Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

411–420 of 443 posts

Re: LastPass autofill exploit

#411

Earlier quoted context omitted.

Exactly this. I'm abandoning them now.

I want an alternative, got a good one?

Check out Enpass password manager. https://www.enpass.io/

I found this alternative when LastPass was acquired by log me once. I was not happy with this. This app doesn't have hacking or vulnerability history like LastPass.

They also have a dedicated import for LastPass. https://www.enpass.io/docs/desktop-mac/import_lastpass.html

Re: LastPass autofill exploit

#412
Enpass is the best alternative for LastPass. I switched over from LastPass a few months ago.

First I decided 1Password to replace LastPass, but it puts a lot of weight on my pockets as it's very expensive. Then I encounter Enpass. It's a really good password manager. What I like about Enpass is that it saves database locally on my device not on their server and gives the desktop app for free.

It's worth to try and it hardly takes a few minutes to move all your LastPass database into into Enpass. https://www.youtube.com/watch?v=Fn69hHur3Jo

Re: LastPass autofill exploit

#413
post #87

Earlier quoted context omitted.

"You agree not to disclose the full amount awarded you as part of this bug bounty award contract."

If the full amount is <=1000 it's irrelevant what you're actually awarded for a bug as serious as this.

Oh, no - I mean, if you want to reward people fairly, but not get a stampede to your door, tell them to report a smaller bounty than was received. They can spread private word to their network (presumably, other people who are going to actually be correct) but still provide hooks to the public.

Probably doesn't work out, but it's what came to mind as a way to deal with the balancing act.

Re: LastPass autofill exploit

#414
post #90

Earlier quoted context omitted.

You could have just linked to http://verbalexpressions.github.io instead of spamming all the repositories. Also, about half of them are out of date by 3 or more years.

The point being it's available for a wide range of languages

Exactly... I probably could have posted less of them but in an era of TLDR it was easy enough to just post the list and let the uninterested scroll past and ignore it. That I have down votes for pointing out how practically no developers are without an option to guard against poorly written regular expressions, feels somewhat overkill.

Re: LastPass autofill exploit

#415
post #43

Earlier quoted context omitted.

Perhaps, but this particular exploit doesn't target the fact your passwords are stored in the cloud. It targets the local autofill functionality in the browser, so it could conceivably have occurred in any password manager with browser/autofill integration. Including those that use a local password store.

Do you mean it could happen with, say, Firefox's built-in password manager?

It happens at the point that the browser functionality interacts with a webpage on the internet that is controlled by a third-party. A well-written autofill function will strictly only allow the 3rd-party website code to access passwords for logging into that domain - the Lastpass allows it to capture passwords for other domains.

This bug could easily occur in Chrome/Firefox's built-in password manager autofill, though I must admit I have slightly more implicit trust of the developers behind Chrome/Firefox than of Lastpass (instinctively; this may well be unwarranted).

Re: LastPass autofill exploit

#416

Earlier quoted context omitted.

I use Lastpass for work and can't stand it. I use 1Password for personal stuff (and some private work stuff now that I think of it) and highly recommend it. It's got a Chrome browser extension, mobile app, and like someone else mentioned below you can sync the encrypted db to a cloud service (iCloud, Dropbox, etc) so you can access it from all of your devices.

It even runs on Linux with Wine with browser integration.

That's awesome! Did not know that.

Re: LastPass autofill exploit

#417
post #45

Earlier quoted context omitted.

I use Lastpass for work and can't stand it. I use 1Password for personal stuff (and some private work stuff now that I think of it) and highly recommend it. It's got a Chrome browser extension, mobile app, and like someone else mentioned below you can sync the encrypted db to a cloud service (iCloud, Dropbox, etc) so you can access it from all of your devices.

>I use Lastpass for work and can't stand it I don't mean to be the advice bird, but maybe you can point all the points you made to your superiors and make them re-evaluate their choice. If they're a huge enterprise, then I understand

I work for a company with 3 owners and approximately 40 people. It would be okay but we need the shared 'team' aspects of a password manager -- I could be mistaken but I don't think 1password can handle a team sharing logins. I'm sure there are other options out there.

