|
LastPass encrypts its data before sending it to their servers. The key for the data is generated using a combination of the master password and username. How then can a one-time password be used to decrypt this data? The data on the server has been encrypted with the master password and username. Does this mean that LastPass stores a new version of encrypted data for every (single-use) password? |
|||
|
|
As hunter notes, the only people who can really say what LastPass actually does are those who work there. However, as long as we only consider what they can and should do... They don't really need to store a separate copy of your data for each one-time password. Instead, all they need to store for each password is an encrypted copy of the key used to actually encrypt the data. So, when you log in using a one-time password, the password is (presumably) passed through PBKDF2 to derive a "key-encryption key", which is then used to decrypt the actual key needed to decrypt the data. |
|||||
|
|
The only people who can answer your question definitively are the programmers at LastPass, however, I'll try. I assume you're referring to this. If LastPass really does encrypt your data with your password/username, then logically it could only be decrypted with the same key. Their 'one-time' password feature is an interesting idea, but I'm dubious about it. They use 256-bit AES to encrypt your data - this is symmetrical encryption, which means that there's only one single key used for encryption/decryption. In answer to your question, yes - it would make sense that they would have to create/store a copy of your data, encrypted with the 'one-time' password, for each one-time password that you create. The only way (that I can think of) to avoid making a separate copy of your data for each 'one-time' password is if there is a server-side 'back-door' into your account, which would put your data at extreme risk (but I doubt this is the case). |
|||
|
|
