8 ms·

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas

by pwman 11y ago

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to use the extension directly to login as it's more secure, we'll need to go further here as well. Sean was clever using http://chrome-extension.pw http://chrome-extension.pw which looks close -- but LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake, mitigating this a great deal. This has existed for a long time before Sean's report and we did not implement as a response to Sean's bug report -- we implemented it as a general way for people to know about password resuse and to be notified of being phished. Making this practical is a lot tougher than email phishing -- you really need an XSS on a page that people use to login, and unlike email phishing it is immediately caught.

DrewHintz 11y ago
> LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?
- willidiots 11y ago
  I'm assuming by the same mechanism that offers to save previously-entered passwords. It's always sniffing anything you type into a password field.
  - TwoBit 11y ago
    How would it know it's a password field and not just some text input box that uses * characters?
    - joshschreuder 11y ago
      <input type="password" /> I assume
bqe 11y ago
Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.
- komaromy 11y ago
  Sending the notification still seems like a better idea than not doing it. If a page has gotten you to enter the password at all then it's pretty likely that it knows the significance before the notification.
  - level3 11y ago
    But does the page even need to get you to enter it? Could it be possible to set up a hidden password field for LastPass to monitor, and then run a dictionary attack in the background, waiting for the notification? (I don't use LastPass, so I don't know anything about how this feature is designed.)
    - DrewHintz 11y ago
      This can be protected against by the extension looking at keyboardEvents and verifying the isTrusted attribute. Here are details about how we do this in Password Alert: https://github.com/google/password-alert/blob/master/SECURITY.md#brute-forcing-the-password-from-a-malicious-webpage https://github.com/google/password-alert/blob/master/SECURIT... Before Chrome implemented isTrusted, it was a bit more tricky and we had to rely on a variety of attributes that did not have as much of a security guarantee.
      - level3 11y ago
        Thanks for the helpful explanation! Those seem like fair mitigations. Reading more on it, though, since isTrusted can apparently be spoofed, it looks like the main obstacles are the (2) rate-limiting and the (3) intentional collisions. For (2), I suspect typical users would have a memorizable master password that's more susceptible to brute forcing, but of course it depends on the actual rate limit and how long you can keep the script running. Alternatively, I suppose a malicious script could overwhelm the rate limit so that the user wouldn't receive a legitimate warning. For (3), I wonder whether LastPass has a similar mitigation? From what I understand, they don't store the actual password, so all you would need is a matching hash. I'd be interested to know more details about LastPass's protections. Edit: I just saw pwman's response above.
nfm 11y ago
For what it's worth, I'd definitely prefer logins from new devices to require an email confirmation when 2FA is enabled.

by pwman 11y ago

DrewHintz 11y ago

> LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?

willidiots 11y ago
I'm assuming by the same mechanism that offers to save previously-entered passwords. It's always sniffing anything you type into a password field.
- TwoBit 11y ago
  How would it know it's a password field and not just some text input box that uses * characters?
  - joshschreuder 11y ago
    <input type="password" /> I assume

bqe 11y ago

Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.

komaromy 11y ago
Sending the notification still seems like a better idea than not doing it. If a page has gotten you to enter the password at all then it's pretty likely that it knows the significance before the notification.
- level3 11y ago
  But does the page even need to get you to enter it? Could it be possible to set up a hidden password field for LastPass to monitor, and then run a dictionary attack in the background, waiting for the notification? (I don't use LastPass, so I don't know anything about how this feature is designed.)
  - DrewHintz 11y ago
    This can be protected against by the extension looking at keyboardEvents and verifying the isTrusted attribute. Here are details about how we do this in Password Alert: https://github.com/google/password-alert/blob/master/SECURITY.md#brute-forcing-the-password-from-a-malicious-webpage https://github.com/google/password-alert/blob/master/SECURIT... Before Chrome implemented isTrusted, it was a bit more tricky and we had to rely on a variety of attributes that did not have as much of a security guarantee.
    - level3 11y ago
      Thanks for the helpful explanation! Those seem like fair mitigations. Reading more on it, though, since isTrusted can apparently be spoofed, it looks like the main obstacles are the (2) rate-limiting and the (3) intentional collisions. For (2), I suspect typical users would have a memorizable master password that's more susceptible to brute forcing, but of course it depends on the actual rate limit and how long you can keep the script running. Alternatively, I suppose a malicious script could overwhelm the rate limit so that the user wouldn't receive a legitimate warning. For (3), I wonder whether LastPass has a similar mitigation? From what I understand, they don't store the actual password, so all you would need is a matching hash. I'd be interested to know more details about LastPass's protections. Edit: I just saw pwman's response above.

nfm 11y ago

For what it's worth, I'd definitely prefer logins from new devices to require an email confirmation when 2FA is enabled.