lastpass-vault-parser

Adding on to what others have said, LastPass stored vault "metadata" unencrypted. Metadata included things the url. This allowed the attackers to prioritize cracking vaults of higher value. See a vault with just a facebook.com and google.com login? Skip it. See a vault with coinbase and 10 other crypto sites in it? Spend a few thousand trying to crack it. Source: https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...

[1] makes it seem like the number of rounds is included unencrypted at least on the client side binary databases. As it's sent over the wire when downloading the vault, lastpass would _have_ to have that in clear text somewhere. [1] https://github.com/cfbao/lastpass-vault-parser

https://github.com/cfbao/lastpass-vault-parser/blob/master/l... This says notes (encrypted). Do you have a different source?

All notes fields are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

Most data fields are encrypted in the LastPass vault. The real exception is URLs linked to passwords. Some metadata is also unencrypted (e.g. created date). Both the "secure notes" category and the "notes" section on a password are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

I found a third-party description[1], which someone in another forum linked to as evidence that notes inside items are encrypted. None of the other unencrypted fields feel as high-value as the URL field, although some of them are clearly valuable, such as whether the password was autogenerated, whether or not there are attachments, and last password change timestamp, which is convenient for comparing against known breaches. That said, I have no information as to the veracity of that description, except that others seem to be using the library it belongs to. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

A description of Lastpass's vault structure[1] suggests that notes inside entries were encrypted (index 4). I have no additional information about the veracity of that description though. [1] https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

The wiki (https://github.com/cfbao/lastpass-vault-parser/blob/master/l...) contains a list of all unencrypted fields in an `acct` data block. It is trivial to decode the custom format of LastPass (e.g. using exactly this tool, but figuring out the format manually doesn't seem much harder). If anyone is interested, although this is originally from 2018, all of these fields still exist and still only the same 6 fields are encrypted. I checked this by creating a LastPass account with a temporary E-mail and looking at the `getaccts.php` network request made upon login to the website. There also seem to be 3 new fields unknown to the tool (in the resulting csv these are just "?", "??", and "???"). "??" appears to be a timestamp of recent settings or password changes. Of particular interest are the following fields - "url": Probably the biggest

It looks like the only relevant data that was unencrypted are the URLs [0]. I'm guessing that was some sort of design decision they made for the browser extension to be able to see if you had a password for that site. If anything, apart from leaking the domain, which could still be a privacy issue, they should have at least sanitized the URLs to remove usernames or tokens if they were going to automatically save those URLs to the vault. I can guess that not doing so allowed their auto-login function to work on some websites by saving the login URL endpoint, but all I'd really want is the vault to keep the sanitized domain. [0]: https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...

This repo claims to document the vault format. https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...