4 ms·

> LastPass storing the URLs unencrypted is so mind boggling. What could possibly be the justification for that? I've never used LastPass, but if the URLs would

• eks391 4y ago
  > So then you'd at least have to enter your password once on (browser) startup so it can load the list and keep that in memory, and you won't be able to automatically sync things either. Correct. However this is how it ought to be. If someone acquires my laptop, I dont want logging into my accounts to be as easy as opening the browser
• worksonmine 4y ago
  That's true when it's on the users device, but archived on their servers there's no need for any of the data to be unencrypted. Best case scenario it will never have to be accessed. Even encrypted with their keys would've been a better solution. I use pass and this attack vector is why I don't sync even in a private git repo like many suggest. I do sync but only encrypted tar files, and even then some sensitve sites are aliases instead of URLs. Sure it makes life a little more difficult but for some things convenience should be the last priority.
• slenk 4y ago
  This is the default with Bitwarden