LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot

LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot of information about you, but not your password: https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details https://grepular.com/LastPass_Vulnerability_Exposes_Account_... Specifically it exposed your email address, your password reminder, the list of sites you log into and the history of your logins, including which sites you logged into, the time and dates you logged into them, and the IP addresses you logged in from. EDIT: I used to use LastPass but now I use a GPG encrypted file, which I sync between machines. I set up a simple helper script so I can just type for example "password facebook" at a terminal and it will do a gpg --decrypt on the text file, grab the facebook password, display it, and also copy it into my clipboard for ten seconds.