4 ms·
I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be
by starquake 10y ago
I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be Dropbox, later I was using BitTorrent Sync, but what tool sync shouldn't really matter. As I see it: the tool only gets to see and sync an encrypted file. You could even use a USB stick and not sync at all. Or only sync on LANs.
I love it how I get to decide who or what gets to see the encrypted file.
Now hopefully the Keepass audit will not reveal any issues in the encryption.
- icebraining 10y agoLastpass also only syncs data after it's encrypted locally, so the threat model is the same.
- starquake 10y agoYou're right about that. The threat model is equal when using Dropbox. It's still different when you use a local LAN share or a USB stick though.
- skrebbel 10y agoNot entirely, since you download the encryption code way more often (for example, when you open the "Lastpass Vault", which is just a website like any other). Parts of Lastpass are simply a website, not part of the browser extension, and as an avid Lastpass user in all honesty I don't know which parts. This matters because even if it's client-side encryption, the encryption code just got downloaded when you opened the site so if the server or the network was compromised, you got compromised. [0] With Keepass, the only time you run that risk is when you download Keepass. [0] As far as I can tell, this is the core argument of tptacek's "javascript crypto considered harmful" rant (https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...). I'm not sure, because it's written worse than his most drunken HN comment, but I believe it is.
- icebraining 10y agoAh, yes, I was assuming the website would be avoided. I didn't realize it was hard to distinguish (I don't personally use LastPass, I prefer Firefox Sync).
- milkey_mouse 10y agoI'm pretty sure when using the Chrome extension, all the HTML/JS is downloaded locally once when installing the extension, as logging in via the extension brings you to a chrome-extension:// URL. When logging in via lastpass.com, of course, you will be redownloading the crypto code every time.
- Ronsenshi 10y agoSimilar here, also using KeePass. Fairly happy to sacrifice some of the usability for more control and less "cloud".
- snehesht 10y agoI was hoping for someone to audit, keepass. Lets see what happens.