Questions tagged [lastpass]

A freemium password management service which seeks to resolve the password fatigue problem by centralising user password management in the cloud.

Filter by
Sorted by
Tagged with
30 votes
4 answers
8k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
jrdioko's user avatar
  • 13.1k
28 votes
5 answers
6k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
Jay Bazuzi's user avatar
18 votes
1 answer
959 views

Lastpass hack - risks for abuse

I use Lastpass. Today I got an email from them telling me that their servers were hacked, and a database with email addresses and recovery hints was probably copied. Dear LastPass User, We wanted to ...
SPRBRN's user avatar
  • 7,529
17 votes
2 answers
5k views

is LastPass SMS Recovery a security risk?

According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords. LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the ...
eKKiM's user avatar
  • 295
15 votes
1 answer
3k views

Security of LastPass' password generator

I currently use LastPass for all of my password generation and management. After reading Diceware, I realized that LastPass' password generator might be insecure, as somebody could potentially ...
Nathan Merrill's user avatar
14 votes
2 answers
10k views

Is LastPass secure enough? [closed]

They said: Private Master Password: The user’s master password, and the keys used to encrypt and decrypt user data, are never sent to LastPass’ servers, and are never accessible by LastPass. ...
AsimRazaKhan's user avatar
11 votes
4 answers
3k views

Why should we prevent users from saving their passwords in their password manager?

I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account. I noticed ...
Filipon's user avatar
  • 1,264
9 votes
3 answers
9k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
octo-carrot's user avatar
9 votes
1 answer
7k views

LastPass installer scary message about sideloading

I've been using LastPass for years, generally through the original Chrome extension. In recent months, certain features of the extension have been totally broken, such as the ability to share ...
Ryan's user avatar
  • 325
9 votes
2 answers
765 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
cuengi8's user avatar
  • 103
8 votes
1 answer
1k views

LastPass's use of client-side Salt

The LastPass Team states the following in their FAQ: Do you use a salted hash for logging in? Yes, we first do a 'salt' of your LastPass password with your username on the client side (on ...
Oliver Weichhold's user avatar
8 votes
2 answers
817 views

Protecting my high-value passwords against offline attacks

Summary I'm a LastPass user, but I have concerns about storing high-value passwords, like my bank password, online. I've read some posts on this topic but still have questions. How safe are ...
user1020406's user avatar
8 votes
1 answer
357 views

How does Lastpass decrypt my mobile vault after restart with just the fingerprint?

So my vault (on mobile device) is encrypted with my Master Password. Without the Master Password, the decryption cannot happen. There is an option to enable Fingerprint Authentication on the mobile ...
Slav's user avatar
  • 183
7 votes
3 answers
659 views

Is storing my LastPass password in LastPass a security risk?

While categorizing my accounts in LastPass, I had a dumb thought cross my mind. Can I store my LastPass password in LastPass? Initially I thought this would be a completely pointless thought ...
Stevoisiak's user avatar
  • 1,535
7 votes
2 answers
1k views

LastPass - Best practices on foreign devices

I am a new user to LastPass and have been reading the literature to better understand how it works. What I do not grasp is how to best use LastPass on other computers. In the case where you only want ...
Polite Master's user avatar
6 votes
1 answer
392 views

How does LastPass know that I used the same passphrase with another service?

So today I switched from Lastpass (chrome extension and iOS app) to bitwarden. So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is ...
L. Faros's user avatar
  • 163
6 votes
2 answers
1k views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
Celeritas's user avatar
  • 10.2k
5 votes
3 answers
798 views

Is there a password manager that combines a "master password" solution with a keystore solution?

There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools. The general idea is that a function hash("my_master_password", "...
Trindaz's user avatar
  • 153
5 votes
1 answer
21k views

Is Google Keep more secure than LastPass Secure Notes?

LastPass is good for storing and using username-password pairs for websites. Some websites (such as for banks) have more complicated login procedures which don't fit the standard LastPass system. ...
cja's user avatar
  • 1,629
5 votes
2 answers
718 views

LastPass vulnerability: Should LastPass users change all their passwords?

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
mcgyver5's user avatar
  • 6,874
5 votes
2 answers
555 views

Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?

Normally LastPass servers won't send out encrypted passwords unless the client proves it knows the master password. With the hashes leaked, does it become possible for an attacker to retrieve ...
RomanSt's user avatar
  • 1,220
5 votes
1 answer
1k views

Relative security of 'offline' vs 'online' password managers

I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
Chas's user avatar
  • 51
5 votes
1 answer
591 views

How does the security of a GPG2 hybrid-encrypted file compare to a LastPass vault?

