4 ms·

This repo claims to document the vault format. https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass-Vault-Format https://github.com/cfbao/lastpass-vaul

• midas 4y ago
  Notes field appears to be encrypted!
  • deleted 4y ago
    [deleted]
• r0uv3n 4y ago
  I created a temporary account to check whether anything of this has changed since 2018, but no, the format is still entirely the same. The fields have slightly different names, but that might be because of the way I got the vault file (looked at network responses during login). There are also four fields not listed in the above link ("Form Fields", "?", "??", and "???"), but those might be an artifact of the process of reading the file. In particular all timestamps (creation, last modification, last access) are unencrypted, as are information about whether you want to auto-logon or auto-fill, whether the password was auto-generated and whether the password has been breached.
• bb101 4y ago
  Field 6 "sharedfromaid": "aid of the sharer's Site/Secure Note" is unencrypted. The hackers will be able to infer relationships between Lastpass users. Field 10: "genpw": "Is an auto-saved generated password". Good for deciding whether to brute force or not. Yikes. I can't imagine why anyone would trust Lastpass after this.
  • wlonkly 4y ago
    Last password change date is a good way to figure out if a password is in a known breach dump, too.