Re:Should you be concerned about LastPass uploading your pas...
by jsutton on Friday April 05, 2019 @01:07PM
(#19584664)
LastPass recently made a change to how they save generated passwords, it'll prompt you right after filling it instead of waiting for the login to succeed.
Re:Should you be concerned about LastPass uploading your pas...
by jzl on Friday April 05, 2019 @03:51PM
(#19586344)
I was very happy when I started seeing that, that's been a huge improvement.
Re:Should you be concerned about LastPass uploading your pas...
by fencepost on Friday April 05, 2019 @03:02PM
(#19585909)
If you're within the same session, the Generate Password popup likely has a down-arrow next to it that will show you a list of recently generated passwords. This has been useful occasionally.
Re:Should you be concerned about LastPass uploading your pas...
by 1024core on Friday April 05, 2019 @11:57AM
(#19583775)
> copy it to the clipboard and fill the form myself.
I'm not that familiar with mobile dev, but could a rogue app just sit in the background, making a copy of whatever's in the clipboard?
Re:Should you be concerned about LastPass uploading your pas...
by yani on Friday April 05, 2019 @12:37PM
(#19584282)
If you have such an application installed... the system has already been compromised.
Re:Should you be concerned about LastPass uploading your pas...
by shawnz on Friday April 05, 2019 @12:08PM
(#19583892)
Yes, Keepass for example avoids this by pasting some of the characters with the clipboard and some of the characters by simulating keypresses. See: https://keepass.info/%0D/help/v2/autotype_obfuscation.html
Lastpass mitigates the issue somewhat by clearing the clipboard after a certain amount of time.
Agreed, ambiguously named form input fields cause all kinds of havok, I helped our UX team track down one in our application because it was breaking my lastpass =)
For the second issue, I've just adjusted my workflow to accommodate LastPass's peculiarities. I just click "Generate Secure Password", copy it to the clipboard and fill the form myself. Then I have a copy of the password on the clipboard should LP miss adding the site properly.
While it's a slight pain to work around that particular issue, it's far better than what I used to do with regards to password reuse.