Reader Comments (Page 1 of 1)

(Unverified)Aug 23rd 2008 5:58AM

Neutral

Just one simple thing. Encrypted or not, I would NEVER store all my passwords on some faraway server up high in the clouds. What if that server goes down? Or what if some Chinese hacker is attracted by this passwords-honeypot and manages to crack even a small part of it? To me, this is like saving your money in a cookie jar on a public park bench. No, thanks!

Dislike

Report

(Unverified)Aug 23rd 2008 7:59AM

Neutral

Henk -

LastPass has 2 data centers right now and your passwords are stored locally in a cache, so if we're down, you still have access to your passwords, can still export them, can still use them to login to your sites.

LastPass is an exceptionally poor target for hackers because we only have 256 bit AES encrypted data and unlike many companies, we hardly know anything about you.

We use AES-256 bit encryption, which is frankly extreme overkill for protecting your passwords, but we wanted to do everything in our power to make it safe: to quote NIST: http://www.nist.gov/public_affairs/releases/aesq&a.htm
"Assuming that one could build a machine that could recover a DES key in a second (i.e., try 2^55 keys per second), then it would take that machine approximately 149 thousand-billion (149 trillion) years to crack a 128-bit AES key. To put that into perspective, the universe is believed to be less than 20 billion years old. "

This is like storing your passwords in a vault in Fort Knox, and is significantly stronger than leaving them unencrypted on your PC.

Dislike

Report

Add your comments

Your comments:

Remember me

E-Mail me when someone replies to this comment

Please keep your comments relevant to this blog entry. Email addresses are never displayed, but they are required to confirm your comments.

When you enter your name and email address, you'll be sent a link to confirm your comment, and a password. To leave another comment, just use that password.

To create a live link, simply type the URL (including http://) or email address and we will make it a live link for you. You can put up to 3 URLs in your comments. Line breaks and paragraphs are automatically converted — no need to use <p> or <br /> tags.