News for hackers. Stuff that matters.

A comment on Grammarly shared its tokens with all websites. Parent comment

Re:Grammarly shared its tokens with all websites by rileyteige on Tuesday February 06, 2018 @11:19AM (#16317215)
Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass)

The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form.

Aside from that, I am not aware of other "hot" attack vectors.

[ Parent | on HN ]
Re:Grammarly shared its tokens with all websites by LocalPCGuy on Tuesday February 06, 2018 @11:37AM (#16317374)
LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are.

Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it comes to being as secure as possible.

[ Parent | on HN ]
Re:Grammarly shared its tokens with all websites by paulryanrogers on Tuesday February 06, 2018 @02:59PM (#16319047)
I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users
[ Parent | on HN ]