Download Squad

I'd like to think LastPass.com is a lot better than we make it sound, today we're just a bunch of developers, how could we make it sound good! (Full Disclosure: I work at LastPass.com).

We're standing on the shoulders of the open source movement to make LastPass.com happen, and nothing would make me happier than to release it as open source, but we can't do that right now.

We can release an open source version of how our encryption works (the website is this already actually), and using that you can audit it, and compare it to what we upload and download -- since we're just storing the locally encrypted data at LastPass.com, if you verify our local encryption implementation you can safely use LastPass because LastPass is just storing that encrypted data.

We've attempted to contact Daniel, and haven't had any reports about this from any other users but to be safe we've made sure that we backup the preference file before touching it going forward.

Same thing happened to me. I just gave up and deleted my profile. Could it be a conflict with Sxipper?

ixtab- We don't have a mobile version out yet, but will definitely have one soon -- iPhone is first, Blackberry second.

Truegod - We use OS X as one of our primary machines, so I'm surprised you're having so much trouble -- When you restart Firefox for the first time after installing LastPass, the create_account page should come up, but definitely shouldn't continue to show up.

Would you mind emailing support@LastPass.com with the version of Firefox and OS X you're using and we'll help you figure it out.

Thanks,

Joe

Fred -

It looks like "KeeFox" is at least a year away (if development continues), will be windows only, and Firefox only at that time, won't provide web access nor will it help portability and syncing. LastPass is here now, has Windows,Mac, Linux on Firefox, and IE on Windows.

As a KeePass user you've already realized you need a password manager, which makes you someone we'd love to get to try LastPass.

As for it being too intrusive -- you can disable the Firefox preference change we make during install (to turn off your built in password manager) in advanced in the installer. And we return your setting on uninstall, so we're definitely trying to do the right thing.

Joe

Mark -

There's some confusion here that's our fault -- The 'Password Manager' will always install the plugins, it's really more of an installer to get the plugins on to your PC, and to get insecure passwords off your PC and the resulting encrypted data into LastPass.

After install you should be interacting with the plugins and/or LastPass.com

We'll make that more clear in the next version.

Joe

Henk -

LastPass has 2 data centers right now and your passwords are stored locally in a cache, so if we're down, you still have access to your passwords, can still export them, can still use them to login to your sites.

LastPass is an exceptionally poor target for hackers because we only have 256 bit AES encrypted data and unlike many companies, we hardly know anything about you.

We use AES-256 bit encryption, which is frankly extreme overkill for protecting your passwords, but we wanted to do everything in our power to make it safe: to quote NIST: http://www.nist.gov/public_affairs/releases/aesq&a.htm
"Assuming that one could build a machine that could recover a DES key in a second (i.e., try 2^55 keys per second), then it would take that machine approximately 149 thousand-billion (149 trillion) years to crack a 128-bit AES key. To put that into perspective, the universe is believed to be less than 20 billion years old. "

This is like storing your passwords in a vault in Fort Knox, and is significantly stronger than leaving them unencrypted on your PC.

Henk -

It's a fair point, though if you look at our product closely you'll see a lot of features, and a lot of time and effort has been put in to do this right; and I'm talking about the little features that no one notices otherwise because the product 'just works' like refreshing open LastPass.com browser sessions when you add a password in another tab, or offering to replace an existing account, or confirm a password update. These things take a lot of time, and supporting IE and Firefox is more than double the amount of work.

My team and I also have a reputation which we've worked hard to build and wouldn't throw away; I was an executive at a software company which was acquired for $50M, and worked extensively with large Financial Service clients.

We originally started writing this months ago with everything encrypted server side (believe me, that's a lot easier), but stopped and spent an extra few months making sure we could make the entire system run with exclusively client side encryption because we wanted something that would hold up to scrutiny, wanted something we could use comfortably, something where the server could be stolen and we wouldn't be a head line news story.

There are other start-ups out there which are taking your password and keeping it on their servers, or using the built in, insecure password manager -- we didn't want to be like them.

Trust is earned, and we hope we're on the road to earning that trust.

Joe