3 ms·

Agreed. On the other hand, I've used it to share passwords with non-geeks, and I wouldn't expect them to be able to retrieve it just with the Chrome inspector.

Agreed. On the other hand, I've used it to share passwords with non-geeks, and I wouldn't expect them to be able to retrieve it just with the Chrome inspector. That is the surprising part of the article, at least to me. I would like to see at least that part fixed, anything else is fine by me at least (if you want their browser to login, the password has to go through the network at some point, so there's really no news here).

oakwhiz 13y ago
But what if those non-geeks have other geek friends besides you who are able to retrieve it and have temporary access to their computer?
- giovannibajo1 13y ago
  In that case, it's just like if the feature didn't exist. I think it's pretty clear that the feature is just obscurity and works only in simple cases. It was pretty clear for me at least from the moment I saw it, and it's clearly written and explained. Does it make it useless? I don't think so. I'd rather LastPass keep it the way it is (maybe closing down the most simple way to retrieve it, like the inspector) rather than removing it altogether just because it can't be a real security feature.
jrochkind1 13y ago
Non-geeks probably don't know how to use the chrome inspector, right? Well, they do if they find instructions to follow to do so to retrieve a LastPass shared password. I would expect that, no matter how they try to obscure it, it will be retrievable even by non-geeks who find and follow specific instructions to retrieve it. So I'm not sure how much development effort it's worth to try and obscure it further -- if that's even possible. LastPass probably ought to be VERY very clear that it's merely slightly obscured, not truly protected, from someone you share it with. Mainly because if someone is confused about this, when they find out it's less protected then they thought, they may begin to doubt LastPass's security in general. If I were LastPass, I'd reduce the level of obscuring going on, to try to make it even more obvious that a shared password is not protected from the sharee.
- giovannibajo1 13y ago
  IMHO LastPass is clear about it. They say: "Savvy end users could potentially access the password if they capture it using advanced techniques during the login process". I think this sentence conveys the correct meaning to most people reading it (programmers should understand that the feature is not real security just upon seeing it). I agree that most end-users won't know how to use the inspector, but that's really two clicks on a window of their browser. The blog also goes the complicated way with javascript, but the easiest way (also mentioned) is really really easy: right click on the password, inspect element, click on "properties", scroll down. Using wireshark or modifying /etc/hosts with a custom html file is surely more complicated.

oakwhiz 13y ago

But what if those non-geeks have other geek friends besides you who are able to retrieve it and have temporary access to their computer?

giovannibajo1 13y ago
In that case, it's just like if the feature didn't exist. I think it's pretty clear that the feature is just obscurity and works only in simple cases. It was pretty clear for me at least from the moment I saw it, and it's clearly written and explained. Does it make it useless? I don't think so. I'd rather LastPass keep it the way it is (maybe closing down the most simple way to retrieve it, like the inspector) rather than removing it altogether just because it can't be a real security feature.

jrochkind1 13y ago

Non-geeks probably don't know how to use the chrome inspector, right? Well, they do if they find instructions to follow to do so to retrieve a LastPass shared password. I would expect that, no matter how they try to obscure it, it will be retrievable even by non-geeks who find and follow specific instructions to retrieve it. So I'm not sure how much development effort it's worth to try and obscure it further -- if that's even possible. LastPass probably ought to be VERY very clear that it's merely slightly obscured, not truly protected, from someone you share it with. Mainly because if someone is confused about this, when they find out it's less protected then they thought, they may begin to doubt LastPass's security in general. If I were LastPass, I'd reduce the level of obscuring going on, to try to make it even more obvious that a shared password is not protected from the sharee.

giovannibajo1 13y ago
IMHO LastPass is clear about it. They say: "Savvy end users could potentially access the password if they capture it using advanced techniques during the login process". I think this sentence conveys the correct meaning to most people reading it (programmers should understand that the feature is not real security just upon seeing it). I agree that most end-users won't know how to use the inspector, but that's really two clicks on a window of their browser. The blog also goes the complicated way with javascript, but the easiest way (also mentioned) is really really easy: right click on the password, inspect element, click on "properties", scroll down. Using wireshark or modifying /etc/hosts with a custom html file is surely more complicated.