4 ms·
Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to
by eknkc 13y ago
Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain.
1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find useful.
- jessedhillon 13y agoWith LP, auto-fill is an opt-in, per-domain feature.
- pessimizer 13y agoWouldn't Yahoo be exactly the type of site that you would opt-in to autofill for?
- deleted 13y ago[deleted]
- HaloZero 13y agoI honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.
- neltnerb 13y agoWhat's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.
- toast0 13y agoJust because there's no autofill doesn't mean you don't have a password manager.
- blazingice 13y ago1Password's browser extension v4, in contrast, fills in the form only when you press a key combination (⌘-\ on OSX), and has you enter your master password into a dropdown from the OSX Menu Bar, and not inside the browser frame. Pretty snazzy all around.
- neltnerb 13y agoAha, I see the distinction now. Thanks. Enough to simply disable autofill in LastPass then? I'm loathe to learn a new system because of such a seemingly small size vulnerability. LastPass has me enter the master password in a pop up window when I click on the icon from the extension (firefox/chrome), although I suppose that's maybe not as good as an independent application?
- korg250 13y agoExactly. I can, not only disable autofill in the Lastpass configuration, but also set to require password reprompt for any of my credentials. I could also individually disable autofill for any credential. Please should first know how something works before criticizing.
- jpgoldberg 13y ago[Disclosure: I work for AgileBits, the makers of 1Password] In 1Password 4, there is no auto-filling. People can use Ctrl-\ or Cmd-\ to tell 1Password to "fill this page". In versions prior to 4, auto-fill was an option. (I'm not sure which versions had what defaults.)
- HaloZero 13y agoOh I know. I use 1Password. I forgot to mention that your solution works better but I believe blazingice mentioned it above.
- judk 13y agoAre you saying that yahoo web mail lets senders create forms with submit actions? That's.. Horribly broken. But tumbler allows JavaScript redirects to phishing sites, so yahoo standard I guess.
- CurtMonash 13y agoEverybody needs a few critical passwords that they should memorize and not use shortcuts with. My email and Paypal passwords are very strong; to break them you have to either keylog/shouldersurf/whatever, or else brute force an attack for quite a few characters. Nor will you find joy with alternate ways of getting in, such as security questions. If I used a password manager, its password would be another critical one, but even so I probably wouldn't use it for accessing my other crucial accounts. A lot of my other accounts can be more easily hacked, but relatively little harm would be done if they were. I think one of my MMO accounts -- to a game I no longer play -- actually was.
- vithlani 13y agoWhy not disable auto-fill and auto-submit in your global preference?
- jagermo 13y agoNot sure it would be that easy. LastPass only auto fills known domains, so you would have to spoof that too.
- wubbfindel 13y agoHence why they said: "send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain."
- korg250 13y agoThen you disable autofill. Problem solved.
- wubbfindel 13y agoTrue....but now if I suggest LastPass to anyone I have to remember to opt-out of this feature. I am actually a LP user, but I would prefer it was more secure by default.