Questions tagged [lastpass]

A freemium password management service which seeks to resolve the password fatigue problem by centralising user password management in the cloud.

Filter by
Sorted by
Tagged with
0
votes
2answers
69 views

Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?

I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
7
votes
1answer
212 views

How does LastPass know that I used the same passphrase with another service?

So today I switched from Lastpass (chrome extension and iOS app) to bitwarden. So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is ...
0
votes
0answers
22 views

intranet users: auditing of credentials vs online vaults (example: lastpass, 1password)

Scenario: a medium company (750 users). Some of them use online services to store their credentials (office email and other web applications), like lastpass and 1password. The IT wants to audit the ...
4
votes
1answer
280 views

Relative security of 'offline' vs 'online' password managers

I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
0
votes
1answer
94 views

iPad stolen with LastPass, Should I be worried?

Unfortunately my iPad was recently stolen and I had LastPass installed on it. Both the iPad and the app are protected with TouchID and passcodes. However, LastPass keeps an encrypted offline cache of ...
2
votes
2answers
128 views

Are password managers still effective on a cloud PC (virtual machine)?

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
7
votes
1answer
5k views

LastPass installer scary message about sideloading

I've been using LastPass for years, generally through the original Chrome extension. In recent months, certain features of the extension have been totally broken, such as the ability to share ...
3
votes
1answer
90 views

Is it safe to share a LastPass master account?

I just found out my company started using LastPass Enterprise for service accounts. (databases and web applications that our whole team needs access to) I immediately switched my team over to it ...
2
votes
0answers
334 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
1answer
648 views

How can you discover a password shared via LastPass?

I'm trying to set up a personal accountant with access to some of my financial accounts. I would like to use LastPass sharing to give them access to the accounts without giving them access to a ...
13
votes
2answers
4k views

is LastPass SMS Recovery a security risk?

According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords. LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the ...
1
vote
1answer
82 views

Lastpass - Can I use my old master password to decrypt local data?

I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
3
votes
1answer
2k views

How does the “emergency access” feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
-2
votes
2answers
407 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
11
votes
4answers
2k views

Why should we prevent users from saving their passwords in their password manager?

I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account. I noticed ...
1
vote
1answer
984 views

iOS 12 built in password manager vs third party apps like Keepass

On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
8
votes
1answer
651 views

LastPass's use of client-side Salt

The LastPass Team states the following in their FAQ: Do you use a salted hash for logging in? Yes, we first do a 'salt' of your LastPass password with your username on the client side (on ...
1
vote
1answer
443 views

How to brute force Last Pass local storage extension? [closed]

I need to brute force Last Pass since I forgot my master password. Anyone know how is the format of the local storage of the extension? I was logged into it so it must have local data. I see words....
0
votes
1answer
298 views

Is my authentication strategy secured?

I want to implement an authentication system by following good practices, i want it as simple as possible and secured (im not going to implement some magic hashing function or something to feel a hero....
30
votes
4answers
8k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
5
votes
2answers
610 views

LastPass vulnerability: Should LastPass users change all their passwords?

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
2
votes
1answer
1k views

How does LastPass decrypt passwords?

I am a web developer, not a security expert, but I know a little bit about security because I need it as a web developer. According to LastPass, LastPass encrypts your Vault before it goes to the ...
2
votes
1answer
2k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
8
votes
1answer
269 views

How does Lastpass decrypt my mobile vault after restart with just the fingerprint?

So my vault (on mobile device) is encrypted with my Master Password. Without the Master Password, the decryption cannot happen. There is an option to enable Fingerprint Authentication on the mobile ...
5
votes
1answer
21k views

Is Google Keep more secure than LastPass Secure Notes?

LastPass is good for storing and using username-password pairs for websites. Some websites (such as for banks) have more complicated login procedures which don't fit the standard LastPass system. ...
5
votes
3answers
484 views

Is storing my LastPass password in LastPass a security risk?

While categorizing my accounts in LastPass, I had a dumb thought cross my mind. Can I store my LastPass password in LastPass? Initially I thought this would be a completely pointless thought ...
2
votes
3answers
139 views

LastPass - maintaining security on foreign devices

So I've recently started using LastPass to generate and store secure passwords for me (previously, I was using the same password for every service). I am in the process of changing all my passwords to ...
2
votes
1answer
601 views

How secure is lastpass if TLS is MITMed?

In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being ...
5
votes
3answers
623 views

Is there a password manager that combines a “master password” solution with a keystore solution?

There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools. The general idea is that a function hash("my_master_password", "...
0
votes
1answer
249 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with "...
5
votes
1answer
441 views

How does the security of a GPG2 hybrid-encrypted file compare to a LastPass vault?

While discussing LastPass, a colleague told me about trousseau, a GPG-based method of sharing key-value stores between developers on shared sites/cloud drives/etc. How do the two compare in terms of ...
2
votes
2answers
585 views

Is LastPass' Formfill inherently compromised?

Is there any sort of documentation to verify that the user info inputted with automatic formfill on "Secure forms" is protected from theft by a keylogger or trojan collecting clipboard data? I ask ...
1
vote
1answer
127 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
1
vote
0answers
284 views

LastPass Secure Notes Leak? - Is Spell Check and Typing Telemetry of LP Secure Notes a Significant Leak in Windows 10 Edge Extension

LastPass is the first and only password manager extension for Windows 10 Edge in the Microsoft Store (Fall 2016). The LP Secure Notes appears to use the standard Msft spelling engine and dictionaries. ...
0
votes
2answers
1k views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I started to use LastPass a few months ago and imported passwords from my browsers. Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
9
votes
3answers
7k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
1
vote
1answer
102 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my passwords,...
2
votes
2answers
2k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like LastPass, be defended through a security assessment that demonstrates the value they provide outweighs the risks of being a high value target? A valid answer should:...
28
votes
5answers
6k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
1
vote
1answer
3k views

Why LastPass logs me out periodically? [closed]

I'm using LastPass password manager extension in Google Chrome. I have to input your MASTER password (LastPass's password) to login and get all the functionality of the manager such as autofill ...
1
vote
0answers
145 views

Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?

A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites. Now, there are some people who are obsessive about not leaving it out to a ...
1
vote
1answer
274 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
2
votes
1answer
297 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
8
votes
2answers
634 views

Protecting my high-value passwords against offline attacks

Summary I'm a LastPass user, but I have concerns about storing high-value passwords, like my bank password, online. I've read some posts on this topic but still have questions. How safe are ...
13
votes
2answers
10k views

Is LastPass secure enough? [closed]

They said: Private Master Password: The user’s master password, and the keys used to encrypt and decrypt user data, are never sent to LastPass’ servers, and are never accessible by LastPass. ...
0
votes
1answer
91 views

Why does LastPass give me one password without needing my MFA key?

I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (...
3
votes
2answers
5k views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
7
votes
2answers
876 views

LastPass - Best practices on foreign devices

I am a new user to LastPass and have been reading the literature to better understand how it works. What I do not grasp is how to best use LastPass on other computers. In the case where you only want ...
4
votes
3answers
815 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
1
vote
2answers
136 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...