Re: LastPass autofill exploit

#418
post #264
post #202

Earlier quoted context omitted.

When you are here, is 1password for team is the future and the classic 1password will become obsolete soon?

Disclaimer: I also work for AgileBits We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions). That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Passwo…

I'm probably being daft but I can't find the Individual Plan on 1Passwords homepage, any idea where I can find out more about it?

Re: LastPass autofill exploit

#419
post #401
post #383

Earlier quoted context omitted.

An example I like to give for why 1Password Families has helped me is this: I work remotely for my job. I do travel several times a year as a result and when I'm gone I have other family members watch my house. Before 1Password Families I had to find a way to easily get my wifi password, my garage door code, and various other instructions and information to whoever was watching my house. With 1Password Families I sim…

Sure, I'll give some of my thoughts about it when I first fired up the trial. The installer gave me an option to create desktop icon, but gave me no option to start the program when it was finished installing. It was odd having to go find and run the program once it was done installing, it is typical for most installers to give me an option to run after install. Not a big deal, but I thought it was worth a mention. W…

Thanks for the feedback. I'm afraid most of my experience is with the Mac and iOS applications, since I work directly on those. However, the Windows application you are using has more or less been sunset and we're working on a new Windows app that you can read more about here:

https://discussions.agilebits.com/discussion/64591/help-us-w...

We are targeting a release soon. This version is a complete rewrite so it'll be missing some of the things that our Mac, iOS and Android applications have, but over time we'll be continuing to improve it. Having a base we can build on was the critical goal for this upcoming release though.

So, not to brush off your concerns for the version you tried (it is the one that we are making available to users still) there will likely be an entirely different set of concerns with the new one, but mostly because it lacks other features that you may expect to be present. But I do believe it solves most of the concerns you did raise :)

Thanks a ton for taking the time to give it a shot and let me know how it was for you. I am sorry it was, what appears to be anyway, an unpleasant experience. Our Windows app has traditionally been one that has lagged behind our Mac version but we are attempting to right that now.

If we can ever answer any questions for you, or help at all in the future, please let us know!

Thanks again!

Kyle

AgileBits

Re: LastPass autofill exploit

#420
post #387
post #347

Earlier quoted context omitted.

The individual plan is the lowest cost subscription option, and standalone is an option if you would like to try to spread the cost out between releases, but you would have to pay for any major upgrades as those are not included. I'd say many people don't need the Pro features in the iOS version, it's possible that maybe you won't either? Depends on how you use it I guess. Probably the biggest reason to get the Pro f…

I appreciate the honest response. I couldn't find an easy link on mobile to explain what those Pro features were and it sounds like I don't need them after all. I just need to be able to share a database of passwords between my few devices for personal use. Purchasing 1Password for 65$ gets the current major release with no updates? Subscribing to 1Password Families for 5$/month: Lets me sync passwords between all of…

Sorry for the delay in response here. I eventually had to go do some of my regular duties and that meant closing the web browser at some point yesterday :)

$65 gets you a single license for Mac and Windows. This can be installed on multiple Macs or PCs you own, but is generally for 1 single person.

You get all updates to 1Password 6 for Mac for free, and any updates to 1Password 4 for Windows for free. On the Mac side, we are planning a 6.5 release in the next couple months. Most of the changes in this release will center around 1Password Teams/Families/Individuals (the subscription option). Along with bug fixes that likely impact both. We are likely nearing the end of the road on version 6 after that.

With the $5/mo you can technically do two things...

1. You can use the hosted solution 2. You can create local vaults (like the standalone version does) and sync those using Dropbox, iCloud or Wifi (to mobile devices)

So, with the subscription option, you get both. Whether you use the hosted part of it or not is up to you. However, if the subscription goes into frozen state (unpaid) the app will go into Trial mode, which limits you unless you re-subscribe or purchase a standalone license.

I currently use both local vaults and the vaults for my work Team and Family account. Mostly the local vaults are for testing purposes but it all works fine with a subscription.

Let me know if that helps :)

Kyle

AgileBits

Post reply on HN