pwman

9 ms·

31.
by pwman 13y ago
We've always had a full blown web browser in the app -- it's been the only viable way to fill passwords in for years. Literally the first option we added. We also have an extension into Dolphin, and you can utilize Chrome utilizi
32.
by pwman 13y ago
We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem. We wish we had all si
33.
by pwman 13y ago
We implement everything in JavaScript on that page if you're trying to login from the website -- which is as secure as that page load -- LastPass recommends people utilize the extensions to mitigate this risk. Our choice could be to no
34.
by pwman 13y ago
You don't get very much by MITM of LastPass compared to other targets -- the extensions aren't going to pull down Javascript, the update process only uses signed binaries... You might be able to put people utilizing LastPass.com
35.
by pwman 13y ago
Extensions/Downloads are all cryptographically signed -- I'd hope if you're installing password management software like this that you see that it's unsigned or signed by someone other than LastPass. Using the extensions
36.
by pwman 13y ago
LastPass has a setting to respect autocomplete -- it's off by default because so many sites use it inappropriately.
37.
by pwman 13y ago
The surprising part of this is that HTTPS isn't used for the requests to Siri/Google so that this is even possible without warnings / errors.
38.
by pwman 13y ago
This was quite an experience for us here at LastPass utilizing multiple UI/UX design firms, splitting them between products and attempting to land new UI/UX experiences all at the same time. If anyone has questions or thoughts on
39.
by pwman 13y ago
LastPass https://lastpass.com Xmarks https://xmarks.com Fairfax, VA (DC area) - Full time developer (we support everything so be ready to play with everything) - Full time support analysts Email jobs at lastpass.c
40.
by pwman 13y ago
One of the reasons we liked name.com was their multi-factor support and email on action support, but it's all an illusion if hackers can get in at this level and go undetected until they helpfully post it publicly!
41.
by pwman 13y ago
Released late in the day on a Friday to try to minimize the news cycle and guarantee fewer people will see it.
42.
by pwman 14y ago
https://LastPass.com http://Gotomeeting.com http://Drive.google.com
43.
by pwman 14y ago
Author is likely incorrect about the C Corp retained earnings taxes, the tax owed for 100k of profit for Federal only would be more like $22,500 as the 15% rate is only for your first 50K of profit. The corporate tax rate is very high and s
44.
by pwman 14y ago
This is a huge downside -- accidentally type your password on a device you shouldn't have? You now have to update every site rather than just updating your master password.
45.
by pwman 14y ago
You can use LastPass as completely zero knowledge app by not utilizing the binary extensions for Chrome or Firefox.
46.
by pwman 14y ago
Can you be more specific as to how you find the LastPass UX lacking? Getting UX right is a priority for LastPass too!
47.
by pwman 14y ago
It's even beyond using a duplicate password which as you point out is ignorant. They were so unclear on the concept that they used a password that was written down into their source code, and once that source code was stolen they didn't c
48.
by pwman 14y ago
Try the prebuild: https://lastpass.com/dlpre
49.
LastPass - eHarmony password checker(lastpass.com)
1 points by pwman 14y ago|0 comments
50.
by pwman 14y ago
https, we're not using 'GET' parameters for the hash (which is almost certainly ending up in log files on leakedin's site). We also just came out with a version for eHarmony's breach: https://lastpass.com/eharmony/
51.
by pwman 15y ago
I love how LastPass isn't the solution because ... "it's a computer program". What kind of Luddite computer programmer is against using computer programs to solve their problems? Yet is fine with using SSH keys? The argument of bloat is
52.
by pwman 15y ago
If you actually test it yourself you see that they only capture phone keypad presses, and the bottom hardware keys. They don't capture the actual screen keyboard at all, that's why Trevor's video does not show the actual keyboard being cap
53.
by pwman 15y ago
Vienna, VA (DC area). Full time. LastPass / Xmarks Want to play with every new toy that comes out and make apps for them? https://lastpass.com/jobs Joe@LastPass.com
54.
by pwman 15y ago
http://www.Xmarks.com
55.
by pwman 15y ago
1) Ensure your 'ebay' query doesn't automatically correct the spelling, likely a general problem -- For LastPass I have hundreds of results like: Disney Trading Pin - FASTPASS PIN SET OF 5 -- perhaps throw out results without the keyword i
56.
by pwman 15y ago
Your speculation is correct -- we re-keyed the certificate just as a precaution. Rolling a new cert is tough as thousands of people's clocks are wrong, so we thought we'd give it a full day so those people wouldn't receive errors -- we did
57.
by pwman 16y ago
Use LastPass and generate random passwords, you'll just chuckle at the next company that does this rather than freak out...
58.
by pwman 16y ago
LastPass is already profitable enough to continue supporting Xmarks indefinitely.
59.
by pwman 16y ago
The service will remain free, and we're happy to have you as a free user. Our plan is to continue to add mobile device support and ancillary services on top to convince you that maybe $1/month is worth it. We only need to convince a few p
60.
by pwman 16y ago
Enough people pay for the advanced service with LastPass (Mobile phone support) to cover all the free users. Even if LastPass was nuked every user still has access to all their data -- a encrypted cached copy is kept on every browser and e

More ›