3 ms·
The sole responsibility for this issue starts and ends with LastPass. For a security focused company, there is no excuse for a threat model to not include insi
by MisterKent 4y ago
The sole responsibility for this issue starts and ends with LastPass.
For a security focused company, there is no excuse for a threat model to not include insider threats, vulnerable software inside an employees network, and potential phishing of employee credentials.
If it wasn't going to happen through Plex, it would have happened through something else.
Them pivoting like this is such a bad faith attempt at pinning the blame on a company that did everything right with regards to security. They should own up, and not try and throw another company under the bus. Even naming Plex as part of the attack chain seems disingenuous at best.
- ravi-delia 4y agoThe article really doesn't do anything of the sort, and honestly neither does the statement. LastPass acknowledged that the issue had been patched for "75" versions, and discussed how it wouldn't have mattered if they had practiced proper isolation. edit: Or not, or with major qualifications. That quote was mislabeled in the article
- tech234a 4y agoOne of the comments on the article points out that this comment may have actually been from Plex and mislabeled. PCMag credits Plex for the quote: https://www.pcmag.com/news/lastpass-employee-couldve-prevented-hack-with-a-software-update https://www.pcmag.com/news/lastpass-employee-couldve-prevent...
- ravi-delia 4y agoOh that's less great. "Reached out to inform...them" is absolutely rich
- joemazerino 4y agoCouldn't agree more. Its not like Lastpass hasn't been hacked before.