Hacker News Reader

Comment by starquake | Hacker News Reader

I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be Dropbox, later I was using BitTorrent Sync, but what tool sync shouldn't really matter. As I see it: the tool only gets to see and sync an encrypted file. You could even use a USB stick and not sync at all. Or only sync on LANs.

I love it how I get to decide who or what gets to see the encrypted file.

Now hopefully the Keepass audit will not reveal any issues in the encryption.

View on HN

Similar here, also using KeePass. Fairly happy to sacrifice some of the usability for more control and less "cloud".

Lastpass also only syncs data after it's encrypted locally, so the threat model is the same.

You're right about that. The threat model is equal when using Dropbox. It's still different when you use a local LAN share or a USB stick though.

Not entirely, since you download the encryption code way more often (for example, when you open the "Lastpass Vault", which is just a website like any other). Parts of Lastpass are simply a website, not part of the browser extension, and as an avid Lastpass user in all honesty I don't know which parts.

This matters because even if it's client-side encryption, the encryption code just got downloaded when you opened the site so if the server or the network was compromised, you got compromised. [0]

With Keepass, the only time you run that risk is when you download Keepass.

[0] As far as I can tell, this is the core argument of tptacek's "javascript crypto considered harmful" rant (https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...). I'm not sure, because it's written worse than his most drunken HN comment, but I believe it is.

Ah, yes, I was assuming the website would be avoided. I didn't realize it was hard to distinguish (I don't personally use LastPass, I prefer Firefox Sync).

I'm pretty sure when using the Chrome extension, all the HTML/JS is downloaded locally once when installing the extension, as logging in via the extension brings you to a chrome-extension:// URL. When logging in via lastpass.com, of course, you will be redownloading the crypto code every time.

I was hoping for someone to audit, keepass. Lets see what happens.

Reply on news.ycombinator.com