4 ms·

Why in God's name would they store the URLs unencrypted? Even if they don't crack the account password, you've just given the attackers a lovely dossier of ever

Why in God's name would they store the URLs unencrypted? Even if they don't crack the account password, you've just given the attackers a lovely dossier of every place I've ever visited frequently enough to make an account. And this is far worse than simply doing reverse-lookups of my email address across site breaches, since I use multiple email addresses and alias-only logins. Nice. Fucking. Job.

meroje 4y ago
Presumably this would be to ease looking up individual items but 1password has been able to encrypt those since 2012. Nice indeed
edsimpson 4y ago
Does anyone know if bitwarden encrypts the URL? A quick search of their docs didn’t turn anything up.
- sliken 4y ago
  Each unique Bitwarden account has an encryption key derived from your Master Password, according to the methods defined in Encryption. This encryption key is used to encrypt all Vault data. From: https://bitwarden.com/help/account-encryption-key/ https://bitwarden.com/help/account-encryption-key/ Seems crazy for anyone to keep using LastPass
joenathanone 4y ago
Not to mention some of the saved URLs may include sensitive information in the URL query string, including things like email address, physical address, etc...
jasonhansel 4y ago
Also: thanks to "forgot my password" features, if someone gets your email password, they can now find and access all your (non-2FA-enabled) accounts.
- dvngnt_ 4y ago
  no because your email is usually 2fa. I could give you my gmail password right now but you wouldn't be able to be logged in
dotty- 4y ago
LastPass storing the URLs unencrypted is so mind boggling. What could possibly be the justification for that? Also -- LastPass is being intentionally unclear when they write >stored in a proprietary binary format that contains both unencrypted data, *such as* website URLs, What do you mean such as?? What else is unencrypted? Now is not the time for tip-toeing around this kind of stuff.
- intelVISA 4y ago
  > "proprietary binary format" weird term for std::vector<std::string>
  - papito 4y ago
    Savage!
  - leoh 4y ago
    Top-tier HN comment
- nycdotnet 4y ago
  This repo claims to document the vault format. https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass-Vault-Format https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...
  - midas 4y ago
    Notes field appears to be encrypted!
    - deleted 4y ago
      [deleted]
  - r0uv3n 4y ago
    I created a temporary account to check whether anything of this has changed since 2018, but no, the format is still entirely the same. The fields have slightly different names, but that might be because of the way I got the vault file (looked at network responses during login). There are also four fields not listed in the above link ("Form Fields", "?", "??", and "???"), but those might be an artifact of the process of reading the file. In particular all timestamps (creation, last modification, last access) are unencrypted, as are information about whether you want to auto-logon or auto-fill, whether the password was auto-generated and whether the password has been breached.

meroje 4y ago

Presumably this would be to ease looking up individual items but 1password has been able to encrypt those since 2012. Nice indeed

edsimpson 4y ago

Does anyone know if bitwarden encrypts the URL? A quick search of their docs didn’t turn anything up.

sliken 4y ago
Each unique Bitwarden account has an encryption key derived from your Master Password, according to the methods defined in Encryption. This encryption key is used to encrypt all Vault data. From: https://bitwarden.com/help/account-encryption-key/ https://bitwarden.com/help/account-encryption-key/ Seems crazy for anyone to keep using LastPass

joenathanone 4y ago

Not to mention some of the saved URLs may include sensitive information in the URL query string, including things like email address, physical address, etc...

jasonhansel 4y ago

Also: thanks to "forgot my password" features, if someone gets your email password, they can now find and access all your (non-2FA-enabled) accounts.

dvngnt_ 4y ago
no because your email is usually 2fa. I could give you my gmail password right now but you wouldn't be able to be logged in

dotty- 4y ago

LastPass storing the URLs unencrypted is so mind boggling. What could possibly be the justification for that? Also -- LastPass is being intentionally unclear when they write >stored in a proprietary binary format that contains both unencrypted data, *such as* website URLs, What do you mean such as?? What else is unencrypted? Now is not the time for tip-toeing around this kind of stuff.

intelVISA 4y ago
> "proprietary binary format" weird term for std::vector<std::string>
- papito 4y ago
  Savage!
- leoh 4y ago
  Top-tier HN comment
nycdotnet 4y ago
This repo claims to document the vault format. https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass-Vault-Format https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...
- midas 4y ago
  Notes field appears to be encrypted!
  - deleted 4y ago
    [deleted]
- r0uv3n 4y ago
  I created a temporary account to check whether anything of this has changed since 2018, but no, the format is still entirely the same. The fields have slightly different names, but that might be because of the way I got the vault file (looked at network responses during login). There are also four fields not listed in the above link ("Form Fields", "?", "??", and "???"), but those might be an artifact of the process of reading the file. In particular all timestamps (creation, last modification, last access) are unencrypted, as are information about whether you want to auto-logon or auto-fill, whether the password was auto-generated and whether the password has been breached.