3 ms·
That's stunning to hear, and also speaks to "then they must not have been adding many features" or that file format must be absolutely rockstar. I'll try to mak
by mdaniel 4y ago
That's stunning to hear, and also speaks to "then they must not have been adding many features" or that file format must be absolutely rockstar. I'll try to make time to study it in order to learn which this is
(BTW, you also have duplicate comments: https://news.ycombinator.com/item?id=34110529 https://news.ycombinator.com/item?id=34110529)
- deleted 4y ago[deleted]
- r0uv3n 4y agoThe three additional data fields might fulfill some functions related to new features. Additionally, there is a full history of all former passwords which is transmitted in its own request, so in particular this vault format doesn't seem to contain all data LastPass has concerning a particular account (though what is unencrypted within this format is surely also unencrypted on the LastPass servers). I think I'd see no problem if LastPass had a great product and kept it as is for extended periods of time, I don't need new features every few months for a security product. But this should have all been encrypted from the start, and there were discussions about this 4 years ago already https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_reminder_that_lastpass_is_sending_the_url/ https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_re.... This could have been fixed for years, but it's the same even now.