4 ms·

Fake app masquerading as password manager LastPass just pulled from App Store

88 points by pg_1234 3y ago

gnabgib 3y ago
Related: "Fraudulent App Impersonating LastPass Currently Available in Apple App Store"[0](from lastpass, 6 points 7 hours ago), "Fake LastPass password manager spotted on Apple's App Store" (34 points, 5 hours ago, 25 comments) [0]: https://news.ycombinator.com/item?id=39302640 https://news.ycombinator.com/item?id=39302640 [1]: https://news.ycombinator.com/item?id=39304732 https://news.ycombinator.com/item?id=39304732
Shank 3y ago
This has been an ongoing issue, albeit not with examples this egregious. If there's one thing I hope the DMA provides, it's a compelling case to Apple to more carefully review and reject scams worldwide. Every time an app like this slips through, it makes the platform worse. While some failures are expected, I really want Apple to do better than to let a direct impersonation of a password manager through.
- ikesau 3y ago
  i'm not sure i understand you. you're saying third party app stores will incentivise apple to improve their quality control to better differentiate them from competing app stores?
  - Shank 3y ago
    Yeah, I mean, that's what I would hope? Especially if a competing app store were to surface with "better" standards for this. As someone residing in the USA, I don't directly benefit from the DMA, but I would sure like to have the App Store improve.
deleted 3y ago
[deleted]
throwaway295729 3y ago
How does an app like this get approved by Apple? Or do they sneak it in with an update?
- Linkd 3y ago
  It's really not that hard. At the end of the day it's just a human making quick decisions hundreds of times a day. I've had more than my share of rejected updates that get approved after a re-submission with no change.
  - fatnoah 3y ago
    > At the end of the day it's just a human making quick decisions hundreds of times a day. My company had a version of our communications app in the app store for several years. We decided to sell private-branded versions for some customers where the only differences were the color palette and logo shown on the login screen. For the app versions we created for customers, one was approved on first review, another required a couple months of back-and-forth with the reviewer, and the third never got approved.
- lapcat 3y ago
  > Or do they sneak it in with an update? Every update is reviewed.
- deleted 3y ago
  [deleted]
- jmull 3y ago
  What's LastPass? You and I know, but the great majority of the people in the world do not. And, of course, we only see the cases where the scam app gets through. The success rate for these scams might be pretty low, but from our perspective we wouldn't know.
  - KomoD 3y ago
    > You and I know, but the great majority of the people in the world do not. Relevance? When there is already an app called LastPass published by LogMeIn with millions of downloads, clearly you don't approve an app called LastPass published by a "Parvati Patel"
dessimus 3y ago
To be fair, the user's passwords were gonna get exploited anyways using the real LastPass anyways.
- girafffe_i 3y ago
  I first thought this post was a slight saying the real app was "masquerading as a password manager"
  - dessimus 3y ago
    Given LP's multiple security issues, that is an fair argument.
bradly 3y ago
I worked on issues similar to this during my time at Apple, but from the search and discovery side of things. You would have bands in Apple Music name themselves genres like "Rock and Roll" or and all sorts of shenanigans.
- jrm4 3y ago
  Shenanigans? You mean marketing? :)
  - bradly 3y ago
    We’ll see that’s the rub. Isn’t it? Should someone be able to create a band called Meditation Playlist? Is it fraud? Is it just unethical? Is it neither? It requires human judgment where that line is.
    - jrm4 3y ago
      I don't think it's legally "fraud." I can't say it's unethical either. Some third party made a place where people can publicly post things and try to make them popular. They're just "hackers", in the positive 80's sense, to me. The responsibility for "fixing" it or whatever is on the platform.
      - bradly 3y ago
        > The responsibility for "fixing" it or whatever is on the platform. I agree! It made for interesting search problems to solve for sure. What are your thoughts on the LassPass app? If they were phishing for LastPass credentials, that's going to be a problem, but if they had a real service then I'm not sure.
deleted 3y ago
[deleted]
from-nibly 3y ago
Good thing apple has a manual review process.
- FireBeyond 3y ago
  The walled garden will protect you from this!

