4 ms·

I'm unclear on what you mean by "MITM... serving Javascript to EVERYONE". In a typical MITM scenario, you've logged into your coffee shop with an insecure netwo

by Erwin 13y ago

I'm unclear on what you mean by "MITM... serving Javascript to EVERYONE". In a typical MITM scenario, you've logged into your coffee shop with an insecure network, or you are in some Middle Eastern country where all traffic is under control of the government. Unless you are somehow able to route all traffic through your network, you cannot MITM "everyone", no matter even you have the private certificate for lastpass.com.

jsn 13y ago
Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.
- icebraining 13y ago
  If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. But MITM can still affect a lot of people if the attacker can get into a big gateway (e.g. large company, ISP, university, etc).
  - Xylakant 13y ago
    > If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. That would leave a trace (at least the person issuing the cert would know) while heartbleed doesn't.
omh 13y ago
Yes, I'd say most MITM scenarios are at the client end. But you could, for example, be an evil network admin near the LastPass servers. That would let you MITM almost everyone who connects.
- pwman 13y ago
  You don't get very much by MITM of LastPass compared to other targets -- the extensions aren't going to pull down Javascript, the update process only uses signed binaries... You might be able to put people utilizing LastPass.com to login which we don't recommend and isn't done by the vast majority of people.
  - icebraining 13y ago
    The vast majority of people haven't logged in to LastPass.com in the last two years, since OpenSSL has been vulnerable?
    - phord 13y ago
      (Frequency of LastPass.com login via web page on insecure network) * ( odds of MITM attack on that network) = scary low odds
icebraining 13y ago
Everyone who they were MITMing. I thought that was implied in the context.

by Erwin 13y ago

jsn 13y ago

Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.

icebraining 13y ago
If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. But MITM can still affect a lot of people if the attacker can get into a big gateway (e.g. large company, ISP, university, etc).
- Xylakant 13y ago
  > If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. That would leave a trace (at least the person issuing the cert would know) while heartbleed doesn't.

omh 13y ago

Yes, I'd say most MITM scenarios are at the client end. But you could, for example, be an evil network admin near the LastPass servers. That would let you MITM almost everyone who connects.

pwman 13y ago
You don't get very much by MITM of LastPass compared to other targets -- the extensions aren't going to pull down Javascript, the update process only uses signed binaries... You might be able to put people utilizing LastPass.com to login which we don't recommend and isn't done by the vast majority of people.
- icebraining 13y ago
  The vast majority of people haven't logged in to LastPass.com in the last two years, since OpenSSL has been vulnerable?
  - phord 13y ago
    (Frequency of LastPass.com login via web page on insecure network) * ( odds of MITM attack on that network) = scary low odds

icebraining 13y ago

Everyone who they were MITMing. I thought that was implied in the context.