4 ms·
The encryption/decryption is done client side. This is a simple version of how it works, your master password isn't sent to lastpass, just an encryption key wh
by aestra 13y ago
The encryption/decryption is done client side.
This is a simple version of how it works, your master password isn't sent to lastpass, just an encryption key which is created with your email address and master password. On the website this is done client side with javascript. When you click on the pencil icon, you are reading the decrypted file, which you have decrypted on your own computer, with javascript.
- jmillikin 13y agoClient-side decoding in a web app is not secure against the host of the web app, because the decryption code can be changed at any time to contain arbitrary backdoors. Lastpass stores the encrypted secret, and they serve the Javascript that decrypts the secret, so they should be assumed to have access to the secret.