Detectify Labs

"Probably refers to"? That you don't know what "secure" refers to is itself a problem. But more problematic is anyone's defense of Google Chrome's architecture while overlooking that that architecture is implemented with secret software which you aren't allowed to vet, alter, or share with others (parts of software freedom).

This proprietary software apparently allowed for sending Google every URL a Chrome user types in (http://www.favbrowser.com/google-chrome-spyware-confirmed/) and making it easy for extensions to spy on Chrome users (https://labs.detectify.com/2015/07/28/how-i-disabled-your-chrome-security-extensions/) which many Chrome extensions apparently do, or activating a Chrome user's microphone and sending the captured data to Google (https://www.privateinternetaccess.com/blog/2015/06/google-chrome-listening-in-to-your-room-shows-the-importance-of-privacy-defense-in-depth/). Hardly behavior users are likely to call "secure" because such behavior does not look out for the security of its users, but instead securing access to Chrome user's data.

I don't think I'd call them a 'sham'. They're not advertising something they don't do. I think they do everything that they say they do[1]. If this was a case where someone was able to get plaintext passwords from lastpass's server, you'd be right.

The first thing I think people should realize is that there are vulnerabilities in every software, and addressing that fact goes a long way. I doubt that they weren't following standards, and they do have a good track record of security although they get flak for being a extension based password manager (which is a very bad idea, something I've come to realize not long ago. I think it was at the time of lastpass's last vulnerability[2])

If you don't mind, I'm interested in know what you'd consider products with 'strong security'?

[1]:https://www.lastpass.com/how-it-works

[2]:https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/

It's definitely a fine sanity check but I'd have to really think about whether it's a barrier.

Immediate things I worry about are around URL parsing.

Is evil.com<insert something here>steampowered.com going to pass as "steampowered.com" when it isn't? Will it handle punycode? All sorts of shit can go wrong when parsing a URL, and it's a real world problem when people implement the mitigation you're describing[0].

https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/

This is just for starters. I think if I were being paid to think about it I'd probably be able to come up with some more. Can I mess with DNS? Can I inject some other malicious payload into the page, to take advantage of other vulns? etc etc etc

I would be extremely wary of this technique as a real boundary rather than just an assertion in code.

> they test to see if your database is decryptable with the password you entered (after it is hashed).

At which point they have full access to your database, don't they?

> And you can already read the Lastpass browser extension's source code

Of course, it's a bit more difficult, I'm betting it's minified.

High profile open source encourages people to read the source code, if nothing else. It's possible someone would've noticed that nasty cross-domain autofill bug from a while back (https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/). It's also possible that the community would hold the codebase to a higher quality standard, and a lot of issues would go away (only a rumor, but I've heard that parts of the LastPass codebase are a mess).

It's confusing that the LastPass site is claiming only Firefox is impacted. [1] Whereas the security researcher's site (detectify.com) shows the vulnerability running in Chrome. [2]

Furthermore, the current live version on Firefox addons repository is 3.x [3], which the LastPass team claims is not vulnerable. [1]

[1] https://blog.lastpass.com/2016/07/lastpass-security-updates.html/
[2] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
[3] https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/

> So if you cracked my LastPass vault - good luck with that, 2FA considered

Well, the traditional[1] way to break[2] LastPass is to ignore individual accounts and go after poor coding technique[3]. 2FA won't help you there.

[1] https://www.wired.com/2015/06/hack-brief-password-manager-lastpass-got-breached-hard/

[2] https://techcrunch.com/2011/05/05/password-manager-last-pass-possibly-hacked/

[3] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/