Is LastPass Secure?

Back in February I put out a post talking about Web Security: Managing Your Passwords, with the recent compromises on sites like LinkedIn, eHarmony and Last.fm I felt it was appropriate to go back and look at some of the technical aspects of the LastPass solution. Specifically on whether it is secure.

This week I was sent a podcast, Security Now with Steve Gibson, that supposedly talked to whether LastPass is secure so I figured why not give it a go. I learned a few things from it and thought I’d share it in a quick post, especially being how relevant a topic it is right now. Password management that is…

Summary of LastPass Features

1. Multi-platform Compatible

While not a security feature, its something I felt important to make note of. The idea is to have quick and ready access to your passwords, not having that access will lead you to become disenfranchised with the idea. I mean seriously, who has only one device these days.

What this specifically means is it’s easily accessible via a number of operating systems, browsers and mobile devices. This is perhaps one of the biggest pitfalls most other password managers suffer from in my opinion.

Some of their supported platforms include:

• Operating Systems: Windows, MAC, Linux
• Browsers: Internet Explorer, FireFox, Chrome, Opera
• Mobile: iOS, Android, Windows

2. It’s in the Encryption Baby

So here is the kicker that I learned about LastPass — all encryption is done locally. Its not just any encryption though, they are using SHA-256 (SHA = Secure Hashing Algorithm). The 256 means that it hashes it into 256 bits. But that’s the just the beginning…let’s see if you can keep up..

First, your local environment will create a 256 bit hash of your normalized username and password. Then it will concatenate the password with that hash into a new 256 bit hash. This then becomes your new token. As a side note, its been determined that to reverse engineer a 256 bit hash is a computational infeasibility right now a – crypto speak.

Second, when you first create a LastPass account the system creates you a unique 256 random ID that is tied to your account.

Third, to authenticate, your 256 key is concatenated with your login token and again, a new 256 bit hash is created. This then allows you to gain access to your information.

Holy crypto batman!!! Paranoid much?

3. How about Storage

The question then turns to the storage of the content on their servers.

We just saw the challenges of compromises such as the one at LinkedIn, eHarmony and Last.fm. So the good news is that all your content is stored in an undecipherable blob. The only way in is through use of the double hashed token concatenated with the ID stored in the blog.

What’s also nice is that the LastPass system was designed such that it never stores the unique token. I’m not a cryptographer by any means, but I can admit that I’m fairly impressed with their level of commitment to keeping our credentials safe.

Understanding SHA-256

So naturally, being that I’m not a cryptographer I wanted to better understand the implications of SHA-256. These were the three things that were relevant to me:

• One-way encryption algorithm – in other words once encrypted you can’t go the other way
• Cryptograhpic Hash Function
• Used to do message integrity checks and digitial signatures (e.g., authentication and message integrity)

As I mentioned before, I am not a cryptographer but I am a bit in tune with some of the web security challenges we’re faced with today. I personally use LastPass and while I recognize that as its on the web the probability of exploitation is higher, for me, its an acceptable risk to take.

Half the battle is knowing, and now that I know its authentication and encryption methods I feel more in tune with its security. I would argue that for the majority of the population, YES, it is secure.