Yeah, the two weak points pointed out have always been weak points. It's unfortunate, but disabling autofill has always been my recommendation. > Altogether it

Yeah, the two weak points pointed out have always been weak points. It's unfortunate, but disabling autofill has always been my recommendation. > Altogether it looks like LastPass is a lot better at PR than they are at security. Yes, that’s harsh but this is what I’ve seen so far. In particular, security vulnerabilities have been addressed punctually, only the exact scenario reported has been tested by the developers. This seems unfair. LastPass fixes the initial vulnerability punctually - we do not know what they will do in the future. Is it better for them to wait, come out with a defense in depth approach, and then patch? Seems silly. Of course, how long do we wait? Historically, I would argue, LastPass has down defense in depth fairly well - when their was a breach they were quick to not only address the vulnerabilities immediately but soon after they rolled out Content Security Policy and HSTS, two technologies that were rarely deployed in the wild at the time (and are still sadly too rare). My suggestion to LastPass users is to: 1) Enable 2FA 2) Up your PBKDF2 Rounds 3) Disable as many browser integration features as possible I don't recommend dropping LastPass and trying to roll your own key-sync store with KeyPass/Dropbox as some have done. I don't know of any other browser-based password manager that isn't equally weak to attacks based on browser-integration. Alternatively, don't use a browser-based solution. This is less convenient but you'll avoid by far the largest area of attack surface.