4 ms·
> "The plugin is more secure than the webapp anyway" Can you explain how this is correct? Because i use only webclient thinking that the plugins may be more vu
by jsudhams 11y ago
> "The plugin is more secure than the webapp anyway"
Can you explain how this is correct? Because i use only webclient thinking that the plugins may be more vulnerable because other plugins may read what lp plug in does.
- viraptor 11y agoTo use the webapp you have to send the master password over the network. So if that connection is captured in some way, your account is hacked. But extensions actually save the encrypted store locally - you can even access them offline (password is still required).
- ejcx 11y agoThis is not correct. The extension and the webapp authenticate the same way, and neither send the master password over the network. Criticism to using the webapp is generally JS crypto being broken. Code delivered every time coupled with the browser not being good place for crypto (any code can eat any other code..). Extensions, being a separate program that lives mostly apart from the web pages your browser visits is slightly a more trustworthy environment
- pweissbrod 11y agoInteresting to hear lastpass actually employs javascript cryptography in their design. I would be interested in hearing the rationale behind this design decision considering the obvious risks that are being taken.
- viraptor 11y agoOops, you're right. I was thinking of the mobile app, not browser extension. Brainfart :(
- ejcx 11y agoThe mobile app does not authenticate by sending plaintext password to the server either.