Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

331–340 of 443 posts

Re: LastPass autofill exploit

#331

Post by jamwt »

gnufied wrote: post #265
jxpx777 wrote: post #146

Earlier quoted context omitted.

Disclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

Long time 1Password user here. I use it on bunch of Machines and I wish you guys supported Linux. :( Heck 1Password mostly works under Wine, except perhaps there is no unlock on Secure desktop and bunch of other usability things.

Coincidentally, a bunch of Dropboxers are working on a version of 1Password for Linux written in Rust (it's Dropbox's "Hack Week" right now). Hopefully we can open source it soon. Looking good so far!

Re: LastPass autofill exploit

#332

Post by wlesieutre »

_pghu wrote: post #303
AGKyle wrote: post #264

Earlier quoted context omitted.

Disclaimer: I also work for AgileBits We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions). That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Passwo…

I also very very very strongly do not want any hosted service requirement for using 1password. I am very proud user of 1P but a hosted requirement would kill it for me. No matter how much you (the generic 'you') tell me you're super secure, nothing will be as secure as owning my own data and using local Wi-Fi sync to put it on my phone.

Seconding this. I generally dislike hosted subscription offerings, especially for a password manager, and even more especially for one that I've already purchased four different licenses to (Mac, Windows, iOS, Android).

Re: LastPass autofill exploit

#333

Post by anonred »

wrboyce wrote: post #267
nichochar wrote: post #262

Earlier quoted context omitted.

I have never understood the password manager market honestly. To me it's very obvious that the CONCEPT of a "single point of failure" is a terrible idea. Putting faith in one or the other is just like humans backing politicians, they think they are backing something when really they just got manipulated into an opinion which they slowly defend more and more. Don't use a password manager, remember your passwords, or r…

Are you saying that you remember a unique and sufficiently random password for every website/app/etc you use? If so, you've got a far better memory that me.

Not the GP, but yes, and it doesn't require a good memory. The main things I do:

1. "Salt" my email usernames with the name of the service (johndoe+reddit@example.com)

2. Use multiple (long) password bases depending on the type of service (eg website vs app)

3. Combine the password bases with a cipher/salt based on the service name and my username

I'm guilty of not rotating passwords on a regular basis, however.

Re: LastPass autofill exploit

#334

Post by unfletch »

notJim wrote: post #302
jamie_ca wrote: post #290

Earlier quoted context omitted.

Not a dev on either product, but I use 1Password for my personal accounts, and a corporate LastPass for my work accounts. I do not believe that 1Password is as immediately vulnerable as LastPass. LastPass (on Chrome) will auto-fill information on a detected site, which a malicious site can read immediately. 1Password (on Chromium nightly) requires me to hit the 1Password Mini button and select a site/account to log i…

1Password doesn't auto-fill, but you can press [Ctrl|CMD] + \ to fill in the password automatically based on the detected domain.

It does have an "open and fill" feature which autofills, but only immediately after opening the site by URL first. (So the attacker's URL would have to be saved in 1Password along side your credentials.)

This is actually how I use 1Password most often. Global hotkey of cmd+opt+\, type a site name, hit enter: 1Password opens the site and logs in.

Re: LastPass autofill exploit

#335

Post by peterwwillis »

bad_user wrote: post #295
0xbadcafebee wrote: post #235

Earlier quoted context omitted.

Heh. https://mathiasbynens.be/demo/url-regex https://lostechies.com/chadmyers/2010/11/20/parsing-a-url-wi... https://stackoverflow.com/questions/27745/getting-parts-of-a... What do all these have in common? They all demonstrate that it is hard to write a regex that parses URLs. Regex's hide programming mistakes because they not only become harder for humans to parse as they get more complicated, but also there isn't…

Regular expressions describe finite state machines and in programming there's nothing simpler than finite state machines / finite automatons. Your handling of vulnerabilities inline is anything but simple. This is CS 101.

The handling of security is anything but simple. Hence, a simple solution is anything but secure. This is Security 101.

Re: LastPass autofill exploit

#336

Post by AgentME »

dkopi wrote: post #300
mook wrote: post #283

Earlier quoted context omitted.

While content scripts (in the extension world, meaning scripts running in the context of a content page) shares the DOM with the untrusted page, it does not share the JavaScript wrapper layer around that DOM. This is extra confusing because the global object is a (JavaScript wrapper around a) DOM object. The untrusted script can override its own view of createElement, but not the extension's view.

Very interesting if true. I'm tempted to build an extension just to check that. I wonder if a DOM mutation event would be triggered if a content script adds a new link element and changes it's href. Would I be able to catch that and quickly change the href, before the content script continues to fecth the processed properties?

The page could only see a mutation event and get a reference to the element if the element was attached to the document. If the extension never attaches the anchor element to the document, then the page's code can't get to it.

Re: LastPass autofill exploit

#337

Post by bad_user »

_pghu wrote: post #303
AGKyle wrote: post #264

Earlier quoted context omitted.

Disclaimer: I also work for AgileBits We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions). That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Passwo…

I also very very very strongly do not want any hosted service requirement for using 1password. I am very proud user of 1P but a hosted requirement would kill it for me. No matter how much you (the generic 'you') tell me you're super secure, nothing will be as secure as owning my own data and using local Wi-Fi sync to put it on my phone.

Would you feel the same about encrypted data stored in Dropbox? IMHO it is better because you have more control and storage is decoupled from UI.

Anyway, I gave up on both 1Password and LastPass. I've been a 1Password user for about 2 years before I switched to KeePass.

To be more specific, for the desktop (OS X, Linux, Windows) I use: https://keeweb.info/

For Android: https://play.google.com/store/apps/details?id=keepass2androi...

And for iOS, though be warned this one is subpar: http://minikeepass.github.io/

All 3 apps are open-source. This is important because open-source will not die for as long as there is demand and more importantly, you own it.

No, I'm NOT against proprietary software, as I said, I gladly paid a premium for 1Password. However their Windows client is basically unmaintained, their new "modern Windows" app is still alpha and doesn't work with Wine and of course, they have no Linux support. Most aggravating is that they are clearly switching to a subscription model, with all of their development effort going towards it lately. No more Everywhere interface for OpVault, no new sync options other than Dropbox and iCloud, etc. In other words I'm tired of bait and switch models and one is in progress here.

Re: LastPass autofill exploit

#338

Post by Fogest »

AGKyle wrote: post #299
gnufied wrote: post #265

Earlier quoted context omitted.

Long time 1Password user here. I use it on bunch of Machines and I wish you guys supported Linux. :( Heck 1Password mostly works under Wine, except perhaps there is no unlock on Secure desktop and bunch of other usability things.

Disclaimer: I work for AgileBits, makers of 1Password Yea, we hear you there. I (and others on the team) wish we could make this happen, but priorities are a tough one. Linux in general didn't fit all that great in our standalone license model before, along with being closed source. Now with the subscription option for individuals (new today), families and teams we have made the payment side a little less of a concer…

Is there a feature comparrison or reasoning you may have about why 1password may be better than Keepass? I have been using Keepass as I use Linux, Windows, and Phone for accessing my passwords. I am wondering if 1password has some neat helpful features that Keepass doesn't. I am considering switching to a new password manager.

Re: LastPass autofill exploit

#339

Post by niij »

serf wrote: post #10
diziet wrote: post #2

To my best knowledge LastPass comes with Autofill disabled by default on at least Chrome (or I was paranoid enough to turn it off myself)

it's a suggested default by the LP installer to disable whatever browsers' built-in password manager.

This post is exploiting a vulnerability in LastPass auto fill, not the browser's auto fill.
Post reply on HN