3 ms·

I am too paranoid to use them, but, from what I read (regarding the biggest one): "LastPass encrypts your Vault before it goes to the server using 256-bit AES

I am too paranoid to use them, but, from what I read (regarding the biggest one): "LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data" If there is an attack still possible (even using LastPass employees) can you post it here?

rileyteige 9y ago
Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass) The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form. Aside from that, I am not aware of other "hot" attack vectors.
- LocalPCGuy 9y ago
  LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are. Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it comes to being as secure as possible.
  - paulryanrogers 9y ago
    I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users
skymt 9y ago
Project Zero has found a number of major flaws in the LastPass extension. https://bugs.chromium.org/p/project-zero/issues/detail?id=884&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=88... https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=11... https://bugs.chromium.org/p/project-zero/issues/detail?id=1209&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1217&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... At a glance what they have in common is flaws in the scripts that the LastPass extension injects into pages. The injected scripts can communicate with the extension core with a set of RPCs. Each of these issues is a way of tricking the extension into running RPCs from untrusted JavaScript on any web page. The RPCs available allow an attacker to fetch the credentials for any site in the database or even execute arbitrary code on the host.
rajasinghe 9y ago
I used LastPass for a while. Then it filled in my username and password (correctly) on a website without my having authenticated... It looks like there's an unencrypted local cache which is not flushed when your authentication expires or you log out. I wasn't able to reproduce it but I was sufficiently spooked to stop using it after that.
- stolsvik 9y ago
  Sure it wasn't the browser that filled it in?

rileyteige 9y ago

Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass) The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form. Aside from that, I am not aware of other "hot" attack vectors.

LocalPCGuy 9y ago
LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are. Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it comes to being as secure as possible.
- paulryanrogers 9y ago
  I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users

skymt 9y ago

Project Zero has found a number of major flaws in the LastPass extension. https://bugs.chromium.org/p/project-zero/issues/detail?id=884&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=88... https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=11... https://bugs.chromium.org/p/project-zero/issues/detail?id=1209&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1217&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... At a glance what they have in common is flaws in the scripts that the LastPass extension injects into pages. The injected scripts can communicate with the extension core with a set of RPCs. Each of these issues is a way of tricking the extension into running RPCs from untrusted JavaScript on any web page. The RPCs available allow an attacker to fetch the credentials for any site in the database or even execute arbitrary code on the host.

rajasinghe 9y ago

I used LastPass for a while. Then it filled in my username and password (correctly) on a website without my having authenticated... It looks like there's an unencrypted local cache which is not flushed when your authentication expires or you log out. I wasn't able to reproduce it but I was sufficiently spooked to stop using it after that.

stolsvik 9y ago
Sure it wasn't the browser that filled it in?