LastPass autofill exploit • Hacker News Board

Re: LastPass autofill exploit

#441

Post by AgentME » Sat, Jul 30, 2016, 2:36 AM UTC

ufmace wrote: post #381

dkopi wrote: post #300

Earlier quoted context omitted.

Very interesting if true. I'm tempted to build an extension just to check that. I wonder if a DOM mutation event would be triggered if a content script adds a new link element and changes it's href. Would I be able to catch that and quickly change the href, before the content script continues to fecth the processed properties?

I don't know about this specific point, but you might want to take a look at the greasemonkey security pitfalls page [0]. There's been a lot of effort put into how all of these parts work together to make sure that malicious Javascript on the page can't interfere with what the plugin or userscript is trying to do. [0] http://archive.oreilly.com/pub/a/network/2005/11/01/avoid-co...

Chrome extensions' content scripts are under stronger isolation from the page than greasemonkey scripts are (or were? -- I'm not sure if greasemonkey has changed since). Chrome extensions run in a separate "isolated world" from the page. They never share javascript objects directly. (They do share the DOM, but the isolated world gets its own separate Javascript wrappers around the DOM.) It's not possible to leak a function from the extension to the page, etc.

Re: LastPass autofill exploit

#442

Post by milkey_mouse » Sat, Jul 30, 2016, 10:14 PM UTC

skrebbel wrote: post #171

icebraining wrote: post #111

Earlier quoted context omitted.

Lastpass also only syncs data after it's encrypted locally, so the threat model is the same.

Not entirely, since you download the encryption code way more often (for example, when you open the "Lastpass Vault", which is just a website like any other). Parts of Lastpass are simply a website, not part of the browser extension, and as an avid Lastpass user in all honesty I don't know which parts. This matters because even if it's client-side encryption, the encryption code just got downloaded when you opened th…

I'm pretty sure when using the Chrome extension, all the HTML/JS is downloaded locally once when installing the extension, as logging in via the extension brings you to a chrome-extension:// URL. When logging in via lastpass.com, of course, you will be redownloading the crypto code every time.

Re: LastPass autofill exploit

#443

Post by qmr » Thu, Aug 04, 2016, 10:32 PM UTC

progx wrote: post #47

IshKebab wrote: post #46

Earlier quoted context omitted.

I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated…

Problem is, that not all sites use the same style of passwort. Some need Lower-/Uppercase, some with numbers, some with special Chars, some restrict to minimum of x chars, some use a maximum. Your system works not for all things, i use a similar system, but store a bunch of passwords with last pass. Only really important passwords are in my head.

> Only really important passwords are in my head.

That has not worked well for me. I have lost a small amount of bitcoin, and some encrypted homedirs and encrypted hard drives.