While discussing LastPass, a colleague told me about trousseau, a GPG-based method of sharing key-value stores between developers on shared sites/cloud drives/etc. How do the two compare in terms of ...
Harvey's user avatar
  • 153
4 votes
2 answers
233 views

LastPass - Can MFA stop hackers from cracking a local vault?

After the recent LastPass security incidents (where old backup copies of users' encrypted vaults have leaked), I was wondering if an account had MFA configured at the time, it makes a difference for ...
Dzhuneyt's user avatar
  • 141
4 votes
1 answer
1k views

What is the math behind iterations in PBKDF2-SHA256 for lastpass users?

I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica. Lastpass has admitted ...
Sakib Arifin's user avatar
4 votes
1 answer
549 views

LastPass Key Derivation Security Question

I have done some research about password managers and of course stumbled upon LastPass. There are plenty of questions and answers about the security of LastPass, but as far as I am aware none of them ...
John's user avatar
  • 1,017
4 votes
3 answers
913 views

Should LastPass use the YubiKey public identifier as a secret key?

I've just picked up a YubiKey. However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is ...
SilverlightFox's user avatar
4 votes
2 answers
1k views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
Wadih M.'s user avatar
  • 1,132
3 votes
1 answer
2k views

How does the "emergency access" feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
amprantino's user avatar
3 votes
2 answers
5k views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
StairCeption's user avatar
3 votes
1 answer
171 views

Is it safe to share a LastPass master account?

I just found out my company started using LastPass Enterprise for service accounts. (databases and web applications that our whole team needs access to) I immediately switched my team over to it ...
Zabe's user avatar
  • 33
2 votes
2 answers
647 views

Is LastPass' Formfill inherently compromised?

Is there any sort of documentation to verify that the user info inputted with automatic formfill on "Secure forms" is protected from theft by a keylogger or trojan collecting clipboard data? I ask ...
Spriter's user avatar
  • 43
2 votes
1 answer
2k views

How does LastPass decrypt passwords?

I am a web developer, not a security expert, but I know a little bit about security because I need it as a web developer. According to LastPass, LastPass encrypts your Vault before it goes to the ...
I am the Most Stupid Person's user avatar
2 votes
1 answer
364 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
BlueRaja - Danny Pflughoeft's user avatar
2 votes
1 answer
764 views

How secure is lastpass if TLS is MITMed?

In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being ...
Matthew Sharp's user avatar
2 votes
1 answer
487 views

LastPass authentication grid hacked on June 15?

I wonder how safe LastPass's grid authentication is. I take it that they have a copy of the authentication grid on their server. You are supposed to print the grid and carry it with you to any device ...
P. Wormer's user avatar
  • 121
2 votes
3 answers
201 views

LastPass - maintaining security on foreign devices

So I've recently started using LastPass to generate and store secure passwords for me (previously, I was using the same password for every service). I am in the process of changing all my passwords to ...
Jordan's user avatar
  • 121
2 votes
2 answers
2k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like LastPass, be defended through a security assessment that demonstrates the value they provide outweighs the risks of being a high value target? A valid answer should:...
Dan O'Boyle's user avatar
2 votes
1 answer
881 views

How can you discover a password shared via LastPass?

I'm trying to set up a personal accountant with access to some of my financial accounts. I would like to use LastPass sharing to give them access to the accounts without giving them access to a ...
Ryan McDermott's user avatar
2 votes
1 answer
2k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
MountainX's user avatar
  • 340
2 votes
3 answers
547 views

Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired

There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
Alex S's user avatar
  • 381
2 votes
0 answers
577 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
End Anti-Semitic Hate's user avatar
2 votes
1 answer
372 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
user48678's user avatar
  • 243
1 vote
1 answer
393 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
danizmax's user avatar
  • 113
1 vote
2 answers
196 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
zedman9991's user avatar
  • 3,387
1 vote
1 answer
217 views

Lastpass - Can I use my old master password to decrypt local data?

I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
Mike Mike's user avatar
1 vote
2 answers
403 views

Are password managers still effective on a cloud PC (virtual machine)?

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
Matthew's user avatar
  • 162
1 vote
1 answer
629 views

How to brute force Last Pass local storage extension? [closed]

I need to brute force Last Pass since I forgot my master password. Anyone know how is the format of the local storage of the extension? I was logged into it so it must have local data. I see words....
cswl's user avatar
  • 111
1 vote
1 answer
181 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
LastPassUser's user avatar
1 vote
1 answer
4k views

Why LastPass logs me out periodically? [closed]

I'm using LastPass password manager extension in Google Chrome. I have to input your MASTER password (LastPass's password) to login and get all the functionality of the manager such as autofill ...
Santropedro's user avatar