4 ms·
This is not correct. The extension and the webapp authenticate the same way, and neither send the master password over the network. Criticism to using the weba
by ejcx 11y ago
This is not correct. The extension and the webapp authenticate the same way, and neither send the master password over the network.
Criticism to using the webapp is generally JS crypto being broken. Code delivered every time coupled with the browser not being good place for crypto (any code can eat any other code..).
Extensions, being a separate program that lives mostly apart from the web pages your browser visits is slightly a more trustworthy environment
- pweissbrod 11y agoInteresting to hear lastpass actually employs javascript cryptography in their design. I would be interested in hearing the rationale behind this design decision considering the obvious risks that are being taken.
- viraptor 11y agoOops, you're right. I was thinking of the mobile app, not browser extension. Brainfart :(
- ejcx 11y agoThe mobile app does not authenticate by sending plaintext password to the server either.