URL encryption

I have been using LastPass for a long time, I never really understood that the URLs in the walls were not encrypted, as they were “in the vault“ I’m experimenting with other password managers, and they all appear to encrypt your URLs. Paragraph

So simple question is LastPass planning to encrypt URLs. If they are planning it, then I can hold off and not switch, if they are not planning it it seems like a dealbreaker.

Find more posts tagged with

Accepted answers

norbeck

Creating multiple posts to ask the same question over and over will not get you a faster response. Nor will it endear you to the community.

You are not getting an answer because no one knows. LP is not saying. (One rep has posted here a handful of times since the breach announcement on 12/22, and mostly with boilerplate nonsense that says nothing conclusive or helpful.) Which is why most of us are taking the safe route in assuming that the fact that LP has failed to take anything close to adequate responsibility thus far is an indication that they will not take responsibility in the future, either, and are getting out.

All comments

tdg7070tdg

That is a very thoughtful answer, and I suspect you are correct

tdg7070tdg

I looked at my file and I know that my email address is stored in an unencrypted fashion. That is also the salt of the encryption. So if a bad actor that work for the company could look at my email address, look at the website, I go to, see a high value, target, and then build a look up table specific to my account that would not be hard.

norbeck

And that is just one of the reasons this breach is so damaging, and LP's lack of ownership/response so disturbing.

norbeck

Creating multiple posts to ask the same question over and over will not get you a faster response. Nor will it endear you to the community.

You are not getting an answer because no one knows. LP is not saying. (One rep has posted here a handful of times since the breach announcement on 12/22, and mostly with boilerplate nonsense that says nothing conclusive or helpful.) Which is why most of us are taking the safe route in assuming that the fact that LP has failed to take anything close to adequate responsibility thus far is an indication that they will not take responsibility in the future, either, and are getting out.

suzannewiley12

Yeah, it’s surprising when you realize stuff like that—makes you rethink security. I saw a discussion about similar concerns on https://fapello.org.uk/; worth checking for some insights.