Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

261–270 of 443 posts

Re: LastPass autofill exploit

#261

Post by DonHopkins »

mankyd wrote: post #246
DonHopkins wrote: post #238

He deserved a whole lot more than $1000 for discovering and reporting such a huge, idiotic security hole that should have never happened in the first place, and it should come out of the salary of whoever caused it by indulging their own laziness and convenience by abusing regular expressions so carelessly and casually.

> and it should come out of the salary of whoever caused it by indulging their own laziness and convenience by abusing regular expressions so carelessly and casually. No. People make mistakes. Honest, unintentional, well-meaning mistakes. Don't punish individuals for being human. Help them learn from them. Don't make individuals afraid to do their job. Should the _organization_ be punished? Should they pay more than…

So do you believe that a patient shouldn't be able to sue their doctor who took a shortcut that caused them harm?

Some people work in fields where there's an extremely high cost to making mistakes, and whose customers trust them to be careful and meticulous. Those people are paid to be more careful than your average code monkey who churns out regular expressions to save time instead of carefully researching the problem, performing code reviews, and using standard well tested libraries to parse complex but precisely documented standards like html and urls. Developing a browser plug-in to manage passwords is one of them.

Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. -JWZ

Re: LastPass autofill exploit

#262

Post by nichochar »

ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I have never understood the password manager market honestly. To me it's very obvious that the CONCEPT of a "single point of failure" is a terrible idea. Putting faith in one or the other is just like humans backing politicians, they think they are backing something when really they just got manipulated into an opinion which they slowly defend more and more.

Don't use a password manager, remember your passwords, or reset them all the time. It's a conceptual vulnerability, and if you read hacker news you are better than this.

Re: LastPass autofill exploit

#263

Post by xur17 »

The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well."

Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.

Re: LastPass autofill exploit

#264

Post by AGKyle »

favadi wrote: post #202
jxpx777 wrote: post #136

Earlier quoted context omitted.

Disclosure: I work for AgileBits, makers of 1Password. For desktop browser extensions that are properly using the frameworks, the extension's Javascript runs in its own execution context so the page cannot redefine variables. This protected 1Password when we discovered that a certain page had redefined the global JSON object, which provides parse and stringify functions among other things, to be the number 3, i.e. a…

When you are here, is 1password for team is the future and the classic 1password will become obsolete soon?

Disclaimer: I also work for AgileBits

We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions).

That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Password Family or 1Password Teams (and as of today, an Individual plan!) then it doesn't make a ton of sense to keep the standalone product around. So, it's probably one of those speak with your wallet kind of scenarios.

I'll certainly pass your feedback along, it sounds like you'd like to keep it around.

I hope that helps answer your question :)

Kyle

AgileBits

Re: LastPass autofill exploit

#265

Post by gnufied »

jxpx777 wrote: post #146
mabcat wrote: post #71

Earlier quoted context omitted.

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

Disclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

Long time 1Password user here. I use it on bunch of Machines and I wish you guys supported Linux. :(

Heck 1Password mostly works under Wine, except perhaps there is no unlock on Secure desktop and bunch of other usability things.

Re: LastPass autofill exploit

#266

Post by AGKyle »

throwanem wrote: post #250
jxpx777 wrote: post #136

Earlier quoted context omitted.

Disclosure: I work for AgileBits, makers of 1Password. For desktop browser extensions that are properly using the frameworks, the extension's Javascript runs in its own execution context so the page cannot redefine variables. This protected 1Password when we discovered that a certain page had redefined the global JSON object, which provides parse and stringify functions among other things, to be the number 3, i.e. a…

Out of curiosity, does this apply only to Chrome's extension framework, or to Firefox's and Safari's as well? Context: I'm a new 1Password user who is contemplating use of the extensions for those latter two browsers, and while it seems probable their extension frameworks offer the level of security you describe, I'd like to be certain before pulling the trigger. Thanks!

Disclaimer: I work for AgileBits as well :)

Hi there!

Yes, all 3 of the major browsers (and derivatives of them) offer the same support for a sandboxed execution environment. You can safely use any of them if that's a requirement you have :)

Kyle

AgileBits

Re: LastPass autofill exploit

#267

Post by wrboyce »

nichochar wrote: post #262
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I have never understood the password manager market honestly. To me it's very obvious that the CONCEPT of a "single point of failure" is a terrible idea. Putting faith in one or the other is just like humans backing politicians, they think they are backing something when really they just got manipulated into an opinion which they slowly defend more and more. Don't use a password manager, remember your passwords, or r…

Are you saying that you remember a unique and sufficiently random password for every website/app/etc you use? If so, you've got a far better memory that me.

Re: LastPass autofill exploit

#268

Post by throwanem »

AGKyle wrote: post #266
throwanem wrote: post #250

Earlier quoted context omitted.

Out of curiosity, does this apply only to Chrome's extension framework, or to Firefox's and Safari's as well? Context: I'm a new 1Password user who is contemplating use of the extensions for those latter two browsers, and while it seems probable their extension frameworks offer the level of security you describe, I'd like to be certain before pulling the trigger. Thanks!

Disclaimer: I work for AgileBits as well :) Hi there! Yes, all 3 of the major browsers (and derivatives of them) offer the same support for a sandboxed execution environment. You can safely use any of them if that's a requirement you have :) Kyle AgileBits

Neat, thanks!

Re: LastPass autofill exploit

#269

Post by mankyd »

DonHopkins wrote: post #261
mankyd wrote: post #246

Earlier quoted context omitted.

> and it should come out of the salary of whoever caused it by indulging their own laziness and convenience by abusing regular expressions so carelessly and casually. No. People make mistakes. Honest, unintentional, well-meaning mistakes. Don't punish individuals for being human. Help them learn from them. Don't make individuals afraid to do their job. Should the _organization_ be punished? Should they pay more than…

So do you believe that a patient shouldn't be able to sue their doctor who took a shortcut that caused them harm? Some people work in fields where there's an extremely high cost to making mistakes, and whose customers trust them to be careful and meticulous. Those people are paid to be more careful than your average code monkey who churns out regular expressions to save time instead of carefully researching the probl…

I seriously doubt this engineer was operating without code review, test infrastructure, and other safety checks in place. They aren't solely responsible.

If they don't have those types of checks in place, that's the fault of the company.

If someone want's to sue over this, then sure, sue the individual (and the company). But as a manager in company, I would not not punish the individual. I would have them conduct a thorough post mortem and look for ways to avoid problems like this in the future. People do learn from their mistakes and that is valuable.

Re: LastPass autofill exploit

#270

Post by ghurtado »

dkopi wrote: post #241
asjfkdlf wrote: post #137

Earlier quoted context omitted.

No, that is not possible. Extensions in Chrome run in a different execution context than the website. The website's document.creatElement is different from the extension's. If the website could override extension functions, attacks would already be possible by overriding Regex functions.

Good point, but that's assuming you're running in the context of the popup and not in the context of a content script. In the popup's script, you are using a new DOM. But in a content script - you're using the same DOM as the client, which can override createElement (and any other function as well).

My understanding is that the content script can access the webpage DOM, but not the other way around (it's a "one way street", if you will)
Post reply on HN