LastPass autofill exploit • Hacker News Board

Re: LastPass autofill exploit

#371

Post by benologist » Wed, Jul 27, 2016, 8:26 PM UTC

cloakandswagger wrote: post #342

balls187 wrote: post #280

Earlier quoted context omitted.

Why did you switch from LastPass to 1Password? I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123

I've been using LastPass for years now, but I'm starting to explore other options. For me, the biggest pain point is the interface. The automatic form filling rarely works as it should; I click the LastPass icon in the username field, select the site, and it only populates the username (even though there is an input with type="password" right below it). I then have to: 1) Press ALT+W to bring up the LastPass site sea…

I use 1Password like that. I'm starting to explore other options because I'd much rather pay for open source software. Dropbox and 1Password are the only proprietary software I really depend on... cause it's 2016 and everyone else got the memo, even Microsoft is changing.

Re: LastPass autofill exploit

#372

Post by foxylion » Wed, Jul 27, 2016, 8:35 PM UTC

riskable wrote: post #210

chrisper wrote: post #190

Earlier quoted context omitted.

What do you mean? Autotype is available in KeepassX.

Autotype is a bit risky because it assumes you've got the correct window/element focused. All it takes to expose your passwords is for a pop-up (e.g. instant message) to appear at the right moment. Even if you don't hit the enter key/submit the form it is still possible for that incorrect window/app to grab your keystrokes.

I had this once, "auto typed" a password into a messenger window. So be careful it can happen at any time. Better use Ctrl+C and Ctrl+V.

Re: LastPass autofill exploit

#373

Post by gohrt » Wed, Jul 27, 2016, 9:12 PM UTC

$1000 is a stingy payout for a bug that undermines the reason for the product's existence.

Re: LastPass autofill exploit

#374

Post by Fogest » Wed, Jul 27, 2016, 9:13 PM UTC

AGKyle wrote: post #353

Fogest wrote: post #338

Earlier quoted context omitted.

Is there a feature comparrison or reasoning you may have about why 1password may be better than Keepass? I have been using Keepass as I use Linux, Windows, and Phone for accessing my passwords. I am wondering if 1password has some neat helpful features that Keepass doesn't. I am considering switching to a new password manager.

We don't generally do feature comparisons. So many products operate under different sets of requirements that comparison charts can be very easily rigged to make one thing look significantly better than the other. I can tell you one thing that is indisputably better about 1Password though. Support. Quite literally. We have a team of over 30 customer support personnel (in addition to myself and other developers who pi…

Out of the year I have been using Keepass I have never had a time where something was wrong that I would need support for.

I am actually not sure what I would need support for either, it seems pretty basic. I am simply storing passwords. It doesn't seem too complicated. And maybe this is because I am a tech person, so maybe I am looking for the more technical reasons why the software may be better rather than how the support excels. Because if keepass had a problem I know ways to get support anyway, either via a Stackexchange site or IRC. So I am definitely a bias group.

However I do not care if the software is open source or not. I know some people do care about that, but the people I talk to do not. People in my age group seem less concerned about open source or closed source.

I'm more curious if there are some kind of features in the product itself that make it better than keepass? I do not have a family so the family cloud version of 1password is not useful, though I would not be opposed to a cloud version of 1password for an individual. I currently store my keepass in dropbox and have that synced to all the devices I use.

Re: LastPass autofill exploit

#375

Post by bad_user » Wed, Jul 27, 2016, 9:14 PM UTC

peterwwillis wrote: post #335

bad_user wrote: post #295

Earlier quoted context omitted.

Regular expressions describe finite state machines and in programming there's nothing simpler than finite state machines / finite automatons. Your handling of vulnerabilities inline is anything but simple. This is CS 101.

The handling of security is anything but simple. Hence, a simple solution is anything but secure. This is Security 101.

I can't even parse that. First sentence is false. Second sentence wouldn't follow from it if it were true, but then a false sentence can imply anything. And I've literally taken Security 101 in college.

You might also want to check the definition of "simple". Probably doesn't mean what you think it means.

Re: LastPass autofill exploit

#376

Post by unfletch » Wed, Jul 27, 2016, 9:21 PM UTC

__jal wrote: post #368

balls187 wrote: post #280

Earlier quoted context omitted.

Why did you switch from LastPass to 1Password? I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123

You didn't ask me, but, several things: - This is the second serious security incident with them. Nobody's immune to bugs, but I haven't seen a similar history with AgileBits. - LastPass has, IMHO, terrible UI/UX. Things don't work consistently, there are weird, unexpected pauses that look like malfunctions until something visible happens; it took me a comparatively long time to figure out how to map common actions t…

> ...I'm hoping to get switching onto the low-priority project list.

You should maybe try and get it on the high priority list. On August 1st the Teams pro plan will increase from $4/user/mo. (introductory price) to $12/user/mo. for new signups: https://1password.com/teams/pricing/

Re: LastPass autofill exploit

#377

Post by robocat » Wed, Jul 27, 2016, 9:21 PM UTC

viraptor wrote: post #4

It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696 (to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")

Lastpass have fixed it - search for Tavis in https://blog.lastpass.com/2016/07/lastpass-security-updates....

Re: LastPass autofill exploit

#378

Post by brainfire » Wed, Jul 27, 2016, 9:22 PM UTC

punjabisingh wrote: post #308

It's confusing that the LastPass site is claiming only Firefox is impacted. [1] Whereas the security researcher's site (detectify.com) shows the vulnerability running in Chrome. [2] Furthermore, the current live version on Firefox addons repository is 3.x [3], which the LastPass team claims is not vulnerable. [1] [1] https://blog.lastpass.com/2016/07/lastpass-security-updates.... [2] https://labs.detectify.com/2016/0…

The Firefox reference is in the second vulnerability discussed in your link 1, and is unrelated to your link 2 and parent submission. That second vulnerability apparently only affected the version 4 line of the Firefox plugin, which is marked beta in the Mozilla repository.

Re: LastPass autofill exploit

#379

Post by ufmace » Wed, Jul 27, 2016, 9:30 PM UTC

cloakandswagger wrote: post #342

balls187 wrote: post #280

Earlier quoted context omitted.

Why did you switch from LastPass to 1Password? I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123

I've been using LastPass for years now, but I'm starting to explore other options. For me, the biggest pain point is the interface. The automatic form filling rarely works as it should; I click the LastPass icon in the username field, select the site, and it only populates the username (even though there is an input with type="password" right below it). I then have to: 1) Press ALT+W to bring up the LastPass site sea…

What browser are you using? Lastpass usually autofills for me, and if it doesn't, there's a menu widget in both the password field and the plugin menu that goes right to the domain, and has a copy password to clipboard option.

Re: LastPass autofill exploit

#380

Post by bj0 » Wed, Jul 27, 2016, 9:41 PM UTC

tyleraldrich wrote: post #278

xur17 wrote: post #263

The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well." Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.

I assume it's because LastPass sends you the multi factor auth request before accessing your passwords (and therefore before allowing the autofill js stuff to use your password). I don't actually use LastPass so I'm not 100% sure, but this would be the most likely case imo

> I assume it's because LastPass sends you the multi factor auth request before accessing your passwords

This would seem like a logical assumption, but I have found that it works differently (at least on the firefox plugin). If I have auto-fill enabled, the password for a site I am looking at is filled in before the MFA prompt pops up. I can even ignore the MFA pop-up and click login and get into the website.