Re:LogMeIn acquires Lastpass
by briHass on Friday October 09, 2015 @02:21PM
(#10362251)
> They still don't have access to my raw passwords.
> They however do control access to the account.
From point 2, point 1 is trivial to change. All they would need to do is update the extension or add some javascript (for the web login) to grab your master password in the clear.
Sure, a local password manager like Keepass could provide a new version that posted my p/w, key file, and DB up to a server somewhere, but I would have to manually install it, and it would have to get around a local program executable-firewall. No such challenges with auto-updating extensions and/or JS served from their server (or MITM.)
I don't know if the acquisition makes them more secure or less, but having worked at large companies, I tend to agree with:
> I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.
From point 2, point 1 is trivial to change. All they would need to do is update the extension or add some javascript (for the web login) to grab your master password in the clear.
Sure, a local password manager like Keepass could provide a new version that posted my p/w, key file, and DB up to a server somewhere, but I would have to manually install it, and it would have to get around a local program executable-firewall. No such challenges with auto-updating extensions and/or JS served from their server (or MITM.)
I don't know if the acquisition makes them more secure or less, but having worked at large companies, I tend to agree with:
> I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.