4 ms·

LastPass also pushes you to install some binary component for their extension.

by blfr 8y ago

jesseryoung 8y ago
I have LastPass installed and thought the binary component was only for native desktop applications and not for their extension. I do not recall installing any binary components for the LastPass Chrome extension, but it's been awhile....
- TheSpiceIsLife 8y ago
  The Firefox for windows extension needs a binary installed for some functionality.
  - SlowRobotAhead 8y ago
    It's worth noting that LastPass for a specific browser and LastPass for Desktop work differently. On the LP FF or LP Chrome it's only listening to that program. On desktop it's trying to listen to all browsers at the same time and watching for other apps it recognizes. It would make sense if LP Desktop had a broader attack surface.
threatofrain 8y ago
How do they do it for ChromeOS devices?
Fabricio20 8y ago
LastPass does NOT require you to install a binary component. That's an optional you have to access the vault on your desktop. OnePassword on the other hand, highly encourages people to download the binary because their standard extension connects to it.
- amarshall 8y ago
  It also requires you to install the binary extension to use the file attachments feature.
- danieldk 8y ago
  They also have an extension (which is the default version on Linux/Chromebooks) that does not require the 1Password application. I have used it since the betas in Linux and it works nicely. Also, this thread seems to imply that having a binary component is always bad. It can also increase security. If the extension is rate-limited in retrieving passwords from a vault, then a compromised browser can only extract a limited number of passwords, whereas with a browser-native extension the attacker could extract all passwords.
palant 8y ago
Yes, they use it because they don't know how to do the same things in JavaScript - without it you get very awkward import/export for example. Tavis Ormandy already demonstrated in the past that this binary allows turning an extension vulnerability into code running with privileges of the logged in user. So it's very advisable not to install it. Not that I'm a big fan of LastPass in general, published a number of article on their issues already: https://palant.de/category/lastpass/ https://palant.de/category/lastpass/

LastPass also pushes you to install some binary component for their extension.

by blfr 8y ago

LastPass also pushes you to install some binary component for their extension.

I have LastPass installed and thought the binary component was only for native desktop applications and not for their extension. I do not recall installing any binary components for the LastPass Chrome extension, but it's been awhile....

TheSpiceIsLife 8y ago
The Firefox for windows extension needs a binary installed for some functionality.
- SlowRobotAhead 8y ago
  It's worth noting that LastPass for a specific browser and LastPass for Desktop work differently. On the LP FF or LP Chrome it's only listening to that program. On desktop it's trying to listen to all browsers at the same time and watching for other apps it recognizes. It would make sense if LP Desktop had a broader attack surface.

threatofrain 8y ago

How do they do it for ChromeOS devices?

Fabricio20 8y ago

LastPass does NOT require you to install a binary component. That's an optional you have to access the vault on your desktop. OnePassword on the other hand, highly encourages people to download the binary because their standard extension connects to it.

amarshall 8y ago
It also requires you to install the binary extension to use the file attachments feature.
danieldk 8y ago
They also have an extension (which is the default version on Linux/Chromebooks) that does not require the 1Password application. I have used it since the betas in Linux and it works nicely. Also, this thread seems to imply that having a binary component is always bad. It can also increase security. If the extension is rate-limited in retrieving passwords from a vault, then a compromised browser can only extract a limited number of passwords, whereas with a browser-native extension the attacker could extract all passwords.

palant 8y ago

Yes, they use it because they don't know how to do the same things in JavaScript - without it you get very awkward import/export for example. Tavis Ormandy already demonstrated in the past that this binary allows turning an extension vulnerability into code running with privileges of the logged in user. So it's very advisable not to install it. Not that I'm a big fan of LastPass in general, published a number of article on their issues already: https://palant.de/category/lastpass/ https://palant.de/category/lastpass/