I'm a LastPass user but not really in love with it. If I were to switch, which is best and WHY? I need it to support chrome and Android.
I like password-store.org for its unixness.
LastPass autofill exploit
231–240 of 443 posts
Re: LastPass autofill exploit
#232Earlier quoted context omitted.
Disclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)
While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?
What you are really "asking" is logically equivalent to this blaming statement:
"I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass."
Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population, which only serves to spread the insanity to others.
Don't feed the fear with dissonance.
Edit: It is NOT "reasonable" to ask questions with negation in them which assume blame in a piece of software which is, by a rather large assumption, a completely different code base. Reason is based on logic. This question was based on fear and uncertainty, and only serves to spread it further.
You downvoters can go fuck yourselves.
Re: LastPass autofill exploit
#233Earlier quoted context omitted.
And somebody looked, so clearly the bounty worked! But the cost to find a bug has practically nothing to do with the impact of the bug. The incentive is to find bugs, not a particular world ending bug.
How do you know it hasn't already been found and actively exploited? Regardless, if a company isn't willing to demonstrate they value security to my satisfaction I won't be a customer.
I am absolutely OK with the idea that you'd stop using LastPass because they have a bug this dumb. I'm even OK with you believing that LastPass should pay more than other companies because they are so clearly reliant on external researchers to work on spec to find the simplest possible flaws in their code.
The only problem I have is with the virulently bogus meme that companies should pay more for vulnerabilities because otherwise the "black market" will outbid them. No:
* The "black market" does not in fact want these vulnerabilities.
* Finding a vulnerability and then not using it to to enter into a criminal conspiracy simply isn't praiseworthy, and reasonable people don't have to paid not to do that. It's hard enough to do this kind of work in a society that believes there's something sketchy about finding vulnerabilities at all, without the constant chatter about how maybe they could just make a living by enabling crime.
* The argument doesn't even make logical sense. If the vulnerability is easy to find and exploit (as this one was), then no matter how severe it is, it doesn't command a high price because you could spend less money to independently rediscover it. Moreover, there are surely many other vulnerabilities to be found in the same target. The economics of the argument are all wrong.
Re: LastPass autofill exploit
#234Earlier quoted context omitted.
While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?
What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…
I see no need to read that into it. It's a reasonable question. Sounds like they just want to know if they, as a 1Password customer, could be affected. A little misguided, but a reasonable question.
Re: LastPass autofill exploit
#235Earlier quoted context omitted.
Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…
"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…
Heh.
https://mathiasbynens.be/demo/url-regex
https://lostechies.com/chadmyers/2010/11/20/parsing-a-url-wi...
https://stackoverflow.com/questions/27745/getting-parts-of-a...
What do all these have in common? They all demonstrate that it is hard to write a regex that parses URLs.
Regex's hide programming mistakes because they not only become harder for humans to parse as they get more complicated, but also there isn't simple programming code to handle potential security vulnerabilities in-line with the code. It also hides the [at least] two considerations of secure programming: designing a secure function, and handling the function securely.
Re: LastPass autofill exploit
#236Earlier quoted context omitted.
While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?
What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…
Or maybe he's just curious if this type of url regex fail is more widespread among similar software.
Re: LastPass autofill exploit
#237Earlier quoted context omitted.
The people who are not the majority of researchers would be... Wait for it... A minority of researchers.
So... a minority of people aren't capable of causing trouble? I don't see your point.
This is a crazy argument. HN is a community populated in large part by software developers, most of whom will at many different times in their careers ship vulnerable code they wrote. You're saying that if you start a new company, you should either (a) get your code absolutely perfect, which nobody ever manages to do, including people who go to great expense to try, or (b) be held hostage by extortion schemes to pay greater sums for vulnerabilities lest the discoverers exploit them to cause the most possible damage to your company.
You know who does fine in a world where that's the norm? Facebook. No matter where vulnerabilities get valued at, they will be a rounding error expense to Facebook.
You know who does not do fine in that world? Anyone smaller than Facebook.
Thankfully, that's not the norm in the real world. Unfortunately, the real norm is: if you pay a bounty at all, random people on Twitter and message boards will claim you're being negligent by not paying more for them. The lesson then is: don't offer a bug bounty. All you're doing is attracting negative attention.
You know who does fine in the real world where that's the norm? Apple and Cisco. Really, so does Facebook, despite the bullshit flak they take for their bounties.
You know who does not do fine in the real world? End-users.
Re: LastPass autofill exploit
#238He deserved a whole lot more than $1000 for discovering and reporting such a huge, idiotic security hole that should have never happened in the first place, and it should come out of the salary of whoever caused it by indulging their own laziness and convenience by abusing regular expressions so carelessly and casually.
Re: LastPass autofill exploit
#239Earlier quoted context omitted.
What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…
Or maybe he's just curious if this type of url regex fail is more widespread among similar software.
Then say that as a hypothesis and stop asking leading questions (which are blaming in nature) from people who make it their business.
Re: LastPass autofill exploit
#240I am using PasswordSafe ( pwsafe.org ) and Dropbox to sync to the cloud. I do not use autofill, nor I asked my browser to manage my passwords. There are a mix of opensource and commercial implementation covering all platforms (iOS, Android and what not). PasswordSafe has also been audited.
Why isn't PasswordSafe more popular ? What do other password managers have that Password Safe does not ?