4 ms·

Stupid question: why can't LastPass encrypt the URL as well and decrypt client-side to show the logo, like they do (as I understand it) with passwords?

• chaosfox 10y ago
  that seems a better solution, but lastpass would still know that user_x is downloading the google.com logo.
  • deleted 10y ago
    [deleted]
  • jogjayr 10y ago
    How? The logo image request goes to google.com then, and not Lastpass, right?
    • chaosfox 10y ago
      I am assuming lastpass have the logos on their domain. if the request goes to google.com then its fine as long as the referer isn't sent.
• ehsankia 10y ago
  They can, probably an oversight. Hopefully once this article makes the rounds they'll reconsider.
• guntars 10y ago
  The client still needs to fetch the logos from somewhere so it has to upload a list of URLs to get the logos for. They've just opted to do it when saving a password entry.
  • jerf 10y ago
    It probably wouldn't be infeasible to send the client all the logos they have. The client could then pick them out with no server interaction. There's only going to be thousands of them, tops, and probably only hundreds. Hooray powerlaw. This might be modestly annoyingly resource intensive for mobile, probably not an issue for desktops.
• thinkloop 10y ago
  an even better solution is who gives a shit about the logos, this a security product.
• Globz 10y ago
  They can, I don't see why they chose the current implementation over this one, somehow this small leak can let them build a database of browsing habits and target users who use x website...hmmm