3 ms·

Did any of you actually expect that you could share an account (a username and password) without one party knowing a piece of the information? Whether through

by theboss 13y ago

Did any of you actually expect that you could share an account (a username and password) without one party knowing a piece of the information? Whether through burp or through Dom inspection there is not much possibility to share an account without them reading the password. The feature of sharing an account is, by definition, insecure. The best solution, if you must share the account, is to use LastPass and change the password after they use the account and let LastPass remember the new password.

300bps 13y ago
Did any of you actually expect that you could share an account (a username and password) without one party knowing a piece of the information? Most technical users would not believe this. But here's the problem. This is what LastPass says when sharing the password: password will remain a secret So it is rational to believe that the majority of users will believe (since they are told this by LastPass) that the password will remain a secret. And this misses the most important issue. What other claims are LastPass asserting that are easily falsified?
- theboss 13y ago
  In my examination last pass does a good job with what it does and I know it has held up under scrutiny from various infosec professionals (you can find some blog posts from nova hacKer's) You can also code audit them by installing their chrome extension and finding where it's installed
  - 300bps 13y ago
    it has held up under scrutiny from various infosec professionals (you can find some blog posts from nova hacKer's) Thanks for the additional information. I was honestly incredulous that any security professional would recommend LastPass for important things like bank credentials so I did some Googling specifically for the one you mentioned: https://www.novainfosec.com/2011/11/15/new-multifactor-authentication-for-lastpass/ https://www.novainfosec.com/2011/11/15/new-multifactor-authe... Although I probably wouldn’t store high value passwords using an online service like this, LastPass provides an simple way to use different strong passwords for every site you need to authenticate to. This is exactly how I think about it. Online forums? Sure, LastPass is probably great. Online banking? No. Brokerages? No. Web-based email? No.

by theboss 13y ago

300bps 13y ago

Did any of you actually expect that you could share an account (a username and password) without one party knowing a piece of the information? Most technical users would not believe this. But here's the problem. This is what LastPass says when sharing the password: password will remain a secret So it is rational to believe that the majority of users will believe (since they are told this by LastPass) that the password will remain a secret. And this misses the most important issue. What other claims are LastPass asserting that are easily falsified?

theboss 13y ago
In my examination last pass does a good job with what it does and I know it has held up under scrutiny from various infosec professionals (you can find some blog posts from nova hacKer's) You can also code audit them by installing their chrome extension and finding where it's installed
- 300bps 13y ago
  it has held up under scrutiny from various infosec professionals (you can find some blog posts from nova hacKer's) Thanks for the additional information. I was honestly incredulous that any security professional would recommend LastPass for important things like bank credentials so I did some Googling specifically for the one you mentioned: https://www.novainfosec.com/2011/11/15/new-multifactor-authentication-for-lastpass/ https://www.novainfosec.com/2011/11/15/new-multifactor-authe... Although I probably wouldn’t store high value passwords using an online service like this, LastPass provides an simple way to use different strong passwords for every site you need to authenticate to. This is exactly how I think about it. Online forums? Sure, LastPass is probably great. Online banking? No. Brokerages? No. Web-based email? No.