“LastPass, a company that offers users a way to centrally manage all of their passwords online with a single master password, disclosed Monday that intruders had broken into its databases and made off with user email addresses and password reminders, among other data.”
But, you probably shouldn’t worry too much. LastPass utilizes AES 256-bit encryption on your device with the lastest PBKDF2 algorithms. I’ll go more in-depth of these shortly, but what you really need to know is that since the data is encrypted on your device, by the time it arrives on the LastPass servers in what they call a vault, they don’t even know what your passwords are. They’ll need to know your salt encryption key to even begin exposing your password. Before this, however, anyone looking at your passwords will need to know your master password, which is also encrypted. If you have two-way authentication, you’ll have to approve their access to your vault.
(more…)