41

DON'T. Unique passwords is one of the most important aspect of password security, as a breach in a different site will not affect other sites for the same user. Unique passwords per site is almost impossible without password managers. In addition, password managers enable longer password. For instance, most of my passwords are unique, 60-character, ...


16

From this support thread on the LastPass website: LastPass says they never receive my Master Password. Don’t I send it to the LastPass servers when I log in? No, when you login to LastPass, two things are generated from your Master Password using our code discussed previously before anything is sent to the server: the password hash and the decryption ...


15

If appears to seed the RNG with window.crypto, which if not available window.msCrypto is used and finally falls back onto current time. The relevant code is: var rng_state; var rng_pool; var rng_pptr; // Mix in a 32-bit integer into the pool function rng_seed_int(x) { rng_pool[rng_pptr++] ^= x & 255; rng_pool[rng_pptr++] ^= (x >> 8) & 255;...


12

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more than just obtain the recovery SMS. To use SMS recovery, you must have access to a computer and browser where you have previously used LastPass. LastPass ...


11

Ars has a decent article on the problem: http://arstechnica.com/security/2015/06/hack-of-cloud-based-lastpass-exposes-encrypted-master-passwords/ One particular Ars user also posted an enlightening breakdown: epixoip wrote: vcsjones wrote: I feel like LastPass needs to really lay out their security. They tout PBKDF2-SHA256 with 100k ...


10

YubiKey has a office in California. LastPass has one in Washington. That means that both companies are legally required to give the NSA your data should the NSA give them a National Security Letter. I see no real reason to use a closed source system like LastPass where you have to trust an US company over an open source solution like KeePass.


8

Original question With only one master password, for both the final hash and the key store. Your scheme adds no additional security on top of what standard password managers already offer. So lets say that the password file from your password manager is leaked. Generally, these are encrypted using a key that is derived from the master password. So an ...


8

As vidarlo said, you should NOT do that. Plus, websites, where password managers don't work, don't disable them per se, they disable paste in password fields. Usually, they disable password copy pasting because they consider it weakens security: user could paste a password he/she doesn't know (irrelevant with a password manager) on registration, user ...


7

First off I used google academic to find papers about LastPass, password managers and memory forensics. It was the last one I found to be more helpful Amari, K. (2009) Techniques and Tools for Recovering and Analysing Data from Volatile Memory. After gaining an understanding memory extracting and analysis I created a windows 7 virtual machine with 2 GB of ...


7

You say you cannot trust a password manager because of the risks inherent to password storage. But I cannot really understand where is the improvement with your solutions: Confidentiality: A password manager normally depends on something you have (an encrypted file) and something you know (a master password). Assuming you use a correct master password and ...


6

Aren't you kind of already at a worst case scenario level with security when there is a keylogger installed? It would be very dangerous to assume that LastPass (or any program) can protect plaintext from being read on a compromised machine. This question/answer might help guide your security practices: LastPass - Best practices on foreign devices


6

The decryption happens on your device, using the password you enter when starting the program, or a stored version of this, if you've selected "remember me" or are using biometric authentication. The password isn't sent to their servers, so the employees don't have access to it. In more detail: the master password is used to generate an encryption key, ...


6

Note This answer discusses some important caveats to keep in mind for systems like this in general, but misses relevant details about the implementation of LastPass' recovery system. For more details specific to LastPass, see @korsbakken's excellent answer. The real risk Yes, it is a security risk, and it doesn't have to have anything to do with how they ...


6

This is locally verified by the Lastpass extension so that you don't reuse password manager's master password itself somewhere else. Password managers use credential management API to capture credentials from the webpage. To derive an encryption key from master password, Lastpass feeds master password into PBKDF2 with 100,100 iterations of SHA-256. One more ...


5

Lastpass uses a preconfigured and extensible set of site aliases to make two or more domains equivalent. Here is a snapshot from my account settings page. YMMV.


