Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

31–40 of 443 posts

Re: LastPass autofill exploit

#31

Post by ktta »

chrisan wrote: post #28
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

> I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. This bug doesn't seem to have anything to do with the cloud. FTA: > The bug that allowed me to extract passwords was found in the autofill functionality.

I meant the software as a whole and the fact that there can be vulnerabilities in the browser extension right now.

Re: LastPass autofill exploit

#33

Post by dkersten »

Its been recommended (at least as long as I've been using Lastpass, so a few years) that you keep autofill disabled, for exactly the reason mentioned in the article.

"Also, this would not work if multi factor authentication was on, so you should probably enable that as well."

If you have something as important as a password manager (ie something that holds the keys to ... everything), then MFA is a must. If you use LastPass without MFA, then you're probably asking for trouble.

Re: LastPass autofill exploit

#34

Post by [deleted] »

maze-le wrote: post #23
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Yes, my thoughts exactly. He could had made 100x that money on the black market, so no wonder we still have problems with 0days traded there. How long would you work for $1,000? Some days, a week, two? If you spend more than a week on this problem it seems not worth to report it... On the other hand, if you set the incentive for bug bounty too high I imagine all sorts of cranks pop up, that want to show off bugs that…

[deleted]

Re: LastPass autofill exploit

#35

Post by ktta »

viraptor wrote: post #19
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I think you could do a lot worse than lastpass. You could also do better, by sacrificing some usability. On the extreme side, you could use a separate, offline device, just for password storage. But I don't think it's worth getting excited about a single lastpass bug. Everything is vulnerable. There will be more of them. Chrome itself had 105 security issues, just this year ( https://www.cvedetails.com/product/15031/…

>Everything is vulnerable.

Well, that put it in perspective for me. I just googled the vulnerabilities in offline password managers like Keepass/X and 1Password. And oh man, I was pretty shocked to see even the offline ones could be broken into.

I think I just had a crisis of faith.

>you'll be more secure than 99% of people

Thanks. I guess since I don't store very sensitive info (financial, etc.), and the important services - Google, Github, Atlassian, AWS use 2FA. I guess I don't have to be paranoid.

Re: LastPass autofill exploit

#36

Post by 0xmohit »

One should really consider using open source tools for such things. The good thing is that those are battle-tested real well and are, usually, more secure than the commercial offerings.

An example is Vault [0].

Encryptr [1] is another alternative: it claims that "all of your data will be saved in encrypted format in our Zero Knowledge [2] cloud".

[0] https://github.com/hashicorp/vault

[1] https://spideroak.com/solutions/encryptr

[2] https://spideroak.com/features/zero-knowledge

Re: LastPass autofill exploit

#37

Post by mpeg »

tomw2005 wrote: post #22
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

The post does point out that this would not work if multifactor authentication is on. I would never dream of using my LastPass account without that anyway. Like with all decisions this is balancing risk/reward. The reward are all the points you have already expressed that I also love about LastPass. Currently I believe the risk is fairly minimal assuming you use 2 factor-authentication. Though I might turn off autofi…

MFA for the end site, not for lastpass. This bug would still have been exploitable with lastpass MFA.

Re: LastPass autofill exploit

#38

Post by y04nn »

mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

The fact that LastPass consider that a flaw in their system that could have put them on their knees is only worth 1K is quite frightening if you are relying on them for your security.

Re: LastPass autofill exploit

#39

Post by ktta »

Ronsenshi wrote: post #25
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I'd say some of the points could be easily covered by something like KeePass which, unlike cloud, doesn't have to depend on questionable security of third-party services. For example. I use KeePass to store all my password. I keep my KeePass database in Google Drive, so any change to the file will be updated. because of that I can use KeePass on any machine that has access to Google Drive (I also keep executables for…

What you do does seem pretty good.

Re: LastPass autofill exploit

#40

Post by littleweep »

ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I use Lastpass for work and can't stand it. I use 1Password for personal stuff (and some private work stuff now that I think of it) and highly recommend it. It's got a Chrome browser extension, mobile app, and like someone else mentioned below you can sync the encrypted db to a cloud service (iCloud, Dropbox, etc) so you can access it from all of your devices.
Post reply on HN