Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

LastPass advertises that they do local encryption of passwords before they are transferred and stored on their website. However, when I log in with my past password, I can access all my passwords in clear text there. Doesn't this imply that they also have access to all my passwords? How can I verify that they do not have access to my passwords?

share|improve this question

migrated from superuser.com Jan 16 '11 at 15:21

This question came from our site for computer enthusiasts and power users.

7  
add comment

2 Answers

up vote 11 down vote accepted

All encryption/decryption occurs on your computer, not on our servers. This means that your sensitive data does not travel over the Internet and it never touches our servers, only the encrypted data does.

[...]

Your encryption key is created from your email address and Master Password. Your Master Password is never sent to LastPass, only a one-way hash of your password when authenticating, which means that the components that make up your key remain local. This is why it is very important to remember your LastPass Master Password; we do not know it and without it your encrypted data is meaningless. LastPass also offers advanced security options that let you add more layers of protection.

Source: http://lastpass.com/help.php?topic=whysafe&nw=1&fromwebsite=1

In other words, your computer encrypts your passwords with your email and master password and sends that data to Lastpass. When you authenticate with your master password at Lastpass.com, Lastpass.com returns all your encrypted passwords, which are decrypted locally on your computer with your email and master password. Every communication happens over SSL, so anything intercepted is doubly useless (since everything is encrypted with not just the SSL keys but with your email and master password).

The best way to ensure this is to set up a script to monitor network activity and see if anything that is decrypted (including the master password) goes to lastpass.com. Based on what I've seen on forums, it seems other users have done this and found nothing suspicious.

share|improve this answer
    
How come I can login to lastpass.com in Safari (w/o Lastpass firefox plugin) and see all my passwords then? –  chovy Jan 18 '13 at 9:32
1  
@chovy You see them in your browser - that is different then seeing them on the server. Yes, the raw data comes from the server, but it is decrypted using data local to your computer before it is shown to you. –  Tom Mar 4 '13 at 16:16
add comment

I just verified what waiwai said, and only a hash was transmitted to the lastpass server, and only encrypted passwords were returned. It looks like a key derived and stored in local storage. To steal your master password, a vulnerability or compromise of the server would (or at least should) be needed for someone to modify the way the application behaves. My opinion is that lastpass is safe for normal web usage, but should not be used for high-value targets that skilled attackers may be after.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.