This works the same way as any other cloud based password manager but less secure. Most work like this:
- Store a AES-256 encrypted database blob in the cloud
- Hash your master password using a slow/expensive hashing algorithm, and use the resulting hash for encryption/decryption.
- Offer 2F options to restrict who can requested the encrypted database blob/test the master password.
- Ask for the master password, try to decrypt the header of the blob, if it works return the blob.
This solution stores an AES-256 encrypted database in public, therefore cannot offer 2F, and is only protected by the quality of your private key (and I cannot even see which hashing algorithm they're using).
Someone unironically said in this thread they "never trusted LastPass" (implying this is safer) but technologically you don't specifically need to trust LastPass.
Regardless of if you're using DropBox, Google Drive, or LastPass for Cloud Storage the primitives are the same: AES-256 Encrypted Blob, Cloud Protected Storage (w/2F options), and a hashed master password.
If you want to roll your own LastPass, use KeePass and DropBox with 2F. Not this.
- Store a AES-256 encrypted database blob in the cloud
- Hash your master password using a slow/expensive hashing algorithm, and use the resulting hash for encryption/decryption.
- Offer 2F options to restrict who can requested the encrypted database blob/test the master password.
- Ask for the master password, try to decrypt the header of the blob, if it works return the blob.
This solution stores an AES-256 encrypted database in public, therefore cannot offer 2F, and is only protected by the quality of your private key (and I cannot even see which hashing algorithm they're using).
Someone unironically said in this thread they "never trusted LastPass" (implying this is safer) but technologically you don't specifically need to trust LastPass.
Regardless of if you're using DropBox, Google Drive, or LastPass for Cloud Storage the primitives are the same: AES-256 Encrypted Blob, Cloud Protected Storage (w/2F options), and a hashed master password.
If you want to roll your own LastPass, use KeePass and DropBox with 2F. Not this.