This is way worse than a lot of people realize. Obviously, the unencrypted URLs mean we may see another wave of blackmail a la Ashley Madison, but there's a hu

This is way worse than a lot of people realize. Obviously, the unencrypted URLs mean we may see another wave of blackmail a la Ashley Madison, but there's a huge potential vulnerability in that most people only have one personal email address. I have my GSuite configured so that I can make email addresses start with a few special characters and then I can just make things up after that (e.g. abc123.anythingiwant@mydomain will get auto-routed to the me@mydomain inbox), so if I used LastPass, you couldn't even try to break into any of my accounts since my vault login email would be completely different from every site I have in the vault. But I'd bet most people don't even know it's possible to do this, much less know how to set it up, and they are thus vulnerable to attackers clicking "Forgot password?" links and typing in the LastPass account email. I'm glad I switched away from LastPass years back. They always seemed fast and loose with security. BitWarden offered a much better mobile experience and seemed to take security much more seriously (self hosting? heck yeah!), and each time LastPass ends up in the news, I am all the more grateful I made the switch. Edit: If anyone else uses GSuite for their personal email, if you want to be able to generate custom addresses on the fly, go to the GSuite Admin Console > Apps > Google Workspace > Gmail > Default Routing, and add one or more rules like so: 1. Recipients to match: Pattern match Regexp: (?i)somelettershere\d*?\..+?@domain\.tld 2. If match: Modify message Envelope recipient: (check the box for) Change envelope recipient Replace username: <your normal GSuite username> 3. Options: (select the option) Perform this action on non-recognized and recognized addresses After you setup the rule, make sure to set the order such that any pattern matching goes before the default "All recipients" rule. I have two of these rules in place so that I can create email addresses in either of the following formats: <name>.<whatever I want>@domain.tld <initials>mr<random numbers>.<whatever I want>@domain.tld This is super useful since a lot of websites don't let you include a "+" in your email address, so you can't use Gmail's helpful "+" functionality. This entirely bypasses those arbitrary restrictions. Edit 2: Just thought about all the terrible web applications I've used over the years which store identifying info in URLs, including session tokens in some cases (yes, you read that right - they don't bother with cookies, so if you send someone a URL without sanitizing it, they get auto-logged into your account!). This info is all unencrypted, and most people probably don't bother sanitizing URLs before putting them into their vault (in fact, they probably just let LastPass pluck the current URL to save). Applications that bad typically don't bother expiring sessions for inactivity and thus the accounts are completely open to compromise!