News for hackers. Stuff that matters.
Re:LastPass autofill exploit by tedmiston on Thursday July 28, 2016 @11:26AM (#12180799)
> - Lastpass is more trouble than it is worth in Safari/Mac.

Can't agree with this more. I've had so many issues with LastPass staying logged in one browser across sessions, even though the preferences are set to logout after short inactivity windows and on browser quit. LastPass seemed to lose its preferences like this multiple times, and it made me uncomfortable from a security perspective to not know for sure when my sessions would actually end.

Besides that it's mostly UX issues for me, similar to what you've described.

I also prefer 1Password's pronounceable random password generator vs LastPass's generator (obligatory xkcd https://xkcd.com/936/).

Re:LastPass autofill exploit by __jal on Thursday July 28, 2016 @12:01PM (#12181047)
Another really cool trick it plays is that it enables Secure Input, as it should, but then never disables it. So it breaks 3rd party tools that expand shortcuts, automate UI actions, etc. like TextExpander, which I use a lot.
Re:LastPass autofill exploit by tedmiston on Thursday July 28, 2016 @01:41PM (#12181777)
I've had this trouble in Chrome quite a bit too. For example, system level text expansions break in the Chrome omnibox. I think that's independent of LastPass, but I could be wrong.
Re:LastPass autofill exploit by __jal on Thursday July 28, 2016 @02:03PM (#12181927)
I'm actually talking about sort of the reverse. Secure Input is a system-level thing; it disables input capture via the accessibility API (which things like TextExpander use), which effects everything on the machine. That is what you want; when typing a password, there is no good reason for other code to be reading what you (or LastPass) is typing. You just also want it to be turned back off when you're done.

But after the first use of the LastPass Safari extension, TextExpander (or KeyboardMaestro, or a bunch of other tools) won't work anywhere until a after reboot or some other method of disabling SI.