- It employs a zero-knowledge model with AES-256 encryption, ensuring that the master password never leaves the user's device.
- It suffered serious breaches in 2022 due to human error and the use of personal equipment, resulting in multimillion-pound fines in the UK.
- It has implemented profound improvements, including the ISO 27701 standard and a more robust cloud infrastructure to prevent new incidents.
If you're looking for a way to avoid going crazy with so many passwords, you've probably come across LastPass. This password manager has become one of the most popular tools for centralizing all access to our accounts, from email to online banking, thus preventing us from having to memorize impossible combinations or, even worse, using the same one for everything.
But of course, when we talk about internet security, there's always controversy. LastPass has gone through some rough patches and has been in the eye of the storm due to some security vulnerabilities, leading many to question whether it's truly reliable to entrust them with access to our digital lives. Let's take a closer look at how it works and what exactly has happened.
How does LastPass protect your data?
The foundation of their entire system is what they call the zero-knowledge model . This basically means that the company has no idea what your master password is. This key only exists in your head and is processed locally on your device, so it's never stored in plain text on their servers.
To make this possible, they use a fairly robust technical process. They employ 256-bit AES encryption along with a derivation function called PBKDF2 and a salted, secure hash (SHA256). In simpler terms: they transform your password into a complex encryption key that serves to lock your vault. When you try to log in, the system verifies that the generated hash matches the stored one, ensuring that only you can decrypt the information.
Main tools and functions
Beyond simply storing usernames and passwords, this software offers a host of extras that make life easier. Among its most notable features are:
- Secure key generator: creates random combinations based on whatever you want (length, symbols, uppercase letters) and runs them through the zxcvbn library to ensure they are not easy to guess.
- Automatic fill: forgets to write down information on forms, addresses, or credit cards by hand.
- Note and PIN management: allows you to save any sensitive digital record in an encrypted environment.
- Reinforced security: includes support for two-factor authentication (MFA) and access via biometrics such as fingerprinting.
All of this is available in a multi-platform ecosystem that ranges from extensions for Chrome, Firefox, Edge, Opera and Safari, to native applications for Windows, macOS, Android and iOS.
The shadow of security incidents
It hasn't all been smooth sailing. Between 2011 and 2022, the platform suffered several setbacks. The most significant occurred at the end of 2022, when an attacker managed to infiltrate the development environment. The problem began with a vulnerability in an employee's computer in Europe and then spread to another employee's personal computer in the United States.
This second attack was the most critical because the employee had access to essential decryption keys. The hacker used a keylogger to steal the employee's master password and bypassed multi-factor authentication by stealing a trusted cookie. Most seriously, the employee mixed up their personal and work accounts using the same password, facilitating access to AWS and customer data.
As a result, data from approximately 1,6 million users in the UK was leaked, including names, emails, and saved website URLs. Consequently, the UK's ICO fined them £1,2 million for failing to adequately secure their systems and allowing the use of personal devices for critical tasks.
Measures taken and current situation
After these scares, the company has taken decisive action to clean up its image and improve its infrastructure. They have migrated to a much more secure cloud platform and implemented the use of managed devices to prevent a recurrence of the errors experienced with personal equipment.
Furthermore, they have strengthened their regulatory compliance by incorporating the 2022 version of ISO 27701 and passing IRAP assessments. They now have teams specializing exclusively in threat intelligence and privacy, centralizing all transparency in a Compliance Center. Although some researchers, such as Mike Kuketz, warned about the use of marketing trackers, the company has continued to evolve to minimize vulnerabilities.
To this day, LastPass remains a viable option because vault encryption is done on the user's device. Although personal data could be compromised, real passwords remained secure thanks to the zero-knowledge system. For those seeking alternatives, options like 1Password, Bitwarden, or NordPass exist, but the key is always to enable two-factor authentication and keep the software updated to avoid leaving the door open to cybercriminals.
