[deleted]
LastPass autofill exploit
281–290 of 443 posts
Re: LastPass autofill exploit
#282Earlier quoted context omitted.
That's a very bad recommendation. Very few people are capable of remembering unique 10-character passwords for each site. I have like 100 passwords and accounts for various systems and I'm certainly not able to remember each of them. So either I start reusing passwords or I use a password manager.
You can vary the password based on the domain name with a predictable algorithm that only you know.
And hope you never have to change a password.
Re: LastPass autofill exploit
#283Earlier quoted context omitted.
No, that is not possible. Extensions in Chrome run in a different execution context than the website. The website's document.creatElement is different from the extension's. If the website could override extension functions, attacks would already be possible by overriding Regex functions.
Good point, but that's assuming you're running in the context of the popup and not in the context of a content script. In the popup's script, you are using a new DOM. But in a content script - you're using the same DOM as the client, which can override createElement (and any other function as well).
While content scripts (in the extension world, meaning scripts running in the context of a content page) shares the DOM with the untrusted page, it does not share the JavaScript wrapper layer around that DOM. This is extra confusing because the global object is a (JavaScript wrapper around a) DOM object.
The untrusted script can override its own view of createElement, but not the extension's view.
Re: LastPass autofill exploit
#284The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well." Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.
I assume it's because LastPass sends you the multi factor auth request before accessing your passwords (and therefore before allowing the autofill js stuff to use your password). I don't actually use LastPass so I'm not 100% sure, but this would be the most likely case imo
They only send the multi factor auth request when you first login to your account in the browser (and then every 30 days). Once you are logged in, autofilling works exactly the same.
Re: LastPass autofill exploit
#285Earlier quoted context omitted.
Why not take a look at the code injected by 1Password's browser extension and find out for yourself whether it handles URLs safely? That shouldn't be hard to do, and it's a lot healthier for the community than discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots.
I'm sorry, but I don't see how asking an employee of the company that makes the product that I use every day is "discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots". I think an official word holds more clout and is more valuable than any one person confirming for themselves in one version of one browser on one version of one OS.
Also, just because we're on Hacker News, it doesn't mean every reader is equipped to audit code for security vulnerabilities.
Presumably that's the job of a professional security developer that might reasonably be expected to have checked their own similar product for this vulnerability...
Re: LastPass autofill exploit
#286>They are still much better than the alternative (password reuse). I'm not sure if it is, bugs like that are a serious threat. Personally I use the same (long) password for every website, except one of the characters which I replace by the website's first letter. One could think of similar, more sophisticated schemes of password reuse that yield a slightly different password for each website. It would be even better…
Your "algorithm" is far less secure than using unique secure passwords through a PW manager. If someone got access to 2 (maybe 1) of your passwords, they would have all your passwords.
Re: LastPass autofill exploit
#287Last pass also has a flaw on 2Fa. They cache local copies of the encrypted files, and the auto-fill populates the fields after password, before promoting 2fa.
It does erase the fields and promoted 2fa, but passwords are available briefly.
I Sent a ticket to their supportthey, they acknowledged the issue and just asked me to disable local cache... (Chrome extension)
Re: LastPass autofill exploit
#288Earlier quoted context omitted.
I'm sorry, but I don't see how asking an employee of the company that makes the product that I use every day is "discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots". I think an official word holds more clout and is more valuable than any one person confirming for themselves in one version of one browser on one version of one OS.
I did speak rather harshly in my prior comment, and for that I apologize. Worse, I did a very poor job of expressing the concern that motivated me to respond. But I think it's still fair to ask whether your initial comment has value. I understand that, as a user of 1Password's browser extension(s), you may well feel some concern that a similar vulnerability exists, and I don't think it's unreasonable to want reassura…
Fwiw, his question did not sound at all like that to me. Your reaction feels like unfair personal bias. Not trying to start a fight but you seem openminded enough to hear it so figured Id let you know
Re: LastPass autofill exploit
#289Earlier quoted context omitted.
I'm sorry, but I don't see how asking an employee of the company that makes the product that I use every day is "discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots". I think an official word holds more clout and is more valuable than any one person confirming for themselves in one version of one browser on one version of one OS.
I did speak rather harshly in my prior comment, and for that I apologize. Worse, I did a very poor job of expressing the concern that motivated me to respond. But I think it's still fair to ask whether your initial comment has value. I understand that, as a user of 1Password's browser extension(s), you may well feel some concern that a similar vulnerability exists, and I don't think it's unreasonable to want reassura…
I understand a concern with my phrasing -- to be honest, I didn't put much thought into it as far as considering multiple interpretations.
I have sent a message to 1Password through the official customer support channel to ask the same question posed here. I'll update once they reply.
Re: LastPass autofill exploit
#290Earlier quoted context omitted.
Disclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)
While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?
Not a dev on either product, but I use 1Password for my personal accounts, and a corporate LastPass for my work accounts. I do not believe that 1Password is as immediately vulnerable as LastPass.
LastPass (on Chrome) will auto-fill information on a detected site, which a malicious site can read immediately.
1Password (on Chromium nightly) requires me to hit the 1Password Mini button and select a site/account to log in with. If 1Password had a similar vulnerability, a malicious site as described would merely wind up showing me accounts for the wrong site in the dropdown. Clicking one could wind up submitting/leaking my credentials to the attacker, though.