5 ms·
No. Here is the explanation: "However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensi
by pgrote 13y ago
No. Here is the explanation:
"However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."
- jbinto 13y agoThis means "your passwords are safe, because they're encrypted with a key that only you have". It still means people could have hijacked your session, which is what GP was referring to. I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
- pgrote 13y agoI thought that too, until they mentioned logins at the end. Perhaps you are right. It would appear the session info would be compromised, but the login credentials would be protected.
- Xylanthia 13y agohijacking your session with lastpass wouldn't do someone any good, as they still wouldn't have access to anything. All they could attempt to get back is encrypted data. Your encryption key is never available.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- pixl97 13y agoLastpass appears to use TLS 1.2 with Forward Secrecy. They would have to hijack individual sessions (or somehow get the current session kays and capture the data at the same time).