4 ms·
Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with
by mentat 10y ago
Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with ad network code or targeted attacks controlling path to internet. That's all setting aside how trivial it would be for nation states.
- bqe 10y agoThey have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.
- bad_user 10y agoThat's unfair. LastPass has always been transparent about their problems, much more so than other companies like Dropbox. And there's nothing in their response that tries shifting the blame: https://blog.lastpass.com/2016/07/lastpass-security-updates.html/ https://blog.lastpass.com/2016/07/lastpass-security-updates....
- mentat 10y ago> Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies. This was not necessary for this attack to be successful on the default configuration of the tool. That's what I take issue with.
- coderdude 10y ago>They have a history of trying to explain away their security problems as not really their fault. I feel like I'm reading some person's pet Wikipedia page. If they do then at least give some examples. You can't just say damning things and expect everyone to take it at face value.
- wjd2030 10y agoSeriously? Unfounded to say the least. LastPass has always been super transparent and forthcoming regarding ANY security issue.
- gizmo686 10y agoI don't. The phrasing was "both exploits do require tricking a user via a phishing attack into going to a malicious website". This suggests that the blogger believes that the only attack vector involves tricking the user to go to a malicious website; I can reasonably see calling such attacks phishing attacks. The problem (which is, in my opinion, more serious) is that, as you identify, the blogger seems to horribly misunderstand the potential attack vectors.
- the_mitsuhiko 10y agoI have not used LP in a long time but does not not prompt for the master password before filling?
- alistairjcbrown 10y agoI believe it depends on the settings for that entry - from "auto log in", "auto fill", "fill in when selected from menu" to "require master password before filling in"