101–110 of 443 posts
I don't quite follow. The author says that by entering the URL " http://avlidienbrunn.se/@twitter.com/@hehe.php" , the extension is fooled into autofilling as if the browser was on twitter.com. What's the difference with simply going to " http://twitter.com" ? This looks more like a bug than a vulnerability, what am I missing?
I don't quite follow. The author says that by entering the URL " http://avlidienbrunn.se/@twitter.com/@hehe.php" , the extension is fooled into autofilling as if the browser was on twitter.com. What's the difference with simply going to " http://twitter.com" ? This looks more like a bug than a vulnerability, what am I missing?
Earlier quoted context omitted.
They sold their future. The next bug will be sold to the highest bidder.
People find and disclose bugs regularly even where there isn't a bounty. Most (at least 99.99%) developers don't want to see a useful, successful product fail even if they can personally gain from it. The likelihood that an exploit for Lastpass will be discovered by an attacker and sold to a nefarious actor is very small. Further to that though, we now know that this problem is fixed in LastPass. We don't know about…
Only when you believe that all password managers are equally secure from the start.
There are many reasons to believe that this is not the case. Storing passwords in a cloud service is quite a red flag. Then there is a former employee stating on Twitter that part of the codebase is very neglected:
Earlier quoted context omitted.
I want an alternative, got a good one?
If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)
I never trusted "cloud" (read: not yours) password stores. I have been using KeePass and manual syncing, but I had my doubts about it too.
This looks perfect and simple!
Earlier quoted context omitted.
Exactly this. I'm abandoning them now.
I want an alternative, got a good one?
I'm generally very sympathetic to regex bugs (especially in a language like JavaScript where you don't get nice expanded multiline regexes with comments), but I am wondering why they went with a regex in the first place. Did they decide `document.location.host` was too brittle for some reason?
Earlier quoted context omitted.
I'd say some of the points could be easily covered by something like KeePass which, unlike cloud, doesn't have to depend on questionable security of third-party services. For example. I use KeePass to store all my password. I keep my KeePass database in Google Drive, so any change to the file will be updated. because of that I can use KeePass on any machine that has access to Google Drive (I also keep executables for…
It's not really very much more effort. I use KeeFox (Firefox) and Keepass2Android (you can guess). I love both tools, they've made password management trivial, and I used to be a die-hard "one password for everything is just so much more convenient" fan.
Earlier quoted context omitted.
Let's do a little calculation to see if the payout is worthwhile. Using something illegally means you run the risk of going to prison. Let's say there's a 1% chance you get caught, the prison sentence is 10 years, and the evil hackers will pay you $20,000 for your bug. Let's also say that you're a mid-career software engineer in the US, and over the next 10 years you expect to make $2M (after taxes). This means your…
Is it still illegal when Lastpass actually stimulates you financially to pry into their systems?
Could someone explain me better the posted code that was vulnerable? I don't understand it. What's the returned value?, what is URL and url?, why the extension is expecting there must be a @ inside the url? Thanks! :-)
Essentially, LastPass made the mistake of writing code which said "If you see `example.com` anywhere in the URL - assume that you're on the right site.
LastPass will allow you to automatically fill in the username and password as soon as you visit a site (I think this is an optional feature).
An attacker convinces you to visit "badsite.wtf/@example.com/". LastPass sees the "example.com" and autofills the password field. The site has some JavaScript to detect the filled in details - and steals them.