is a 256-bit password, as shown by the RoboForm password generator, because there are 44 characters, using upper & lower case and numeric characters, no special characters and the minimum number of numeric digits is 2. “Exclude similar characters” is unchecked, as is “Hexadecimal 0-9, A-F”.

It would have been 128-bit, if there were 22 characters with only 1 numeric digit required, from the same sets of characters.

At least, now you know that LastPass 256-bit encrypted data is protected by a weaker password than the encryption itself, unless the password is at least 44 characters, with no more than 2 numerals required, using A-Z, a-z and 0-9.

However, it’s never a good idea to use exactly the minimum required. If a hacker knows exactly how many characters there are in a password, it becomes a much less difficult problem to decipher.

So, why not 50 or 60? The fewer numeric digits required, the better. If LastPass doesn’t require any, then 50 characters = 297-bits and 60 = 357-bits, and the generated password may or may not include numerals.

357-bits would provide 29,356,782,284,672,915,348,618,507,459,867e+96 possible combinations. More than the NSA is likely to decipher in your lifetime.

So, get a Yubikey, if you want to keep your data kept safe online, assuming you trust LastPass encryption more than “mark” does. I believe a Yubikey can handle a password that long, but I haven’t tried one yet.

However, if you don’t trust proprietary code, which (by definition) provides security by obscurity, then you’re better off with PasswordSafe, which is Free and Open Source, so it has been scrutinized much more than RoboForm or LastPass for properly implemented algorithms.

The RoboForm password generator does this quite nicely.

“Why wouldn’t you trust your encrypted data to be stored on a server?”

Because there could be implementation bugs in your software, for one thing. It’s not impossible that you sometimes mistakenly send unencrypted passwords to your server under certain circumstances. It’s not impossible that the encryption is done, but not done in the best way, and has weaknesses that should not exist.

Thanks for the clarification. I’m now more inclined to take a look at your offering.

LastPass works by locally encrypting data with 256-bit AES, then storing that for you so you can use it elsewhere. It’s quite safe if you pick a good master password.

If you trust NIST:

Q: What is the chance that someone could use the “DES Cracker”-like hardware to crack an AES key?

A: In the late 1990s, specialized “DES Cracker” machines were built that could recover a DES key after a few hours. In other words, by trying possible key values, the hardware could determine which key was used to encrypt a message.

Assuming that one could build a machine that could recover a DES key in a second (i.e., try 2^55 keys per second), then it would take that machine approximately 149 thousand-billion (149 trillion) years to crack a 128-bit AES key. To put that into perspective, the universe is believed to be less than 20 billion years old.

– NIST.gov AES Questions and Answers

LastPass uses a 256-bit AES key, so it would take many times longer than this. The risk of compromise of your locally encrypted data is exceedingly low.

Using LastPass is by far safer than what most people do, which is use a few passwords for every site. Many sites don’t hash passwords and simply store them in plain text, many sites don’t encrypt the channel for sending passwords. These are the pratical attacks that hackers can use to compromise you.

Joe Siegrist
LastPass

Sure, it can eventually be cracked. But I prefer a password storage system that writing it on sticky notes, any day.

I do agree on the compromise of online system. Though it sounds tempting (you can access your passwords everywhere, don’t even have to bring a pen drive), I would never trust my security on cloud computing.

I’ve tried KeePass, nah too complex. Currently using PasswordSafe and it is pretty good.

LastPass sounds promising, especially the integration with the web browser. I hope future builds will include Opera.