3 ms·

Is LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a fun

Is LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a funny joke for anyone who understands even a little about cryptography.

dividedbyzero 4y ago
I see why it's a bad idea, but what does that have to do with cryptography?
- mikechalmers 4y ago
  I don't understand enough to know why it's a bad idea but Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behaviour, so this part seems clear to me.
  - dividedbyzero 4y ago
    It's a bad idea because URLs, email addresses and user names help with phishing, identity theft, social engineering, matching with other leaks, may lend themselves to blackmail (certain dating apps) or otherwise endanger people (gay dating apps in certain places), for very questionable benefit. No definite idea if they really do that, but if they did, that would strike me as irresponsible. Also, I think the failure here is to not use cryptographical methods in the first place which would seem to be a screw-up in a different security specialty.
- jacquesm 4y ago
  At a minimum a bunch of non-encrypted data might give you some cribs to try. HN12345[*] is easier to find if you know that the website used is called Hacker News. [*] Not my actual password.
driscoll42 4y ago
This is very frustrating... I operated with LastPass on the assumption that the other data was encrypted in there. So backup authentication codes stored. Alas, time to invalidate a bunch of crap.
- daveoc64 4y ago
  Most data fields are encrypted in the LastPass vault. The real exception is URLs linked to passwords. Some metadata is also unencrypted (e.g. created date). Both the "secure notes" category and the "notes" section on a password are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md https://github.com/cfbao/lastpass-vault-parser/blob/master/l...
indutny 4y ago
As a shameless plug I'd like to suggest the project that I have been using for my personal credentials for quite some years now: https://derivepass.com/ https://derivepass.com/ . The encrypted website metadata is stored only locally (with only optional remote sync, and even that has to be your own server), and the passwords are not stored at all (they are generated from your master password).
autophagian 4y ago
According to their security notice from a couple days ago, they have "fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data." So, according to them, they encrypt the other fields. I suppose the website field is unencrypted to enable autodetection or something like that.
- Fire-Dragon-DoL 4y ago
  As I reported, they encrypt everything but URLs, which is still very bad
  - bkaplowitz 4y ago
    This is incorrect as I understand it. See: https://www.reddit.com/r/1Password/comments/za0zpn/any_vault_items_not_encrypted/iykavli?utm_medium=android_app&utm_source=share&context=3 https://www.reddit.com/r/1Password/comments/za0zpn/any_vault... They specifically do encrypt everything, with URLs being only briefly exposed for favicons (a feature you can turn off easily in 1P and in bitwarden where it is also done.)
    - Fire-Dragon-DoL 4y ago
      I referred to lastpass, sorry for the confusion
runlevel1 4y ago
1Password and Mac OS X Keychain used to do that.[1] They'd leave the URL and title in plain text, amongst some other metadata. I think both no longer do, but the fact that they once did was very surprising to me. [1]: https://1password.community/discussion/12237/metadata-is-not-encrypted https://1password.community/discussion/12237/metadata-is-not...
- mdaniel 4y ago
  In their defense, the treat model was way different back when they were using local vaults; I suspect the old "cloud storage" model they used placed each individual user who chose to sync opvault to the cloud at some risk, but short of Dropbox or OneDrive themselves getting popped, the cloud attack against 1P vaults was very limited It doesn't escape me that their threat model could still be that, if they'd relent the cloud-only licensing choice

dividedbyzero 4y ago

I see why it's a bad idea, but what does that have to do with cryptography?

mikechalmers 4y ago
I don't understand enough to know why it's a bad idea but Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behaviour, so this part seems clear to me.
- dividedbyzero 4y ago
  It's a bad idea because URLs, email addresses and user names help with phishing, identity theft, social engineering, matching with other leaks, may lend themselves to blackmail (certain dating apps) or otherwise endanger people (gay dating apps in certain places), for very questionable benefit. No definite idea if they really do that, but if they did, that would strike me as irresponsible. Also, I think the failure here is to not use cryptographical methods in the first place which would seem to be a screw-up in a different security specialty.
jacquesm 4y ago
At a minimum a bunch of non-encrypted data might give you some cribs to try. HN12345[*] is easier to find if you know that the website used is called Hacker News. [*] Not my actual password.

driscoll42 4y ago

This is very frustrating... I operated with LastPass on the assumption that the other data was encrypted in there. So backup authentication codes stored. Alas, time to invalidate a bunch of crap.

daveoc64 4y ago
Most data fields are encrypted in the LastPass vault. The real exception is URLs linked to passwords. Some metadata is also unencrypted (e.g. created date). Both the "secure notes" category and the "notes" section on a password are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/lastpass-vault-format.md https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

indutny 4y ago

As a shameless plug I'd like to suggest the project that I have been using for my personal credentials for quite some years now: https://derivepass.com/ https://derivepass.com/ . The encrypted website metadata is stored only locally (with only optional remote sync, and even that has to be your own server), and the passwords are not stored at all (they are generated from your master password).

autophagian 4y ago

According to their security notice from a couple days ago, they have "fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data." So, according to them, they encrypt the other fields. I suppose the website field is unencrypted to enable autodetection or something like that.

Fire-Dragon-DoL 4y ago
As I reported, they encrypt everything but URLs, which is still very bad
- bkaplowitz 4y ago
  This is incorrect as I understand it. See: https://www.reddit.com/r/1Password/comments/za0zpn/any_vault_items_not_encrypted/iykavli?utm_medium=android_app&utm_source=share&context=3 https://www.reddit.com/r/1Password/comments/za0zpn/any_vault... They specifically do encrypt everything, with URLs being only briefly exposed for favicons (a feature you can turn off easily in 1P and in bitwarden where it is also done.)
  - Fire-Dragon-DoL 4y ago
    I referred to lastpass, sorry for the confusion

runlevel1 4y ago

1Password and Mac OS X Keychain used to do that.[1] They'd leave the URL and title in plain text, amongst some other metadata. I think both no longer do, but the fact that they once did was very surprising to me. [1]: https://1password.community/discussion/12237/metadata-is-not-encrypted https://1password.community/discussion/12237/metadata-is-not...

mdaniel 4y ago
In their defense, the treat model was way different back when they were using local vaults; I suspect the old "cloud storage" model they used placed each individual user who chose to sync opvault to the cloud at some risk, but short of Dropbox or OneDrive themselves getting popped, the cloud attack against 1P vaults was very limited It doesn't escape me that their threat model could still be that, if they'd relent the cloud-only licensing choice