aimeeandbeatles
watermelon
- Joined
- Apr 5, 2007
- Messages
- 20,112
The site says its stored locally (on your machine). hmm. It says this fancy stuff
and this
AES utilizing 256-bit keys.AES-256 is accepted by the US Government for protecting TOP SECRET data. AES is implemented in JavaScript for the LastPass.com website, and in C++ for speed in the Internet Explorer and Firefox plug-ins. This is important because your sensitive data is always encrypted and decrypted locally on your computer before being synchronized. Your master password never leaves your computer and your key never leaves your computer. No one at LastPass (or anywhere else) can decrypt your data without you giving up your password (we will never ask you for it). Your key is created by taking a SHA-256 hash of your password. When you login, we make a hash of your username concatenated with your password, and that hash is what's sent to verify if you can download your encrypted data.
and this
Has your software been verified by an independent 3rd party?
3rd party verification is on our road-map. Members of Mozilla Corporations' Firefox Add Ons team have reviewed some parts of our Firefox code base and individual end-users have carried out their own external audit of our software to verify that it does what it purports to do. Namely:
Confidential data in your vault is encrypted before it is sent to LastPass
Encryption is performed using your LastPass Master password
Your LastPass Master password and encryption key generated from it never leaves your computer - so you are the only person who can decrypt your data
Steve Gibson, a respected security industry expert reviewed LastPass in his Security Now podcast and concluded 'This thing is secure every way you can imagine. And it's simple.'