5

While the strict answer to the question can be found in the LastPass Help Centre, what is interesting on the info they provide is that by enabling it you make your account as secure as the master password of the relying party (on a threath model where the attacker has access to encrypted data like lastpass has). If you have a strong one, but the other ...


4

First, keep in mind that 99.99...% of sites transmit your password to the server in clear-text over (over an SSL connection, of course). There the server actually has your clear-text password during authentication. So even that one hash increases security. Taking a step back, the reason that we perform numerous rounds for hashing or key derivation for ...


4

LastPass encrypts everything locally on your PC and only sends the encrypted blob to the LastPass servers. Even if someone hacks into LastPass's servers, your data is safe, even your "secure notes" data. That's not the case for Google Keep. If they manage to get access to Google's servers, presumably they will have access to anything you've stored in Keep. ...


4

Most of the other answers say banks shouldn't do this, which I mostly agree with. However, I'm going to answer the question you asked: why do some banks do this? The answer is simple: many password managers have had vulnerabilities or breaches that leak passwords. For example, this flaw in LastPass. The reason that banks in particular try to stop this is ...


4

In June 2018, ZDNet reported that the password manager OneLogin was hacked, exposing sensitive customer data. A few months prior to this another popular password manager, LastPass, also suffered from a troublesome security issue as this article from the UK Independent describes (LastPass had previously been hacked two years earlier .) Bottom line: The ...


4

These are the threats that I have identified when dealing with password managers. It's a single point of failure. If you forget the master password or it is ever stolen, everything is going to be compromised. You need backups like everything else, but then you need to make sure the backups are at least as secure as everything else, otherwise that will ...


3

What's happening Both the built-in and Lastpass password managers are trying to auto fill/auto login and probably the built-in password manager gets precedence over Lastpass. Pros and cons Pros: Your passwords are stored redundantly. Cons: Multiple popups to save /override passwords/login when saving new login data. More efforts in terms of ...


3

LastPass is "safe" for most use cases. I suspect that Edward Snowden and Julian Assange do not use it however. (If you're not familiar with these guys, they're both on the run from the US government for releasing classified data). An important feature of the LastPass design is that their cloud systems never see your passwords. All your passwords are ...


3

As with any two-factor authentication (2FA) method, then you're back to essentially only having a password protecting your account. But with grids I'd consider the printout a greater security risk than the server getting hacked. The thing that I find hilarious about grids as a 2FA method is that A) they are too complex to memorize, so you HAVE to have a ...


3

Without having precise details regarding how Lastpass operates, it is impossible to give a definitive answer to this question. However, there are some things to consider which will possibly allow you to use the software in a more secure manner. In practice, you should consider all foreign devices i.e. those you don't own and control, as being potentially ...


3

No, this is insecure as the public identity is not considered a secret. This is backed up by the fact Yubico send the identifier over HTTP. If this is known to be used for a LastPass account, a MITM could capture the extra offline encryption key as used by LastPass. Although there is a chance that it has been leaked over the internet, as the master password ...


3

Maybe a simple way to proceed with such research would be to use some of the tools normally dedicated to game cheating by analyzing and directly editing the target software memory content. Search for things like "game memory search cheat" on your favorite search engine, and you should find several of them. The programs I'm referring to take a snapshot of ...


3

Is the same decryption key used for data on the server as locally with Lastpass? Yes, the same decryption key is used for data on the server as local data. Although if you are using a Yubikey, so you can set your local password database to be encrypted with the public identifier too. Does it give a database to anyone who asks? Not anyone. LastPass will ...


3

As far as I understand only your master password is used to derive the key to protect your secret (https://lastpass.com/support.php?cmd=showfaq&id=6926) 2nd factor is used to avoid an attacker to get access to the encrypted data from the lastpass servers only (download it for local decryption). Not for encryption/decryption. I cant find a reference ...


Only top voted, non community-wiki answers of a minimum length are eligible