Thanks all 
Topic: LastPass - What are your thoughts? (Read 42,776 times)
I've had some issues with Firefox not dropping down the menu when I want it occasionally
LastPass also performs a large number of rounds of PBKDF2 server-side. This implementation of PBKDF2 client-side and server-side ensures that the two pieces of your data - the part that's stored offline locally and the part that's stored online on LastPass servers- are thoroughly protected:The notes on the account settings page recommend that you tweak up the round to 5000 if your setting is less.
(screen capture image, not copied)
By default, the x number of rounds that LastPass uses is 5000. LastPass allows you to customize the number of rounds performed during the client-side encryption process. If you log in to LastPass, open your LastPass vault from the LastPass Icon, and launch Account Settings, you will see the "Password Iterations" field displaying the current number of rounds used for your account. Although 5000 is currently the default number of rounds, your number may be lower if your account is older.
___________________________
[...] I increased the iterations (from 42? "Don't Panic" I guess) up to 5000 [...]
Ye gods. Mine was at 1. Now fixed. Agreed on the "they should communicate this stuff better" point -- and I AM a paid user.[...] I increased the iterations (from 42? "Don't Panic" I guess) up to 5000 [...]
Interesting. Mine was at 500.
I will be renewing later, but I am a Disability Pensioner and have had a lot of unexpected expenses recently! Also the exchange Rate was so high I had to wait for it to come down for other software.
I will be renewing later this year.
Hello Lynette,
Thank you for reaching out. Please enjoy your extended Premium subscription, which is now due to expire 2014-09-25.
Best,
They replied:What astonishingly nice people.QuoteHello Lynette,
Thank you for reaching out. Please enjoy your extended Premium subscription, which is now due to expire 2014-09-25.
Can't get better service than that!
Lachlan HuntQuoteBrianB_NY wrote:Quotemudlock wrote:
"Despite what anyone tells you, end to end encrypted e-mail is not possible in a webmail world."
Sure it is. Anything a stand-alone client can do, a browser can do....
Exactly. The author either doesn't understand that you can implement stuff client side (Javascript for example) or he is making the leap that because doing so could potentially be too slow (in execution cycles) to be usable equates to "not possible"
If you start doing the decryption with javascript, then there are a number of issues that make it impractical and not totally secure. The question of where the private key is stored still exists. For practical and usability reasons, it's most convenient for the service to maintain the keys on their servers. It's possible that those keys can be password protected to provide limited protection against snooping, but users are notoriously bad at picking good passwords. Alternatively, you have to find some way to let the user store the private key themselves, leaving them wholly responsible for keeping it secure and backed up.
But assuming you have a workable solution for private key storage, you also need a way for the browser to perform the decryption of the email content, which is separate from normal decryption performed as part of the SSL/TLS connection. If, as you suggest, this is done by some JavaScript in the page. Then that exposes a huge security hole.
If you give the JavaScript access to the key and the user's password for decrypting the key, then it is also possible for that script to send a copy of the password and/or decrypted key back to the server. You have to have a certain level of trust in the service provider that they won't do this. But, that is exactly what HushMail did, and they were forced to snoop the credentials of some specific users in order to turn over unencrypted emails to the authorities.
It's also, unfortunately, the approach taken by services like LastPass when you log in via the website, rather than the extention, or use their security check tool. Users have to trust that LastPass is never going to send any javascript for the purpose of stealing their credentials. But they could certainly do so if they were ordered to. They could theoretically even direct this malicious version of the script to a specific IP address or user account, so no-one else could possibly notice it.
[...]
This results in annoying "what do you want to open this link in?" prompts. Even after selecting "Always" use my default browser, I still get prompted which one to use occasionally.You've just solved a mystery for me. I've never understood why LastPass appears along with my tablet's 3 browsers when I'm asked "What do you want to open this link in?" I had no idea that LastPass had a browser. Many thanks for clueing me in.
I'm usually thorough about stuff like this, but this one I overlooked. I'm using Lastpass without any problems since 2010 and My number of "Password Iterations" was only 1, and when I've changed it to 5000 I've noticed that Firefox Lastpass addon is a little slower to login now, but I can live with that. LastPass also performs a large number of rounds of PBKDF2 server-side. This implementation of PBKDF2 client-side and server-side ensures that the two pieces of your data - the part that's stored offline locally and the part that's stored online on LastPass servers- are thoroughly protected:
(screen capture image, not copied)
By default, the x number of rounds that LastPass uses is 5000. LastPass allows you to customize the number of rounds performed during the client-side encryption process. If you log in to LastPass, open your LastPass vault from the LastPass Icon, and launch Account Settings, you will see the "Password Iterations" field displaying the current number of rounds used for your account. Although 5000 is currently the default number of rounds, your number may be lower if your account is older.
Just another thanks to IainB for info,
I've noticed LP acting slower lately also but wasn’t certain if it was the new version or the change to the iterations setting.
I've noticed LP acting slower lately also but wasn’t certain if it was the new version or the change to the iterations setting.
Well, I guess it's only logical for it to be slower and it's also using more cpu cycles during encryption since its number of rounds is much bigger now.
I only got notification of an update (version 3) today per email - is that the new version you're talking about?
Not me, I think it's safer to wait for a while, cause people are reporting many problems with this major version change.Most of the changes seem to be cosmetic -- and, once you get used to them, the lack of need to keep clicking up in the toolbar or the Lastpass icon, are reasonably good.
Original address: https://www.donationcoder.com/forum/index.php?topic=25361.0
