Even if the sites name was encrypted, since it is confirmed, that the URL is not, that wouldn’t have mattered. If you used LP to store the credentials for „embarrassing-site.com“ in LastPass now the attackers know and maybe if the stolen data end up being made public maybe over BitTorrent (happened with other stolen data before), everyone can see it.
Really really bad and I can’t believe that in their blog posts they still use the term „zero knowledge“, which I is simply not the case and claiming to have such a policy is just a lie.
I spoke to their support person by phone who told me that site titles were NOT encrypted but usernames, passwords and notes were encrypted.
"FlyingHawk" wrote:For more details, see this table: [url=https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass-Vault-Format#user-content-structures-of-some-types-of-composite-data-blocks:xua9zhl0]LastPass-Vault-Format[/url:xua9zhl0]
11 sn Is a Secure Note (0/1)
If you found this discussion useful, why not register/sign-in? It only takes a minute to share your feedback, ask a question, or vote for a new feature!