Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

301–310 of 443 posts

Re: LastPass autofill exploit

#301

Post by ruipgil »

tedmiston wrote: post #189
jxpx777 wrote: post #141

Earlier quoted context omitted.

Disclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)

While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?

If they're not using regex, they can't be affected by it anyways

Re: LastPass autofill exploit

#302

Post by notJim »

jamie_ca wrote: post #290
tedmiston wrote: post #189

Earlier quoted context omitted.

While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?

Not a dev on either product, but I use 1Password for my personal accounts, and a corporate LastPass for my work accounts. I do not believe that 1Password is as immediately vulnerable as LastPass. LastPass (on Chrome) will auto-fill information on a detected site, which a malicious site can read immediately. 1Password (on Chromium nightly) requires me to hit the 1Password Mini button and select a site/account to log i…

1Password doesn't auto-fill, but you can press [Ctrl|CMD] + \ to fill in the password automatically based on the detected domain.

Re: LastPass autofill exploit

#303

Post by _pghu »

AGKyle wrote: post #264
favadi wrote: post #202

Earlier quoted context omitted.

When you are here, is 1password for team is the future and the classic 1password will become obsolete soon?

Disclaimer: I also work for AgileBits We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions). That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Passwo…

I also very very very strongly do not want any hosted service requirement for using 1password. I am very proud user of 1P but a hosted requirement would kill it for me. No matter how much you (the generic 'you') tell me you're super secure, nothing will be as secure as owning my own data and using local Wi-Fi sync to put it on my phone.

Re: LastPass autofill exploit

#304

Post by K0nserv »

tedmiston wrote: post #189
jxpx777 wrote: post #141

Earlier quoted context omitted.

Disclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)

While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?

I had a quick look at the 1Password chrome extension source and it seems to me like they are using window.URL[0].

See this pastebin[1] for the function I believe is determining the url of the active tab and if it has a valid hostname.

There's also this one[2] that seems to be extracting the hostname of a given url also using the URL API.

Both these pastebins contain minimized code that I've cleaned up.

0: https://developer.mozilla.org/en-US/docs/Web/API/URL

1: http://pastebin.com/tWns7XmG

2: http://pastebin.com/PXS1iqsq

Re: LastPass autofill exploit

#305

Post by nekopa »

throwanem wrote: post #293
jonahx wrote: post #288

Earlier quoted context omitted.

Fwiw, his question did not sound at all like that to me. Your reaction feels like unfair personal bias. Not trying to start a fight but you seem openminded enough to hear it so figured Id let you know

Not at all. But I would be interested to hear what sort of bias you saw in my prior comment. I mean, I don't think you're wrong, but beyond the downvotes, I only have my own perspective to go on here, and I'd appreciate the benefit of having yours as well.

Not the poster you replied to, but there were 2 types of bias I saw:

1: Defensiveness. It seemed more like an honest question than a pot shot. You seemed to read into it something like "Aha! How about your software fool!?!"

That said, if it were a reporter asking the question, then I would see it as a gotcha, because the use of the word confirm is used as a setup sometimes.

2: Tech bias. Not everyone on here is a Dev, and even though I know a fair bit about programming it would not be a trivial task to do what is simple for you regarding checking out code injections and what they do re a security standpoint. That would probably be a long afternoon of googling for me :)

Just my view...

Re: LastPass autofill exploit

#306

Post by juandazapata »

throwanem wrote: post #294
arcticfox wrote: post #285

Earlier quoted context omitted.

Also, just because we're on Hacker News, it doesn't mean every reader is equipped to audit code for security vulnerabilities. Presumably that's the job of a professional security developer that might reasonably be expected to have checked their own similar product for this vulnerability...

Fair. I would, though, expect someone whose HN profile identifies him as an experienced full-stack engineer to be up to the challenge of spotting something as basic as an extension injecting code into untrusted DOM and trusting the results that code gives back.

Chill. There's no need to bash other people's expertise. We get it, you're an expert in the domain, but this is adding nothing to the conversation.

Re: LastPass autofill exploit

#307

Post by jacobsladder »

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded $3k just because someone found a way to brute force passwords without getting rate limited. This is quite simply unacceptable.

I think the company should have paid $100,000.

Re: LastPass autofill exploit

#308

Post by punjabisingh »

It's confusing that the LastPass site is claiming only Firefox is impacted. [1] Whereas the security researcher's site (detectify.com) shows the vulnerability running in Chrome. [2]

Furthermore, the current live version on Firefox addons repository is 3.x [3], which the LastPass team claims is not vulnerable. [1]

[1] https://blog.lastpass.com/2016/07/lastpass-security-updates.... [2] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... [3] https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass...

Re: LastPass autofill exploit

#309

Post by jerf »

0xbadcafebee wrote: post #235
jerf wrote: post #157

Earlier quoted context omitted.

"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…

Heh. https://mathiasbynens.be/demo/url-regex https://lostechies.com/chadmyers/2010/11/20/parsing-a-url-wi... https://stackoverflow.com/questions/27745/getting-parts-of-a... What do all these have in common? They all demonstrate that it is hard to write a regex that parses URLs. Regex's hide programming mistakes because they not only become harder for humans to parse as they get more complicated, but also there isn't…

It is hard to write code that parses URLs, period.

You can't look at regexs in isolation, see that a task is hard, then declare them unfit. You have to consider them as one of the many choices and analyze the cost/benefits of the whole suite of options.

I guarantee you that anyone who has said "Oh, gosh, this is hard, I'll just start using indexOf and substring operations" has written code that is just as broken, only in ways much harder to tell.

Which is probably why everyone here thinks it's better to not use regex. You didn't write better code... you wrote code that hid its brokenness better. That's not a good thing!

Again, my real point here is not "regexes are awesome in every way"... my point is that I literally glanced at that code and saw several ways in which it was wrong. Does your alternative have that property?

Also, some of the difficulties of regexes are accidental, not essential. Take something like the recent Perl 6 efforts for parsing and you're far better off in every way using that stuff than trying to bash together string-manipulation-based parsing, or whatever other alternatives you may be thinking of. The Perl 6 constructs will be more readable and more maintainable. (Perl 6 is crazy in a lot of ways but the parsing support is best-of-breed.)

Re: LastPass autofill exploit

#310

Post by cowkingdeluxe »

imglorp wrote: post #92
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

Don't use anything that runs in the DMZ (browser), if you care about your secrets. I use keepassx, which requires manual search, copy, paste but it can store its vault on a cloud drive, mobile etc. and can have a key file or password.

Worth mentioning that one of the major benefits of Keepass is that it is open source. Many of the other providers mentioned here are not.
Post reply on HN