4 ms·

Tavis Ormandy finds another major hole in Lastpass

48 points by robk 10y ago

robk 10y ago
From down thread: "@moeadham It will take a long time to fix this properly, it's a major architectural problem. They have 90 days, no need to scramble!"
xs 10y ago
Does Tavis get any overtime for finding a bug on Saturday?
timmytokyo 10y ago
Ok this is the last straw for me. I'm finally done with Lastpass. Can anyone who uses Keepass with desktop and iPhone please explain their setup? I'm finally going to make the switch, but I'm not sure what the best options are for smart phone use.
- grawlinson 10y ago
  I self-host an instance of Nextcloud and sync my KeePass DB between devices with their desktop/mobile syncing applications. You could do the same with Dropbox/Google Drive/et al. It's pretty effortless.
  - timmytokyo 10y ago
    Assuming you have an iPhone, which iPhone app do you use?
    - grawlinson 10y ago
      Hey, sorry for the late reply. i do not have an iPhone, but a quick glance at the iOS app store shows that Nextcloud have an official app there.
    - hprotagonist 10y ago
      for managing kbdx files on ios, i use MiniKeePass: https://github.com/MiniKeePass/MiniKeePass https://github.com/MiniKeePass/MiniKeePass
- m-p-3 10y ago
  Google Drive to host the database (Google account obviously protected using 2FA). Keepass is accessing the database that is kept in sync on my desktop, and on Android I use Keepass2Android which includes Google Drive integration. Changes are synchronized in both directions. So far it works well, and at no time the database is kept in plain-text on a system I do not control.
- AdmiralAsshat 10y ago
  Keep in mind that LastPass is the only one that Tavis has seriously looked at so far. I'd be willing to bet he'll start finding similar problems with Dashlane or 1Password once he starts digging into them. With that said, KeePass + iOS port + something to sync the database (Dropbox, Drive, whatever) should be good enough.
chainsaw10 10y ago
I feel like just having a browser extension is a major security hole for any password manager. Yes it's more usable and prevents domain spoofing, but it makes the attack surface huge. Whereas to exploit a desktop app that doesn't interface with the browser (written in a decent way), you'd need code execution already. Thoughts?
- hdhzy 10y ago
  I think it depends on the extension. For example browserpass [0] can be only invoked on button press in browser's Chrome (not via scripts on page) and while it runs native app via Native Messaging it just uses JSONs to communicate. [0]: https://github.com/dannyvankooten/browserpass https://github.com/dannyvankooten/browserpass

48 points by robk 10y ago

robk 10y ago

From down thread: "@moeadham It will take a long time to fix this properly, it's a major architectural problem. They have 90 days, no need to scramble!"

xs 10y ago

Does Tavis get any overtime for finding a bug on Saturday?

timmytokyo 10y ago

Ok this is the last straw for me. I'm finally done with Lastpass. Can anyone who uses Keepass with desktop and iPhone please explain their setup? I'm finally going to make the switch, but I'm not sure what the best options are for smart phone use.

grawlinson 10y ago
I self-host an instance of Nextcloud and sync my KeePass DB between devices with their desktop/mobile syncing applications. You could do the same with Dropbox/Google Drive/et al. It's pretty effortless.
- timmytokyo 10y ago
  Assuming you have an iPhone, which iPhone app do you use?
  - grawlinson 10y ago
    Hey, sorry for the late reply. i do not have an iPhone, but a quick glance at the iOS app store shows that Nextcloud have an official app there.
  - hprotagonist 10y ago
    for managing kbdx files on ios, i use MiniKeePass: https://github.com/MiniKeePass/MiniKeePass https://github.com/MiniKeePass/MiniKeePass
m-p-3 10y ago
Google Drive to host the database (Google account obviously protected using 2FA). Keepass is accessing the database that is kept in sync on my desktop, and on Android I use Keepass2Android which includes Google Drive integration. Changes are synchronized in both directions. So far it works well, and at no time the database is kept in plain-text on a system I do not control.
AdmiralAsshat 10y ago
Keep in mind that LastPass is the only one that Tavis has seriously looked at so far. I'd be willing to bet he'll start finding similar problems with Dashlane or 1Password once he starts digging into them. With that said, KeePass + iOS port + something to sync the database (Dropbox, Drive, whatever) should be good enough.

chainsaw10 10y ago

I feel like just having a browser extension is a major security hole for any password manager. Yes it's more usable and prevents domain spoofing, but it makes the attack surface huge. Whereas to exploit a desktop app that doesn't interface with the browser (written in a decent way), you'd need code execution already. Thoughts?

hdhzy 10y ago
I think it depends on the extension. For example browserpass [0] can be only invoked on button press in browser's Chrome (not via scripts on page) and while it runs native app via Native Messaging it just uses JSONs to communicate. [0]: https://github.com/dannyvankooten/browserpass https://github.com/dannyvankooten/browserpass