LastPass - Answering Security Questions The Right Way

I was recently asked to take a look at LastPass. LastPass is an interesting solution to portable secure passwords - it works as a browser plugin, and works with IE and Firefox on MacOS, Linux, and Windows. It supports one time passwords, central synchronization, and a host of other features.

What impressed me the most, however, was the level of detail that the developers provide in their forum. These former eStara staffers give some great responses, as seen in this forum discussion which is a great example of how to answer questions about a password safe program effectively.

A user asks:

"You say you never receive and you never ask but when I access to your website I do send my password...
This is even more true when I don't have the lastpass plugin installed in FF and I just log to your site."

And Joe Siegrist, one of the founding developers responds:

You don't send your master password in either case, you may want to try it yourself to convince yourself: https://lastpass.com/faq.php#howcanilook

What's done is that password field is blanked out and the value is used to make a SHA-256 hash along with your email using JavaScript, locally on your computer.

As the discussion continues, further internal technical detail is explained:

We understand your concern and would like to help you verify. The data is base64'd AES encrypted data with the 256-bit key being made up by a SHA256(username+password) username is lowecased and has whitespace removed, password is untouched. m.lastpass.com is by far the simplest version to follow this logic. I can probably make an extremely simple page that just takes username+password and encrypts and decrypts data in JavaScript if needed.

I'll continue to look at LastPass for a while, but it looks like it may well be on my list of regular recommendations in the near future.