3 ms·
The notice uses language that implies that other fields were unencrypted too: contains both unencrypted data, such as website URLs, as well as fully-encrypte
by nequo 4y ago
The notice uses language that implies that other fields were unencrypted too:
contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data
“Such as website URLs” reads like it’s giving one example among multiple other fields that are unencrypted.
Now I wonder if the notes are not in fact encrypted either since if the user wanted those to be secure too, they would’ve written them in a “secure note.”
- pcthrowaway 4y agoIf notes are unencrypted then I'm absolutely fucked. I really hope this isn't the case. I assumed they were, I thought I read they were even. But now I can't find anything confirming this. Lastpass, please advise
- wlonkly 4y agoA description of Lastpass's vault structure[1] suggests that notes inside entries were encrypted (index 4). I have no additional information about the veracity of that description though. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md#structures-of-some-types-of-composite-data-blocks https://github.com/cfbao/lastpass-vault-parser/blob/master/l...
- weaksauce 4y agoI agree the verbiage does make is seem that way but also the language could just be imprecise so we'd need a formal statement from them on it to know either way.