News for hackers. Stuff that matters.
Re:LastPass RCE vulnerability fixed by AhtiK on Wednesday March 22, 2017 @04:05AM (#13929201)
Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2] Initially Trezor was created as a bitcoin wallet but is much more these days.

The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK...

[1] https://trezor.io/passwords/ [2] https://blog.trezor.io/satoshilabs-launches-trezor-password-...

Re:LastPass RCE vulnerability fixed by manyxcxi on Wednesday March 22, 2017 @07:29AM (#13930062)
If you install 1Password 4 in Wine it works pretty well, I've even got browser extensions working with my Linux browser.

Its not great and it crashes some, but it does work.

Re:LastPass RCE vulnerability fixed by RubyPinch on Wednesday March 22, 2017 @05:04AM (#13929434)
I've wanted to use such a thing, but the requirement to use a specific browser is always a massive bother

same with things like yubikey

It seems like it would be better to just fake a keyboard output instead? then you could have something that could work on all platforms in all situations

Re:LastPass RCE vulnerability fixed by freeone3000 on Wednesday March 22, 2017 @11:50AM (#13931875)
KeePass does this. Autofill activates the last window, finds the "input control" on the window, then tries to type in the username, tab key, password. It breaks in all the expected ways, and sometimes new and exciting ways.
Re:LastPass RCE vulnerability fixed by RubyPinch on Saturday March 25, 2017 @10:15AM (#13955726)
That is software emulation though, which is restricted by various things (can't type across users (so breaks on Run As, and elevated windows), if a window implements a custom control, it won't work with that either since that window likely reads from the keyboard in a weird or wonderful way, some windows also just avoid any windows messaging and read the keyboard directly)

Hardware faking of the keyboard would work fine though