Re:LastPass release fix for DOM manipulation vulnerability
by AnkhMorporkian on Saturday April 01, 2017 @08:21AM
(#14011784)
That really isn't an option for most users. People who use a password manager are pretty much forced to use that password manager, at least if they're using it properly. Most users won't know how to export it to a CSV and then use that without a browser extension and/or import that to another password manager.
Re:LastPass release fix for DOM manipulation vulnerability
by scott00 on Saturday April 01, 2017 @10:07AM
(#14012169)
This vulnerability didn't affect Android or iOS apps. A user could have transcribed passwords from mobile to browser for a few days.
Re:LastPass release fix for DOM manipulation vulnerability
by pluma on Saturday April 01, 2017 @09:10AM
(#14011935)
Also "not using it" depending on the kind of exploit may mean completely shutting down the account until the vulnerability is fixed.
Re:LastPass release fix for DOM manipulation vulnerability
by Thrillington on Saturday April 01, 2017 @12:17PM
(#14012807)
Isn't that the right thing to do for truly sensitive passwords?
I'd much rather transcribe my financial account passwords to paper, or not log in for a couple days than have multiple months where a vulnerability might be exploitable
In the case of the Lastpass exploit it would've been to not use Lastpass for a few days. That's one benefit of direct disclosure to the user.