Storing Passwords?

I keep my passwords in and on a manila folder.

Multifactor Authentication and Security is handled by Smith & Wesson.

I didn't mention the "G" word. It's against forum policy but Texas is not unique in that regard. :)

We are unique in that we have our own water, gas, oil, electric, food and fuel so it matters not.

You missed a good series on the History Channel the last few weeks. It was about how the "country" of Texas was formed and the beginning of the Texas Rangers (law enforcement, not the baseball club).

An official was once asked why he sent only one Ranger to handle a riot. He replied; "It was only one riot".

logicearth said:

What resides on their end is an authentication hash that is made in-part with your password but it goes though so many iterations you cannot get your master password from it. It goes though thousands of iterations on the client side before sending to Lastpass. It then goes though several more iterations before being stored. The sole purpose of that authentication hash is just to say "yes you are the owner of this data." An attacker cannot use it to decrypt your data or to your account.

Of course you can read all about in the Lastpass blog.

And btw, the salt is just for their end on storing the authentication hash. Overkill but still adds some strength to the stored hash.

Sure, it is unlikely that the hash can be turned back into a password...
...but, I would not say never.

Is it never. It is mathematically impossible, that is not even a debate. It goes though so many iterations it can never be turned back to the source material.

Using iterations in general only means it will be more time consuming to generate the hashes. Both for users and hackers. It doesn't mean it's impossible to crack.
Sure, you can't revert a hash to its source but there are other ways. The hackers will redo all steps needed to create the hash(including iterations, any salt etc). Then they do this for all possible password combinations and run it millions or billions of times on multiple and powerful CPU/GPUs. When they finally end up with a generated hash that matches the hacked hash, they know what the password is. Simplified example:

Hacked hash: sldjkfh345se
Re-generated hash for password "Test": fjeiojri334jikk
Re-generated hash for password "Test1": ejeiud837fgk
Re-generated hash for password "Test2": sldjkfh345se
Match found! Password is "Test2"

The salt isn't overkill as it makes any successful crack attempts useless on all other hacked accounts and they need to start the process over for every account. Or maybe even give up...

My advice is to use a master password that's at least 20 characters long. That's too much to generate hashes for.