2 ms·
They claim it's credential stuffing, but there are plenty of people on the HN thread (https://news.ycombinator.com/item?id=29705957 https://news.ycombinator.com
by tgsovlerkhgsel 5y ago
They claim it's credential stuffing, but there are plenty of people on the HN thread (https://news.ycombinator.com/item?id=29705957 https://news.ycombinator.com/item?id=29705957) claiming to have used a unique password.
Does LastPass/LogMeIn have a history of lying about/downplaying security incidents? I only remember a controversial (and to my knowledge unresolved) issue at TeamViewer (where the company claimed no compromise but due to the number of reports there were doubts about that claim).
- shakna 5y agoNot lying, but definitely downplaying past incidents [0], of which they have had a number. [0] https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues
- tgsovlerkhgsel 5y agoOh, that leads to an interesting possibility: Yet another vulnerability in their extension, allowing a malicious web site to access the master password. This could be very hard to trace since users would have to notice the correlation between visiting a certain web site (or e.g. one of many compromised sites) and getting hacked. Worse, combined with malvertising, it could be exploited from almost any web site if the user doesn't block ads.