5 ms·

It would probably be more accurate to say that LastPass has the information to decrypt your vault if they can guess your password. By contrast 1Password would n

It would probably be more accurate to say that LastPass has the information to decrypt your vault if they can guess your password. By contrast 1Password would need to both guess your password and guess your personal secret key. The latter is effectively impossible assuming the key generation was well-implemented. The trade-off is that users must keep track of their own secret keys.

panick21_ 2y ago
What if in lastpass you have 2FA?
- TingPing 2y ago
  2FA has nothing to do with the encryption, if that data is leaked.
  - panick21_ 2y ago
    My understanding is some of the key strength was to low. If 2FA increases the key strength, that should have an impact no?
    - MyOutfitIsVague 2y ago
      2FA does not increase the key strength. The key is solely derived from the password. 2FA limits access to somebody who already has the password to get in. The LastPass leak was of a backup, though, for which 2FA does nothing.
      - panick21_ 2y ago
        I see, that's unfortunate.
Everdred2dx 2y ago
How does that work with sharing vaults between devices?
- pigbearpig 2y ago
  You have to provide the secret key to each device on initial setup. After that, you just need your password.
  - HeatrayEnjoyer 2y ago
    What if you're in a foreign location and your devices are all stolen or lost?
    - 9x39 2y ago
      You'd have to contact someone to get the secret key from your 1Pass emergency kit, wherever you stored it. That is, unless you can memorize long strings of numbers really well.
      - deleted 2y ago
        [deleted]
    - soraminazuki 2y ago
      Then you have a much bigger and immediate problem at hand.
      - TeMPOraL 2y ago
        Not really. The biggest, most immediate and most threatening problem in this scenario, is inability to access your passwords, and therefore inability to use banking and means of electronics communication.
      - HeatrayEnjoyer 2y ago
        What do you mean? There's a tourist experiencing this scenario probably every minute.

panick21_ 2y ago

What if in lastpass you have 2FA?

TingPing 2y ago
2FA has nothing to do with the encryption, if that data is leaked.
- panick21_ 2y ago
  My understanding is some of the key strength was to low. If 2FA increases the key strength, that should have an impact no?
  - MyOutfitIsVague 2y ago
    2FA does not increase the key strength. The key is solely derived from the password. 2FA limits access to somebody who already has the password to get in. The LastPass leak was of a backup, though, for which 2FA does nothing.
    - panick21_ 2y ago
      I see, that's unfortunate.

Everdred2dx 2y ago

How does that work with sharing vaults between devices?

pigbearpig 2y ago
You have to provide the secret key to each device on initial setup. After that, you just need your password.
- HeatrayEnjoyer 2y ago
  What if you're in a foreign location and your devices are all stolen or lost?
  - 9x39 2y ago
    You'd have to contact someone to get the secret key from your 1Pass emergency kit, wherever you stored it. That is, unless you can memorize long strings of numbers really well.
    - deleted 2y ago
      [deleted]
  - soraminazuki 2y ago
    Then you have a much bigger and immediate problem at hand.
    - TeMPOraL 2y ago
      Not really. The biggest, most immediate and most threatening problem in this scenario, is inability to access your passwords, and therefore inability to use banking and means of electronics communication.
    - HeatrayEnjoyer 2y ago
      What do you mean? There's a tourist experiencing this scenario probably every minute.