42 votes

Why should we prevent users from saving their passwords in their password manager?

DON'T. Unique passwords is one of the most important aspect of password security, as a breach in a different site will not affect other sites for the same user. Unique passwords per site is almost ...
vidarlo's user avatar
  • 16k
19 votes
Accepted

is LastPass SMS Recovery a security risk?

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more ...
korsbakken's user avatar
16 votes
Accepted

Is LastPass secure enough?

From this support thread on the LastPass website: LastPass says they never receive my Master Password. Don’t I send it to the LastPass servers when I log in? No, when you login to LastPass, ...
Joshua Shearer's user avatar
8 votes

Is there a password manager that combines a "master password" solution with a keystore solution?

Original question With only one master password, for both the final hash and the key store. Your scheme adds no additional security on top of what standard password managers already offer. So lets ...
Anders's user avatar
  • 65.6k
8 votes

is LastPass SMS Recovery a security risk?

Note This answer discusses some important caveats to keep in mind for systems like this in general, but misses relevant details about the implementation of LastPass' recovery system. For more ...
Conor Mancone's user avatar
8 votes

Why should we prevent users from saving their passwords in their password manager?

As vidarlo said, you should NOT do that. Plus, websites, where password managers don't work, don't disable them per se, they disable paste in password fields. Usually, they disable password copy ...
CheddarLizzard's user avatar
7 votes
Accepted

Is there a password manager that combines a "master password" solution with a keystore solution?

You say you cannot trust a password manager because of the risks inherent to password storage. But I cannot really understand where is the improvement with your solutions: Confidentiality: A ...
Serge Ballesta's user avatar
6 votes

Is LastPass' Formfill inherently compromised?

Aren't you kind of already at a worst case scenario level with security when there is a keylogger installed? It would be very dangerous to assume that LastPass (or any program) can protect ...
le3th4x0rbot's user avatar
  • 3,139
6 votes

How does LastPass decrypt passwords?

The decryption happens on your device, using the password you enter when starting the program, or a stored version of this, if you've selected "remember me" or are using biometric authentication. The ...
Matthew's user avatar
  • 27.4k
5 votes

Is Google Keep more secure than LastPass Secure Notes?

LastPass encrypts everything locally on your PC and only sends the encrypted blob to the LastPass servers. Even if someone hacks into LastPass's servers, your data is safe, even your "secure notes" ...
Ben's user avatar
  • 4,022
5 votes

How does the "emergency access" feature of LastPass work?

While the strict answer to the question can be found in the LastPass Help Centre, what is interesting on the info they provide is that by enabling it you make your account as secure as the master ...
CristianTM's user avatar
  • 2,580
5 votes
Accepted

How does LastPass know that I used the same passphrase with another service?

This is locally verified by the Lastpass extension so that you don't reuse password manager's master password itself somewhere else. Password managers use credential management API to capture ...
defalt's user avatar
  • 6,841
5 votes
Accepted

What is the math behind iterations in PBKDF2-SHA256 for lastpass users?

PBKDF2 is an iterated function based on a pseudorandom function (PRF) that takes a passphrase or other secret and a random salt. Essentially, there is a PRF, such as HMAC with a hash function (e.g., ...
bk2204's user avatar
  • 9,339
4 votes

LastPass vulnerability: Should LastPass users change all their passwords?

Last pass suggesting people change their passwords depends on if the vulnerability was discovered before it was disclosed and solved and if users have visited an infected site in case it was. It also ...
Daniel V's user avatar
  • 443
4 votes

How secure is lastpass if TLS is MITMed?

If an adversary is able to issue arbitrary certificates your browser trusts, then everything you do in the browser can potentially be compromised. On the three points above: If the vault blob is ...
Liam Dennehy's user avatar
4 votes

Why should we prevent users from saving their passwords in their password manager?

Most of the other answers say banks shouldn't do this, which I mostly agree with. However, I'm going to answer the question you asked: why do some banks do this? The answer is simple: many password ...
paj28's user avatar
  • 33.4k
4 votes

What are most dangerous vulnerabilities of users of password management?

In June 2018, ZDNet reported that the password manager OneLogin was hacked, exposing sensitive customer data. A few months prior to this another popular password manager, LastPass, also suffered from ...
user3382203's user avatar
4 votes

What are most dangerous vulnerabilities of users of password management?

These are the threats that I have identified when dealing with password managers. It's a single point of failure. If you forget the master password or it is ever stolen, everything is going to be ...
reed's user avatar
  • 15.8k
3 votes

Is storing my LastPass password in LastPass a security risk?

It is rather useless because you first need to type the password to recover it. But IMHO this does not really weaken the overall security of the password vault by itself. Assuming LastPass encryption ...
Serge Ballesta's user avatar
3 votes

Is storing my LastPass password in LastPass a security risk?

LastPass seems to store your Vault as a single encrypted blob, according to their documentation. Let's consider two attack scenarios. First, an attacker manages to get his hands on your encrypted ...
Daniel Szpisjak's user avatar
3 votes

LastPass - maintaining security on foreign devices

There's a second option also. LastPass have their app for mobile devices. You can access your password vault by logging into your account on your mobile device, search for your password and type it ...
mdymek's user avatar
  • 131
3 votes
Accepted

Can LastPass local password store (on a Android device) be brute forced in a usual way?

Making brute-force attack the only possible option is a desired feature of a security system. This "only" would mean there are no weaknesses in the algorithm or implementation and the system could be ...
techraf's user avatar
  • 9,159
3 votes

LastPass's use of client-side Salt

I would interpret "we first do a salt of your LastPass password with your username on the client side" as: we do a PBKDF2 function on the client side that includes your password and username (email) ...
HTKLee's user avatar
  • 1,842
3 votes
Accepted

Why does LastPass give me one password without needing my MFA key?

As far as I understand only your master password is used to derive the key to protect your secret (https://lastpass.com/support.php?cmd=showfaq&id=6926) 2nd factor is used to avoid an attacker to ...
CristianTM's user avatar
  • 2,580
3 votes
Accepted

LastPass installer scary message about sideloading

There's no more risk installing LastPass by sideloading than there is installing/running any other executable that you download. And since LastPass is well-known and trustworthy, it's basically no ...
Joseph Sible-Reinstate Monica's user avatar
3 votes
Accepted

Is it safe to share a LastPass master account?

It is a lot less secure. You have the equivalent of a password-protected file filled with passwords. Everyone with access to this resource: has all the passwords contained within it, whether they ...
schroeder's user avatar
  • 129k
3 votes

LastPass - Can MFA stop hackers from cracking a local vault?

MFA is just for logins, not for the encryption of the vaults themselves. And, no, that control is not "useless". Just not useful in this case.
schroeder's user avatar
  • 129k
2 votes

Is LastPass secure enough?

It might be worth checking out Public and Private key Cryptography(asymmetric). I speculate, they could use asymmetric cryptography. When a you register a new device, create a keypair on said device ...
Snewedon's user avatar
  • 185
2 votes

Security of LastPass together with YubiKey

well 2FA and password managers together is pure chaos. there are some things that one needs to know: 1) One-type password (yubico OTP)/signature (U2F) based 2FA usually cannot be used for encryption....
My1's user avatar
  • 394

Only top scored, non community-wiki answers of a minimum length are eligible