88 points by pg_1234 3y ago

Related: "Fraudulent App Impersonating LastPass Currently Available in Apple App Store"[0](from lastpass, 6 points 7 hours ago), "Fake LastPass password manager spotted on Apple's App Store" (34 points, 5 hours ago, 25 comments) [0]: https://news.ycombinator.com/item?id=39302640 https://news.ycombinator.com/item?id=39302640 [1]: https://news.ycombinator.com/item?id=39304732 https://news.ycombinator.com/item?id=39304732

Shank 3y ago

This has been an ongoing issue, albeit not with examples this egregious. If there's one thing I hope the DMA provides, it's a compelling case to Apple to more carefully review and reject scams worldwide. Every time an app like this slips through, it makes the platform worse. While some failures are expected, I really want Apple to do better than to let a direct impersonation of a password manager through.

ikesau 3y ago
i'm not sure i understand you. you're saying third party app stores will incentivise apple to improve their quality control to better differentiate them from competing app stores?
- Shank 3y ago
  Yeah, I mean, that's what I would hope? Especially if a competing app store were to surface with "better" standards for this. As someone residing in the USA, I don't directly benefit from the DMA, but I would sure like to have the App Store improve.

deleted 3y ago

[deleted]

throwaway295729 3y ago

How does an app like this get approved by Apple? Or do they sneak it in with an update?

Linkd 3y ago
It's really not that hard. At the end of the day it's just a human making quick decisions hundreds of times a day. I've had more than my share of rejected updates that get approved after a re-submission with no change.
- fatnoah 3y ago
  > At the end of the day it's just a human making quick decisions hundreds of times a day. My company had a version of our communications app in the app store for several years. We decided to sell private-branded versions for some customers where the only differences were the color palette and logo shown on the login screen. For the app versions we created for customers, one was approved on first review, another required a couple months of back-and-forth with the reviewer, and the third never got approved.
lapcat 3y ago
> Or do they sneak it in with an update? Every update is reviewed.
deleted 3y ago
[deleted]
jmull 3y ago
What's LastPass? You and I know, but the great majority of the people in the world do not. And, of course, we only see the cases where the scam app gets through. The success rate for these scams might be pretty low, but from our perspective we wouldn't know.
- KomoD 3y ago
  > You and I know, but the great majority of the people in the world do not. Relevance? When there is already an app called LastPass published by LogMeIn with millions of downloads, clearly you don't approve an app called LastPass published by a "Parvati Patel"

dessimus 3y ago

To be fair, the user's passwords were gonna get exploited anyways using the real LastPass anyways.

girafffe_i 3y ago
I first thought this post was a slight saying the real app was "masquerading as a password manager"
- dessimus 3y ago
  Given LP's multiple security issues, that is an fair argument.

bradly 3y ago

I worked on issues similar to this during my time at Apple, but from the search and discovery side of things. You would have bands in Apple Music name themselves genres like "Rock and Roll" or and all sorts of shenanigans.

jrm4 3y ago
Shenanigans? You mean marketing? :)
- bradly 3y ago
  We’ll see that’s the rub. Isn’t it? Should someone be able to create a band called Meditation Playlist? Is it fraud? Is it just unethical? Is it neither? It requires human judgment where that line is.
  - jrm4 3y ago
    I don't think it's legally "fraud." I can't say it's unethical either. Some third party made a place where people can publicly post things and try to make them popular. They're just "hackers", in the positive 80's sense, to me. The responsibility for "fixing" it or whatever is on the platform.
    - bradly 3y ago
      > The responsibility for "fixing" it or whatever is on the platform. I agree! It made for interesting search problems to solve for sure. What are your thoughts on the LassPass app? If they were phishing for LastPass credentials, that's going to be a problem, but if they had a real service then I'm not sure.

deleted 3y ago

[deleted]

from-nibly 3y ago

Good thing apple has a manual review process.

FireBeyond 3y ago
The walled garden will protect you from this!