5 ms·
This title is hyperbolic linkbait and should probably be changed. From skimming the paper, the only real flaw that seems broadly applicable is in autofill feat
by morgante 13y ago
This title is hyperbolic linkbait and should probably be changed.
From skimming the paper, the only real flaw that seems broadly applicable is in autofill features which I'm not sure 1Password even has. Those intuitively seem like a bad idea and are easy to disable.
- city41 13y agoIt also mentions that auto filling is the default for two of them.
- morgante 13y agoRight, and that default should probably be changed. But that doesn't justify this clickbait title which is simply untrue as nowhere in the report does it say that passwords are shared "everywhere."
- kaervas 13y agoAlso, not making the distinction between http/https allows retrieving most passwords if you can man-in-the-middle
- kaervas 13y agoAlso, not making the distinction between http/https allows retrieving most passwords if you can man-in-the-middle
- kaervas 13y agoAlso, not making the distinction between http/https allows retrieving most passwords if you can man-in-the-middle
- kaervas 13y agoAlso, not making the distinction between http/https allows retrieving most passwords if you can man-in-the-middle
- Havoc 13y agoLastpass does autofill, but only once a site is recognized. That to me is OK - unless there is a way to trick it of course. EDIT: Nevermind..you can configure either behaviour. Either fill in or fill & submit.
- jrockway 13y agoThe paper is about how they tricked it. It's pretty bad, but only if you use AutoLogin. (Which they should really call AutoLockout anyway. "Password bad? Let's try 3 more time this millisecond and see if the results are different those times.")