8 votes
1 answer
6k views

LastPass installer scary message about sideloading

I've been using LastPass for years, generally through the original Chrome extension. In recent months, certain features of the extension have been totally broken, such as the ability to share ...
user avatar
  • 315
2 votes
0 answers
409 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
user avatar
2 votes
1 answer
779 views

How can you discover a password shared via LastPass?

I'm trying to set up a personal accountant with access to some of my financial accounts. I would like to use LastPass sharing to give them access to the accounts without giving them access to a ...
user avatar
1 vote
1 answer
147 views

Lastpass - Can I use my old master password to decrypt local data?

I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
user avatar
-2 votes
2 answers
458 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
user avatar
  • 121
1 vote
1 answer
1k views

iOS 12 built in password manager vs third party apps like Keepass

On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
user avatar
  • 25
11 votes
4 answers
2k views

Why should we prevent users from saving their passwords in their password manager?

I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account. I noticed ...
user avatar
  • 1,182
16 votes
2 answers
5k views

is LastPass SMS Recovery a security risk?

According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords. LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the ...
user avatar
  • 285
1 vote
1 answer
511 views

How to brute force Last Pass local storage extension? [closed]

I need to brute force Last Pass since I forgot my master password. Anyone know how is the format of the local storage of the extension? I was logged into it so it must have local data. I see words....
user avatar
  • 111
2 votes
1 answer
1k views

How does LastPass decrypt passwords?

I am a web developer, not a security expert, but I know a little bit about security because I need it as a web developer. According to LastPass, LastPass encrypts your Vault before it goes to the ...
user avatar
2 votes
1 answer
2k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
user avatar
  • 320
8 votes
1 answer
322 views

How does Lastpass decrypt my mobile vault after restart with just the fingerprint?

So my vault (on mobile device) is encrypted with my Master Password. Without the Master Password, the decryption cannot happen. There is an option to enable Fingerprint Authentication on the mobile ...
user avatar
  • 183
5 votes
1 answer
21k views

Is Google Keep more secure than LastPass Secure Notes?

LastPass is good for storing and using username-password pairs for websites. Some websites (such as for banks) have more complicated login procedures which don't fit the standard LastPass system. ...
user avatar
  • 1,589
2 votes
3 answers
187 views

LastPass - maintaining security on foreign devices

So I've recently started using LastPass to generate and store secure passwords for me (previously, I was using the same password for every service). I am in the process of changing all my passwords to ...
user avatar
  • 121
5 votes
3 answers
552 views

Is storing my LastPass password in LastPass a security risk?

While categorizing my accounts in LastPass, I had a dumb thought cross my mind. Can I store my LastPass password in LastPass? Initially I thought this would be a completely pointless thought ...
user avatar
  • 1,515
0 votes
1 answer
344 views

Is my authentication strategy secured?

I want to implement an authentication system by following good practices, i want it as simple as possible and secured (im not going to implement some magic hashing function or something to feel a hero....
user avatar
  • 11
2 votes
1 answer
686 views

How secure is lastpass if TLS is MITMed?

In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being ...
user avatar
5 votes
3 answers
697 views

Is there a password manager that combines a "master password" solution with a keystore solution?

There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools. The general idea is that a function hash("my_master_password", "...
user avatar
  • 153
5 votes
2 answers
662 views

LastPass vulnerability: Should LastPass users change all their passwords?

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
user avatar
  • 6,797
8 votes
1 answer
786 views

LastPass's use of client-side Salt

The LastPass Team states the following in their FAQ: Do you use a salted hash for logging in? Yes, we first do a 'salt' of your LastPass password with your username on the client side (on ...
user avatar
2 votes
2 answers
628 views

Is LastPass' Formfill inherently compromised?

Is there any sort of documentation to verify that the user info inputted with automatic formfill on "Secure forms" is protected from theft by a keylogger or trojan collecting clipboard data? I ask ...
user avatar
  • 43
1 vote
1 answer
163 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
user avatar
1 vote
0 answers
328 views

LastPass Secure Notes Leak? - Is Spell Check and Typing Telemetry of LP Secure Notes a Significant Leak in Windows 10 Edge Extension

LastPass is the first and only password manager extension for Windows 10 Edge in the Microsoft Store (Fall 2016). The LP Secure Notes appears to use the standard Msft spelling engine and dictionaries. ...
user avatar
  • 219
1 vote
1 answer
3k views

Why LastPass logs me out periodically? [closed]

I'm using LastPass password manager extension in Google Chrome. I have to input your MASTER password (LastPass's password) to login and get all the functionality of the manager such as autofill ...
user avatar
1 vote
0 answers
182 views

Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?

A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites. Now, there are some people who are obsessive about not leaving it out to a ...
user avatar
  • 381
1 vote
1 answer
142 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my passwords,...
user avatar
  • 119
5 votes
1 answer
527 views

How does the security of a GPG2 hybrid-encrypted file compare to a LastPass vault?

While discussing LastPass, a colleague told me about trousseau, a GPG-based method of sharing key-value stores between developers on shared sites/cloud drives/etc. How do the two compare in terms of ...
user avatar
  • 153
1 vote
1 answer
335 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
user avatar
  • 113
2 votes
1 answer
351 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
user avatar
  • 233
0 votes
1 answer
284 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with "...
user avatar
  • 6,797
14 votes
2 answers
10k views

Is LastPass secure enough? [closed]

They said: Private Master Password: The user’s master password, and the keys used to encrypt and decrypt user data, are never sent to LastPass’ servers, and are never accessible by LastPass. ...
user avatar
0 votes
1 answer
127 views

Why does LastPass give me one password without needing my MFA key?

I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (...
user avatar
  • 1,455
3 votes
1 answer
2k views

How does the "emergency access" feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
user avatar
3 votes
2 answers
5k views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
user avatar
4 votes
2 answers
1k views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
user avatar
  • 1,102
4 votes
1 answer
394 views

LastPass Key Derivation Security Question

I have done some research about password managers and of course stumbled upon LastPass. There are plenty of questions and answers about the security of LastPass, but as far as I am aware none of them ...
user avatar
  • 987
2 votes
3 answers
516 views

Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired

There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
user avatar
  • 381
0 votes
2 answers
1k views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I started to use LastPass a few months ago and imported passwords from my browsers. Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
user avatar
  • 381
2 votes
2 answers
2k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like LastPass, be defended through a security assessment that demonstrates the value they provide outweighs the risks of being a high value target? A valid answer should:...
user avatar
2 votes
1 answer
327 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
user avatar
2 votes
1 answer
462 views

LastPass authentication grid hacked on June 15?

I wonder how safe LastPass's grid authentication is. I take it that they have a copy of the authentication grid on their server. You are supposed to print the grid and carry it with you to any device ...
user avatar
  • 121
1 vote
2 answers
172 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
user avatar
  • 3,367