4 ms·

>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzippin

by tyingq 5y ago

>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount of the size as arrays of localized text, error messages, lists of numbers, etc. But it is still a lot of JS.

yawaworht1978 5y ago
Wow, how can this amount of files be justified? And how did this breached exactly happen?
- samtho 5y ago
  > Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.
  - hetspookjee 5y ago
    I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.
    - feoren 5y ago
      Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".
      - deleted 5y ago
        [deleted]
      - 101011 5y ago
        To be fair, orthogonal just means something that’s at a right angle to another line. I’ve heard people refer to something that is opposite, or an antonym to parallel (or in sync) as orthogonal.
      - albedoa 5y ago
        Here it means "perpendicular". A high dependency count is perpendicular to the goal of reducing exposure as much as possible.
  - Strilanc 5y ago
    Seems like a pretty good metric of complexity to me, particularly when it comes to a security audit. Having a lot of packages packaged up in the extension corresponds to having a lot of source code you have to vet, lest it be an avenue of attack.
  - tgsovlerkhgsel 5y ago
    "total of 25MB of javascript" is a good metric of the complexity of the application's code, and correspondingly the difficulty of auditing it (I'd say 25 MB of JS code make it infeasible).
  - VWWHFSfQ 5y ago
    25MB of plaintext lines of javascript code is absolutely an indication of the complexity
  - kerneloftruth 5y ago
    File count and general "bloat" is an indicator of the quality of the engineering in the product. Especially for a security product _minimalism_ should be evident -- nobody with good security sense would want or allow anything not truly necessary to the product's functionality to be included. There's a lot of room between "super trivial" and "needlessly complex" -- it shouldn't be either. Trusting a cloud-based third party with my passwords is a non-starter for me.
    - tyingq 5y ago
      I posted the GP, with the sizes, etc. I think they do have a somewhat hard problem to solve though. They probably also want to minimize remote calls so that the extension is functional offline, is more secure, etc. Which would drive the size up, especially with localized errors, etc.
foxfluff 5y ago
> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript. For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs, etc.) and the compressed image that contains all of this easily fits in 16MB SPI NOR flash with a few megs to spare.
- symlinkk 5y ago
  Does your product have any images or localized text that could balloon the size?
  - foxfluff 5y ago
    Nope.
    - symlinkk 5y ago
      So that explains why it’s so small then.
      - foxfluff 5y ago
        If you measured the proportion of localized text and images in the 25MB of javascript mentioned above, please post these numbers. Otherwise nothing's been explained. There's 4.3 megabytes of plain text in the KJV bible. Is LastPass' localization longer than the bible? https://www.gutenberg.org/cache/epub/10/pg10.txt https://www.gutenberg.org/cache/epub/10/pg10.txt
kryogen1c 5y ago
> The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. i wonder if any of that is log4j ( :
- CamelRocketFish 5y ago
  How could it be log4j if it’s JavaScript and not Java?

by tyingq 5y ago

yawaworht1978 5y ago

Wow, how can this amount of files be justified? And how did this breached exactly happen?

samtho 5y ago
> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.
- hetspookjee 5y ago
  I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.
  - feoren 5y ago
    Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".
    - deleted 5y ago
      [deleted]
    - 101011 5y ago
      To be fair, orthogonal just means something that’s at a right angle to another line. I’ve heard people refer to something that is opposite, or an antonym to parallel (or in sync) as orthogonal.
    - albedoa 5y ago
      Here it means "perpendicular". A high dependency count is perpendicular to the goal of reducing exposure as much as possible.
- Strilanc 5y ago
  Seems like a pretty good metric of complexity to me, particularly when it comes to a security audit. Having a lot of packages packaged up in the extension corresponds to having a lot of source code you have to vet, lest it be an avenue of attack.
- tgsovlerkhgsel 5y ago
  "total of 25MB of javascript" is a good metric of the complexity of the application's code, and correspondingly the difficulty of auditing it (I'd say 25 MB of JS code make it infeasible).
- VWWHFSfQ 5y ago
  25MB of plaintext lines of javascript code is absolutely an indication of the complexity
- kerneloftruth 5y ago
  File count and general "bloat" is an indicator of the quality of the engineering in the product. Especially for a security product _minimalism_ should be evident -- nobody with good security sense would want or allow anything not truly necessary to the product's functionality to be included. There's a lot of room between "super trivial" and "needlessly complex" -- it shouldn't be either. Trusting a cloud-based third party with my passwords is a non-starter for me.
  - tyingq 5y ago
    I posted the GP, with the sizes, etc. I think they do have a somewhat hard problem to solve though. They probably also want to minimize remote calls so that the extension is functional offline, is more secure, etc. Which would drive the size up, especially with localized errors, etc.

foxfluff 5y ago

> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript. For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs, etc.) and the compressed image that contains all of this easily fits in 16MB SPI NOR flash with a few megs to spare.

symlinkk 5y ago
Does your product have any images or localized text that could balloon the size?
- foxfluff 5y ago
  Nope.
  - symlinkk 5y ago
    So that explains why it’s so small then.
    - foxfluff 5y ago
      If you measured the proportion of localized text and images in the 25MB of javascript mentioned above, please post these numbers. Otherwise nothing's been explained. There's 4.3 megabytes of plain text in the KJV bible. Is LastPass' localization longer than the bible? https://www.gutenberg.org/cache/epub/10/pg10.txt https://www.gutenberg.org/cache/epub/10/pg10.txt

kryogen1c 5y ago

> The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. i wonder if any of that is log4j ( :

CamelRocketFish 5y ago
How could it be log4j if it’s JavaScript and not Java?