4 ms·
>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can
by ktta 9y ago
>purportedly a bit more secure?
The worst bugs in LastPass are:
1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2]
2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3]
3. Last year a software engineer who wasn't a security researcher found a bug[4], which again, gives all your passwords.
4. The bug in (3) wasn't fixed properly, which lead to this [5]
Other bugs, but not as terrible as the ones I listed above
Jul 27 2016 [6]
Mar 25 2017 [7]
Jun 17, 2015 [8]
Nov 17, 2015 [9]
You are also forgetting a whole another class of attacks -
Phishing [10]
[1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1209 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
[2]: https://news.ycombinator.com/item?id=13924737 https://news.ycombinator.com/item?id=13924737
[3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1217 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
[4]: https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...
[5]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&desc=2 https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
[6]: https://bugs.chromium.org/p/project-zero/issues/detail?id=884 https://bugs.chromium.org/p/project-zero/issues/detail?id=88...
[7]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&desc=6 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
[8]: http://www.businessinsider.com/security-expert-describes-lastpass-vulnerabilities-posted-to-pastebin-in-2013-2015-6 http://www.businessinsider.com/security-expert-describes-las...
[9]: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/ http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...
[10]: https://www.seancassidy.me/lostpass.html https://www.seancassidy.me/lostpass.html
- 6ak74rfy 9y agoOh my. Thanks for taking the time to list these down. Will work right away to get off Lastpass. No, seriously!
- ktta 9y agoWhat ever password manager you move to, chose something that will stay far away from your browser. And don't use anything that autofills your passwords. This includes KeePassHTTP.