Well. This is not a good week for lastpass.

And for all the users of password managers which use a browser extension or a cloud synced database, KeepPassXC[1] is a good alternative, because it won't come close to touching your browser or any remote server. It is cross platform so you have no excuse. It also has a mobile app which is not made by the same developers but a different company so I would be wary of the app.

[1]:https://keepassxc.org/

Is this any better than KeePassX?

From https://keepassxc.org/docs:

>Why KeePassXC instead of KeePassX?

>KeePassX is an amazing password manager, but hasn't seen much active development for quite a while. Many good pull requests were never merged and the original project is missing some features which users can expect from a modern password manager. Hence, we decided to fork KeePassX to continue its development and provide you with everything you love about KeePassX plus many new features and bugfixes.

I'm really surprised, and disappointed, that Travis announced this publicly like this. From my understanding the Google team has a policy of giving people time to patch the bug before announcing it. I know that the technical details weren't released by by confirming there is a zero day exploit he's making it more likely to be discovered and exploited. The responsible thing would have been to notify the vendor and apply the standard policy they have in place for disclosure.

He announced it exists, though not what it is. Who knows, it might even spur some people to move away from LP.

They fixed all 3 bugs already. https://mobile.twitter.com/taviso/status/844573211278794753 I'm not moving.

I can confirm that there is unpatched exploitable vulnerabilities with high impact in the following software products:

Linux

OpenBSD

iOS

Windows

Google Chrome

Mozilla Firefox

Safari

Apache

nginx

openSSHd

bonzi buddy