Grammarly shared its tokens with all websites

Re:Grammarly shared its tokens with all websites by ransom1538 on Tuesday February 06, 2018 @11:04AM (#16317105)

I am too paranoid to use them, but, from what I read (regarding the biggest one):

"LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data"

If there is an attack still possible (even using LastPass employees) can you post it here?

[ Parent | on HN ]

Re:Grammarly shared its tokens with all websites by skymt on Tuesday February 06, 2018 @11:35AM (#16317357)

Project Zero has found a number of major flaws in the LastPass extension.

https://bugs.chromium.org/p/project-zero/issues/detail?id=88... https://bugs.chromium.org/p/project-zero/issues/detail?id=11... https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

At a glance what they have in common is flaws in the scripts that the LastPass extension injects into pages. The injected scripts can communicate with the extension core with a set of RPCs. Each of these issues is a way of tricking the extension into running RPCs from untrusted JavaScript on any web page. The RPCs available allow an attacker to fetch the credentials for any site in the database or even execute arbitrary code on the host.

[ Parent | on HN ]

Re:Grammarly shared its tokens with all websites by rileyteige on Tuesday February 06, 2018 @11:19AM (#16317215)

Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass)

The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form.

Aside from that, I am not aware of other "hot" attack vectors.

[ Parent | on HN ]

Re:Grammarly shared its tokens with all websites by LocalPCGuy on Tuesday February 06, 2018 @11:37AM (#16317374)

LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are.

Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it comes to being as secure as possible.

[ Parent | on HN ]

Re:Grammarly shared its tokens with all websites by paulryanrogers on Tuesday February 06, 2018 @02:59PM (#16319047)

I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users

[ Parent | on HN ]

Re:Grammarly shared its tokens with all websites by rajasinghe on Tuesday February 06, 2018 @03:56PM (#16319490)

I used LastPass for a while. Then it filled in my username and password (correctly) on a website without my having authenticated... It looks like there's an unencrypted local cache which is not flushed when your authentication expires or you log out. I wasn't able to reproduce it but I was sufficiently spooked to stop using it after that.

[ Parent | on HN ]

Re:Grammarly shared its tokens with all websites by stolsvik on Thursday February 08, 2018 @04:34PM (#16335768)

Sure it wasn't the browser that filled it in?

[ Parent | on HN ]