[walterbell]

STRIP (https://www.zetetic.net/strip/) is a mature offline password manager that has been around since the late 1990s, available on iOS, Android, Windows and OSX. It uses the open-source encryption extension to SQLite, https://github.com/sqlcipher/sqlcipher, developed by the same company.

STRIP supports mobile-desktop synchronization over local wifi or remote cloud (Dropbox & Gdrive).

[llimllib]

> STRIP supports mobile-desktop synchronization over local wifi or remote cloud (Dropbox & Gdrive).

Right, but the threat model here is exactly the same! Except you're trusting Dropbox and Google instead of LastPass.

[walterbell]

Or you can use local WiFi -- now you have a choice. If you do choose a cloud service, note that the database file is encrypted by STRIP, https://www.zetetic.net/blog/2014/09/10/how-strip-syncs-with...

"When initialized with a passphrase SQLCipher derives the key data using PBKDF2 (e.g. OpenSSL’s PKCS5_PBKDF2_HMAC_SHA1 on some platforms.) Each database is initialized with a unique random salt in the first 16 bytes of the file. This salt is used for key derivation and it ensures that even if two databases are created using the same password, they will not have the same encryption key."

[PuffinBlue]

The LastPass database is encrypted client side too. Only the encrypted blob is synced to the cloud. Are people under the impression the passwords are stored up in the cloud in a for accessible to LastPass or otherwise unencrypted?

https://lastpass.com/whylastpass_technology.php

[sk5t]

Only if you want to use that approach for syncing; you can also sync strip with local files, then delegating cross-device accessibility to network share, btsync, or something else.