LastPass Password Manager 4.36.1

[T3rM1nat0Rr3]

LastPass is an online password manager that automatically fills in saved logins and forms with the click of a button. This handy little Web freeware and browser plug-in also syncs your data to any computer you use regularly. With LastPass you won't need to remember passwords anymore. You can easily log into your websites with a single click of your mouse. You can set up multiple 'profiles' and automatically fill your personal information into web forms accurately and safely. It protects against identity theft by keeping sensitive data encrypted on your PC. Your LastPass vault isn't limited to only securely storing usernames and passwords, any confidential text data can be placed in your vault for safe keeping.

Thanks to Astron for the update.

Download

[uffbros]

I have 4.37 dated 11-8-19

[debebee]

 

32 minutes ago, uffbros said:

I have 4.37 dated 11-8-19

Same here, best just let the brosers download/update  the plugins via their individual stores/addon reposotories

[mp68terr]

8 hours ago, T3rM1nat0Rr3 said:

LastPass is an online password manager

 

8 hours ago, T3rM1nat0Rr3 said:

keeping sensitive data encrypted on your PC

 

Getting lost, is lastpass an online password manager, or an offline one, or both?

[T3rM1nat0Rr3]

14 minutes ago, mp68terr said:

Getting lost, is lastpass an online password manager, or an offline one, or both?

 

I wouldn't have a clue. All software descriptions are predefined.

Someone who uses LastPass might be able to answer your question.

[psyko666]

21 minutes ago, mp68terr said:

 

 

Getting lost, is lastpass an online password manager, or an offline one, or both?

 

If you are logging in via the LastPass browser extension, it will automatically switch to offline mode and you'll still be able to view your stored data. ... If we're offline you're still able to login in offline mode, and you'll still be able to add or change sites while LastPass is off the air.

 

Edit: Typo

 

[PistalPete]

2011 security incident

On Tuesday, May 3, 2011, LastPass discovered an anomaly in their incoming network traffic, then a similar anomaly in their outgoing traffic. Administrators found none of the hallmarks of a classic security breach (for example, a non-administrator user being elevated to administrator privileges), but neither could they determine the anomalies' cause. Furthermore, given the size of the anomalies, it was theoretically possible that data such as email addresses, the server salt, and the salted password hashes were copied from the LastPass database. To address the situation, LastPass took the "breached" servers offline so they could be rebuilt and, on May 4, 2011, requested all users change their master passwords. They said that while there was no direct evidence that any customer information was compromised, they preferred to err on the side of caution. However, the resulting user traffic overwhelmed the login servers, and company administrators—considering the possibility that existing passwords had been compromised was trivially small—asked users to delay changing their passwords until further notice.^[27][28]

2015 security breach

On Monday, June 15, 2015, LastPass posted a blog post indicating that the LastPass team had discovered and halted suspicious activity on their network the previous Friday. Their investigation revealed that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised; however, encrypted user vault data had not been affected. The company blog said, "We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed."^[29][30]

2016 security incidents

In July 2016, a blog post published by independent online security firm Detectify detailed a method for reading plaintext passwords for arbitrary domains from a LastPass user's vault when that user visited a malicious web site. This vulnerability was made possible by poorly written URL parsing code in the LastPass extension. The flaw was not disclosed publicly by Detectify until LastPass was notified privately and able to fix their browser extension.^[31] LastPass responded to the public disclosure by Detectify in a post on their own blog, in which they revealed knowledge of an additional vulnerability, discovered by a member of the Google Security Team, and already fixed by LastPass.^[32]

2017 security incidents

On March 20, Tavis Ormandy discovered a vulnerability in the LastPass Chrome extension. The exploit applied to all LastPass clients, including Chrome, Firefox and Edge. These vulnerabilities were disabled on March 21, and patched on March 22.^[33]

On March 25, Ormandy discovered an additional security flaw allowing remote code execution based on the user navigating to a malicious website. This vulnerability was also patched.^[34][35]

2019 security incidents

On Friday, August 30, 2019, Tavis Ormandy reported a vulnerability in the LastPass browser extension in which Web sites with malicious JavaScript code could obtain a username and password inserted by the password manager on the previously visited site.^[36][37] By September 13, 2019, Lastpass publicly announced the vulnerability, acknowledging the issue was limited to the Google Chrome and Opera extensions only; nonetheless, all platforms received the vulnerability patch.

[frankl1n]

I wouldn't touch this soft with a 10' pole!

Never ever ever ever ever ever store your siht online!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 

 

[Stig]

On 11/16/2019 at 5:55 PM, mp68terr said:

 

 

Getting lost, is lastpass an online password manager, or an offline one, or both?

LastPass stores your data on its servers, and for that reason I don't use or trust it.

 

I use Enpass which gives you total control of your passwords which are stored locally.

But you can Sync it with OneDrive if you wish to enable access to your passwords from all of your devices.

[mp68terr]

23 minutes ago, Stig said:

LastPass stores your data on its servers, and for that reason I don't use or trust it.

 

4 hours ago, frankl1n said:

Never ever ever ever ever ever store your siht online!

 

Same here, using keepassxc, all stored locally, integration/interaction with browsers is not enabled, and no auto-type.