Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

201–210 of 443 posts

Re: LastPass autofill exploit

#201

Post by niij »

jxpx777 wrote: post #146
mabcat wrote: post #71

Earlier quoted context omitted.

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

Disclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

How easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.

Re: LastPass autofill exploit

#202

Post by favadi »

jxpx777 wrote: post #136
dkopi wrote: post #124

Earlier quoted context omitted.

While that might be an "easy way" - it isn't a secure way in this case. Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function. And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname

Disclosure: I work for AgileBits, makers of 1Password. For desktop browser extensions that are properly using the frameworks, the extension's Javascript runs in its own execution context so the page cannot redefine variables. This protected 1Password when we discovered that a certain page had redefined the global JSON object, which provides parse and stringify functions among other things, to be the number 3, i.e. a…

When you are here, is 1password for team is the future and the classic 1password will become obsolete soon?

Re: LastPass autofill exploit

#203

Post by [deleted] »

baby wrote: post #173

Does someone understand the snippet? var fixedURL = URL.match(/^(.*:\/\/[^\/]+\/.*)@/); fixedURL && (url = url.substring(0, fixedURL[1].length) + url.substring(fixedURL[1].length).replace(/@/g, "%40")); It looks like: * fidexURL is whatever is after :// and up until the very last @ (greediness) * the second line fixedURL && is going to complete if fixedURL is not undefined * url = this fixedURL, then the rest of it w…

[deleted]

Re: LastPass autofill exploit

#204

Post by niij »

jxpx777 wrote: post #146
mabcat wrote: post #71

Earlier quoted context omitted.

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

Disclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

How easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.

Re: LastPass autofill exploit

#205

Post by dkopi »

jxpx777 wrote: post #136
dkopi wrote: post #124

Earlier quoted context omitted.

While that might be an "easy way" - it isn't a secure way in this case. Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function. And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname

Disclosure: I work for AgileBits, makers of 1Password. For desktop browser extensions that are properly using the frameworks, the extension's Javascript runs in its own execution context so the page cannot redefine variables. This protected 1Password when we discovered that a certain page had redefined the global JSON object, which provides parse and stringify functions among other things, to be the number 3, i.e. a…

Great point. Exactly the type of comments I come to hacker-news for!

Re: LastPass autofill exploit

#206

Post by AGKyle »

niij wrote: post #201
jxpx777 wrote: post #146

Earlier quoted context omitted.

Disclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

How easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.

Disclosure: I also work for AgileBits :)

We have a dedicated LastPass import option. See here:

https://support.1password.com/import-lastpass/

If you encounter any trouble please write into support at agilebits dot com and mention "Kyle" somewhere in the body of the email and I'll get notified. You should be fine though, but every once in awhile we have someone encounter trouble with the import from LastPass.

Re: LastPass autofill exploit

#207

Post by lyonlim »

If autofill is potentially so dangerous, and in this instance, the prerequisite setting for this to work, why should it even be a feature?

People who enable it might not understand the repercussions.

I use 1Password and always invoke a shortcut to fill in my credentials.

Re: LastPass autofill exploit

#208

Post by ktta »

andybak wrote: post #116
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

> I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. This was a client-side bug and so surely doesn't depend on the fact that your passwords are 'stored in someone else's cloud'? i.e. If there was only local storage of passwords this vulnerability would still be there. (Also worth noting that lastpass encrypts your remote and local store with a key wh…

repeating my other comment: 'I meant the software as a whole and the fact that there can be vulnerabilities in the browser extension right now.'

Re: LastPass autofill exploit

#209

Post by djrogers »

tptacek wrote: post #180
lkbm wrote: post #177

Earlier quoted context omitted.

> and suggesting otherwise is a grave insult to hundreds of researchers who would never dream of attempting (and, of course, inevitably failing) to "sell bugs to the black market". No, suggesting otherwise is saying that a bounty program with high enough rewards can reach both legitimate security researchers and sketchy folks. This is in no way a slight on the first group.

So the people on this thread saying that this particular researcher didn't get paid enough to "do the right thing" just mean that this person seems a little sketchy?

Clearly not - merely that this bug could just as easily have been discovered by someone 'a little sketchy' and $1000 wouldn't be a big enough reward to skip setting up a watering hole or two for lulz.

Re: LastPass autofill exploit

#210

Post by riskable »

chrisper wrote: post #190
imglorp wrote: post #92

Earlier quoted context omitted.

Don't use anything that runs in the DMZ (browser), if you care about your secrets. I use keepassx, which requires manual search, copy, paste but it can store its vault on a cloud drive, mobile etc. and can have a key file or password.

What do you mean? Autotype is available in KeepassX.

Autotype is a bit risky because it assumes you've got the correct window/element focused. All it takes to expose your passwords is for a pop-up (e.g. instant message) to appear at the right moment.

Even if you don't hit the enter key/submit the form it is still possible for that incorrect window/app to grab your keystrokes.

Post reply on HN