3 ms·

Why do you assume it'd be stored in plain text rather than hashed? Also, what does compromising someone's local filesystem have to do with the functionality of

• Houshalter 13y ago
  Even if it's hashed, then the hash can still be used to reconstruct the lastpass passwords. And I'm just assuming that you can't trust your filesystem if your machine has been compromised by malware. You're right the keylogger probably isn't that complicated. It depends on what level of paranoia you have and how widely lastpass becomes adopted (thus more incentive to hack it.) More likely the keylogger will just get the first time you enter your password into lastpass and then steal it that way. The point is lastpass is designed to protect you from weak passwords and password reuse. It doesn't do anything to protect against attacks on your actual computer.
  • JangoSteve 13y ago
    Oh, I misunderstood you; I thought you were referring to the master password of LastPass as being plain-text or reversibly encrypted. You mean that the passwords stored by LastPass must be reversibly encrypted on disk. Yes, that's true. Password managers do open the door for such an attack, but they tend to be much less vulnerable to attacks in general than reusing the same passwords. Of course, it's really up to each person to decide what risks are acceptable in the trade-off between convenience and security. I think the main point was that a password manager would have been much less susceptible to the keylogger attack which lead to this particular incident.