Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I can't simply understand how using LastPass is secure. All an attacker need to do is to compromise the single LastPass account and then he has also compromised all other websites.

What's so good about that compared to the traditional approach to have separate accounts per site?

Is it really better to have one strong master password, strong site-specific passwords that can be accessed via the master password than having weaker passwords, but different on all websites?

share|improve this question
    
Exactly how are you going to remember strong passwords for several dozen sites? I'm counting 160+ credentials stored in my vault at this time. That's not even counting securely stored pin codes for cards and software license keys I'm keeping in there as well. Apart from a very few exceptions, every password in there is randomly generated, using any available character for the particular site, and of maximum length or somewhere over 20 characters. LastPass can sniff out duplicates for me and can give a report of where I'm compromising security. –  G_H May 21 '13 at 8:45
add comment

6 Answers 6

up vote 37 down vote accepted

Aside from allowing you to create unique, complex passwords for each site, we also offer free second factor authentication: Grid. So your username and password are not enough to access your data when Grid is used.

In addition, your passwords are not stored in Firefox's or IE's password managers which are generally insecure (just run our installer and watch how we can pull all of the passwords).

As for storing in the cloud, everything is encrypted locally before it is sent to the server and your key is never sent to us. You can read more about how we keep you safe on the technology page on our website.

share|improve this answer
9  
i do appreciate the sincere integrity of your service, yet the old paranoia dies hard. and the fact that your company is based in the US of A (not too far from Washington) doesn't help much either. if agents of Homeland Security or other less-existent agencies show up, flashing credentials and reminding you of your patriotic duty i think your best intentions aren't worth much. i hope you don't mind that i prefer a local solution. –  Molly7244 Jan 2 '10 at 19:48
18  
Actually, molly, it sounds like everything is encrypted and decrypted client-side - as in, they can't access anything by themselves. If that's true, I don't see why this is any less secure than having something locally. –  Phoshi Jan 2 '10 at 21:26
8  
Yes, everything is encrypted locally. We frankly don't want the liability of being able to access your sensitive data, it is an unnecessary risk that we do not want to take. FWIW, we were ranked in pcmag's top 100 products of 2009, ranked in pcworld's best security products of 2009 and are currently being featured on google chrome's extension site as their top picks. –  Bob from LastPass Jan 2 '10 at 22:08
2  
fair enough (although Google may not be my preference to rate privacy-related products given their track record), but the fact remains that my passwords are ultimately no longer exclusively accessible by myself when they are stored online, regardless the sophistication of protective measures. –  Molly7244 Jan 2 '10 at 23:28
3  
It's nice to hear from a first-party. +1 for your "Grid" technology, that's a really smart idea. :) –  Sasha Chedygov Jan 3 '10 at 0:28
show 6 more comments

I don't consider LastPass particularly safe (like anything that is stored 'in the cloud'), I much prefer a local solution (for example, KeePass). The convenience of having online access to login information comes at an unacceptable price (at least for paranoid old me).

share|improve this answer
2  
KeePass has Unix (KeePassX) and Windows versions, and works from a USB drive (perfect for passwords for sites like SuperUser). –  Roger Pate Jan 2 '10 at 19:04
    
@Molly - nicely put. –  ldigas Jan 2 '10 at 19:15
5  
@Molly It appears that the LastPass info is encrypted locally, not "in the cloud". –  phoebus Jan 2 '10 at 23:19
    
quite so, yet the information is no longer exclusively accessible by myself when stored on an external server. it's a trade-off, convenience for exclusiveness, a risk i'm not willing to take. –  Molly7244 Jan 2 '10 at 23:49
1  
I'm using it, but the trick is to keep the key store file up to date and backed up. This is the tradeoff with the online password keepers. –  owlstead Dec 31 '11 at 1:42
show 3 more comments

What makes it secure is simply that they cannot tell anyone what your passwords are, even with a gun to their head. Even when using the web interface, your passwords are encrypted locally before being transmitted.

Yes, it is true that it provides a "single point of failure" unless Grid is used. However, you could have a ridiculously strong master password - who cares if you have to type a 100 character password if you only do it once a day? And because it saves your "sub passwords", you can have them a lot stronger than you normally might.

Another advantage is that most people won't have different passwords for every website (or will have a pattern), and LastPass lets you ditch this. So whereas before every single site you were on was a potential entry point to all other sites you were on, now only your LastPass account is. Cracking any "sub password" yields no extra information to an attacker.

This is useful because you have no idea whether sites you are on are encrypting your password, or salting it. I could name a website with 11 million users that stores passwords unencrypted in their database.

Finally, LastPass offers features like one time passwords for accessing your passwords in untrustworthy locations, which keeps your account secure from even the most advanced keyloggers.

share|improve this answer
    
That's a good point.. most people reuse their password.. or have two or three that cover all bases –  trideceth12 Oct 18 '11 at 12:02
add comment

Just had a quick look at their site - I think your points are correct... If someone cracks your password there, they have all your passwords - it simply bundles a few features from a few programs in to one program.

From looking there, there is nothing that makes me think it is "more secure" than having separate passwords for different sites - as you will be anyway... Last pass simply makes it easer to manage.

share|improve this answer
    
The Lastpass service doesn't work like that as explained in Bob's comment. What people seem to be missing nowadays is that the most insecure way to store your sensitive data and passwords is at the pc side. Many people use the insecure password features of Firefox, Chrome etc. while that is a wrong feeling of security. A good hacker, smart thief or trojan only needs a minute to get all your passwords, access your mail and other data. Lastpass doesn't have any information then encrypted rubbish on their side. How can a security agency compromise that? The key is on the pc side. –  Rick Steven Jan 3 '10 at 2:12
    
If you run the LastPass windows installer, we pull all of your passwords from IE, FF and Chrome (btw...if we can do it, any program can) and then offer you the ability to delete them. We definitely feel we are much more secure than this status quo way of remembering your passwords in the browser and we are much more convenient as well. –  Bob from LastPass Jan 3 '10 at 4:13
add comment

It might be helpful to know Steve Gibson (of Security Now! fame) referred to LastPass in a podcast:

... what I have to say is, I think, the best solution possible.

share|improve this answer
add comment

No online password storage tool can assure you security. They claim that the host proof password storage mechanism hides the passwords from the host, and only the client side knows the key and the decrypted form.

But the following blog post shows a flaw in that assertion:

One reason why we can't trust online password storage

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.