3 ms·
Reading that, it looks like the master password retrieval relies on you using the 'store password' feature, which means anyone with access to the local machine
by tempestn 11y ago
Reading that, it looks like the master password retrieval relies on you using the 'store password' feature, which means anyone with access to the local machine would have access to your vault anyway. Obviously such a feature will reduce security, although you wouldn't necessarily expect it to make the password itself retrievable.
This was also somewhat reassuring:
"As always, we made a responsible disclosure to LastPass. I want to stress how easy it was to work with the security team. The where very responsive and worked on fixing the issues we reported immediately. They also followed up with us from time to time and asked for our thoughts on every fix. It was a real pleasure to work with team!"
- why-el 11y agoA google search did not return meaningful results, so pardon the dumb question: What does the store password feature does exactly? Is that a way to remember the password like usual browsers do? I use 1Password and I don't think it has this feature?
- tempestn 11y agoThis is the feature to store the master password, so you don't have to type it in each time; you can just log into Lastpass automatically on that device. (Not a great feature for security!)
- why-el 11y agoYeah I got that reading the full post by the researchers. I am surprised it's even offered.