4 ms·
You're entirely right of course, the vault data as accessed in the breach need not necessarily be in the same format as what is transmitted to the client. And
by r0uv3n 4y ago
You're entirely right of course, the vault data as accessed in the breach need not necessarily be in the same format as what is transmitted to the client.
And yes, the whole repository is from 2018, but I checked again today and it seems only 3 additional fields were added. In particular the same fields are unencrypted as before.
- mdaniel 4y agoThat's stunning to hear, and also speaks to "then they must not have been adding many features" or that file format must be absolutely rockstar. I'll try to make time to study it in order to learn which this is (BTW, you also have duplicate comments: https://news.ycombinator.com/item?id=34110529 https://news.ycombinator.com/item?id=34110529)
- deleted 4y ago[deleted]
- r0uv3n 4y agoThe three additional data fields might fulfill some functions related to new features. Additionally, there is a full history of all former passwords which is transmitted in its own request, so in particular this vault format doesn't seem to contain all data LastPass has concerning a particular account (though what is unencrypted within this format is surely also unencrypted on the LastPass servers). I think I'd see no problem if LastPass had a great product and kept it as is for extended periods of time, I don't need new features every few months for a security product. But this should have all been encrypted from the start, and there were discussions about this 4 years ago already https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_reminder_that_lastpass_is_sending_the_url/ https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_re.... This could have been fixed for years, but it's the same even now.