I'm shopping around for a good password manager (yes, I'm picky) and today I ran into an interesting issue:
- I have my passwords stored in Google Password manager.
- For couple of sites I use LastPass to get the feel of it.
- For a new site I'm entering with saved-loaded credentials from GooglePass LastPass is offering to save entries to my vault. If I do, they are readable, decrypted and in plain sight.
- Since GooglePass saved credentials are supposed to be encrypted with my Google/Microsoft user/passwords HOW LastPass is able to read them? They are 'hidden' on the screen, and LastPass does not 'know' them. If I want to access them in GooglePass I need to provide my PC account credentials. How is it possible, that LastPass is doing (reading) it without any issues? Is it able to decrypt anything? Is it able to read ASC characters sent to the password box before they are 'hidden' on the screen as dots or stars? What about protection of my passwords I don't want to store in the vault
Since I act on the premise of 'limited trust' I'm slightly confused. Am I missing something obvious here?