Re:How did LastPass master passwords get compromised?
by Sebb767 on Thursday December 30, 2021 @05:05PM
(#29742051)
> Storing the encrypted database in the cloud and downloading it is the same as storing it locally if the decryption protocol is performed locally.
The problem is that, with web-based password managers, you are not only downloading the database, but also the code to decrypt it. A locally installed Keypass requires your PC to be compromised, whereas for LastPass it is sufficient for their servers to be compromised (while not avoiding the problem if you are compromised, either).
The problem is that, with web-based password managers, you are not only downloading the database, but also the code to decrypt it. A locally installed Keypass requires your PC to be compromised, whereas for LastPass it is sufficient for their servers to be compromised (while not avoiding the problem if you are compromised, either).