LastPass autofill exploit

Post by yonilevy » Wed, Jul 27, 2016, 7:21 PM UTC

fencepost wrote: post #329

yonilevy wrote: post #230

The autofill feature starts sounding like the benefit isn't worth the risk. It's kind of odd when thinking about it, that my passwords can be decrypted without me explicitly asking for them. I hope there aren't other mechanisms aside from autofill that allow that. While we're here - is there a way to disable autofill in LastPass entirely?

Disabling Autofill is the second checkbox in the General section on the first page you see when you open Preferences in LastPass. It appears to be specific to each instance, so if you have LastPass installed in several browsers or on multiple systems, you may need to change it in each place. You can also likely mitigate some of this by setting a fairly low autologoff timeout, though how well that will work may vary w…

Post by AGKyle » Wed, Jul 27, 2016, 7:23 PM UTC

jamwt wrote: post #359

AGKyle wrote: post #348

Earlier quoted context omitted.

Hi there! If you have any questions that we might be able to answer, please shoot me an email. kyle at agilebits.com, or support at agilebits.com. I work on our Mac/iOS teams and security teams. I can probably answer most of your questions and at least get them in front of people who can answer them. I really hope you're not making this work with AgileKeychain, we've put that one out to pasture. :) Kyle AgileBits

Purely OPVault! We've got pretty good OPVault support going, but your guys' RPC protocol is not open, right? Between mini and the browser plugins?

Post by Domenic_S » Wed, Jul 27, 2016, 7:34 PM UTC

arcticfox wrote: post #320

Domenic_S wrote: post #311

Earlier quoted context omitted.

Someone always makes a comment like this. Honestly, the black market value (if any) has nothing to do with the whitehat bounty amount. Why should it? The person who's going to do legitimate whitehat work isn't the same person who's going to sell on the black market. I think of it like drugs. $50k street value of cocaine is not going to do me a lot of good because 1) I'd have no idea where to sell it, 2) if I did know…

But if the police want to incentivize you to find cocaine, how hard are you going to look for only $500? In the sense that "Oh yeah, I just casually stumbled on an enormous exploit of security software" the bounty is a good deal. In the sense that "Should I look for holes in this thing? Is it worth my time?" it's absolutely not unless the person is interested in it academically or for reputation.

Post by sctb » Wed, Jul 27, 2016, 7:59 PM UTC

kordless wrote: post #232

tedmiston wrote: post #189

Earlier quoted context omitted.

While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?

What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…

Post by gorhill » Wed, Jul 27, 2016, 8:17 PM UTC

dkopi wrote: post #300

mook wrote: post #283

Earlier quoted context omitted.

While content scripts (in the extension world, meaning scripts running in the context of a content page) shares the DOM with the untrusted page, it does not share the JavaScript wrapper layer around that DOM. This is extra confusing because the global object is a (JavaScript wrapper around a) DOM object. The untrusted script can override its own view of createElement, but not the extension's view.

Very interesting if true. I'm tempted to build an extension just to check that. I wonder if a DOM mutation event would be triggered if a content script adds a new link element and changes it's href. Would I be able to catch that and quickly change the href, before the content script continues to fecth the processed properties?