91–100 of 443 posts
Earlier quoted context omitted.
I want an alternative, got a good one?
KeePass, but I'm not 100% on that one either.
Earlier quoted context omitted.
Exactly this. I'm abandoning them now.
I want an alternative, got a good one?
I use keepassx, which requires manual search, copy, paste but it can store its vault on a cloud drive, mobile etc. and can have a key file or password.
Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…
I am a lot taken back by it. This wasn't a minor bug. I don't care if $1,000 was the published maximum payout under their bug bounty program - for something like this, the payout needs to be representative of the damage that would have been done to their reputation had this bug been discovered and exploited by bad actors. Given that reputation is everything in this space, any well-publicized incident using this would have effectively rendered the company dead within days.
Here's hoping they reconsider the award amount (though I'm certain they won't).
It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696 (to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")
> @taviso Are you looking at their binary? (I'm a former lastpass engineer)
> @ejcx_ Yes.
> @taviso Ahhh. I never touched it. Very neglected. There's a lot of stuff between message passing between extension and binary that is scary
Earlier quoted context omitted.
Not using `document.location.host` stood out to me too. I think the takeaway here is don't use regex unless you absolutely have to and don't use it to parse things that have rigorous standards describing them. Emails, phone numbers, URLs come to mind.
> don't use it to parse things that have rigorous standards describing them Where a regex must be used, there is a reference regex for parsing URL: https://tools.ietf.org/html/rfc3986#appendix-B Edit: a permalink to demonstrate the above reference regex: https://regex101.com/r/yJ5nU4/1 -- would have prevented the LastPass bug.
The string "foo" correctly gets parsed as a path (group 5). However the string "foo;key:value" gets parsed as a "foo;key" scheme (group 1,2) and a "bar" path (group 5) by the regular expression, but as a path if you follow the grammar.
scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
vs.
^(([^:\/?#]+):)?
:; are reserved characters, but they do not need to be encoded when they are a part of the path.
So yeah, don't use regular expressions for parsing.
What's the difference with simply going to "http://twitter.com"?
This looks more like a bug than a vulnerability, what am I missing?
Earlier quoted context omitted.
The concern with the low payout is that it's supposed to be a way to compensate white hat hackers and dissuaded them from going to the black market with security problems like this. Given the business that LastPass is in wouldn't you agree that it's extremely crucial they make sure white hat hackers are aptly compensated for serious problems they find? In fact I'd think it'd be reasonable for them to pay more than Fa…
There are many people capable of finding this specific bug and reporting it who might be motivated to take a look by a bug bounty, but who would never even consider trying to sell an exploit on the black market. I agree there is one cohort where you are trying to offer them an alternative to illegally monetizing their exploits. Then there is another cohort who you are just trying to encourage them to spend some time…
Personally I lost a lot of confidence in them when they got acquired and switched to 1Password, paying very low bounties for critical security flaws further hurts my confidence in them.
Earlier quoted context omitted.
At the time I submitted this, they didn't even have a bug bounty. Considering that, I think $1,000 is great :)
Perhaps LassPass users might like to donate to show their gratitude -- after all, you just protected an awful lot of people's passwords. Have you got a mechanism you could post here for them to do so?