4 ms·

I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel

by ejcx 12y ago

I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two. When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same request a bunch of times, I just kind of chuckled. It was a good bug. Josip is top notch.

monksy 12y ago
BTW: I just subscribed to LastPass a few days ago. I'm pretty happy with the service.
- jdubs 12y ago
  LastPass is awesome but I hate their website login process! It bothers me to no extreme that if I type in my email address with a wrong username, it pops back with, "Invalid password" while typing in a obviously random email, it pops back with a "Unknown email address. Would you like to create an account now?." I worry that a malicious attacker could finger the service for potential victims.
  - ejcx 12y ago
    Username enumeration is a valid concern. Requests on the login form (and some other places) are throtted. If you get too many emails wrong you will start only getting errors.
  - innocenat 12y ago
    It is already normally possible to test whether email address is registered by trying to register with that email address. Unless that process is secured too, it doesn't really make much sense to not pop up Unknown email address error.
    - pwman 12y ago
      Correct -- It's a pet peeve of mine when login processes obscure this saying invalid password when the sign up process doesn't -- if you're going to tell people usernames aren't available then you shouldn't be avoiding it on the login screen.
franjkovic 12y ago
Thanks! I reported the bug to security@ email, and one of your team's members replied on the same day (January 6th). Either way, good job on fixing this really fast. I wish more teams are as responsive as yours.
- ejcx 12y ago
  Oh okay I was mistaken then. I believe the race condition is on the rise in terms of severity and importance. Developers are aware of common OWASP bugs, but this type of race condition is often overlooked and developers are going to NEED to be just as aware of. Way to go.
homakov 12y ago
> When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same request a bunch of times, I just kind of chuckled. It was a good bug That's the problem with OWASP, when developer from a big company sees race condition for the first time and is surprised

by ejcx 12y ago

monksy 12y ago

BTW: I just subscribed to LastPass a few days ago. I'm pretty happy with the service.

jdubs 12y ago
LastPass is awesome but I hate their website login process! It bothers me to no extreme that if I type in my email address with a wrong username, it pops back with, "Invalid password" while typing in a obviously random email, it pops back with a "Unknown email address. Would you like to create an account now?." I worry that a malicious attacker could finger the service for potential victims.
- ejcx 12y ago
  Username enumeration is a valid concern. Requests on the login form (and some other places) are throtted. If you get too many emails wrong you will start only getting errors.
- innocenat 12y ago
  It is already normally possible to test whether email address is registered by trying to register with that email address. Unless that process is secured too, it doesn't really make much sense to not pop up Unknown email address error.
  - pwman 12y ago
    Correct -- It's a pet peeve of mine when login processes obscure this saying invalid password when the sign up process doesn't -- if you're going to tell people usernames aren't available then you shouldn't be avoiding it on the login screen.

franjkovic 12y ago

Thanks! I reported the bug to security@ email, and one of your team's members replied on the same day (January 6th). Either way, good job on fixing this really fast. I wish more teams are as responsive as yours.

ejcx 12y ago
Oh okay I was mistaken then. I believe the race condition is on the rise in terms of severity and importance. Developers are aware of common OWASP bugs, but this type of race condition is often overlooked and developers are going to NEED to be just as aware of. Way to go.

homakov 12y ago

> When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same request a bunch of times, I just kind of chuckled. It was a good bug That's the problem with OWASP, when developer from a big company sees race condition for the first time and is surprised