Re:LastPass bug leaks credentials from previous site
by jsutton on Monday September 16, 2019 @12:39PM
(#20985867)
The vast majority of people don't have the same threat model, and unfortunately just want the product to work, or they won't use it at all. If you can't provide relevant information for the current website, you just won't be able to succeed as a password manager outside of niche markets.
[ Parent
| on HN ]
Re:LastPass bug leaks credentials from previous site
by reilly3000 on Monday September 16, 2019 @01:42PM
(#20986637)
Yes, but that's the essence of the whole problem: there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't. Diabling autofill pretty much eliminates the whole vector though, without breaking UX that hard.
Re:LastPass bug leaks credentials from previous site
by dsissitka on Monday September 16, 2019 @02:08PM
(#20986916)
> there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't.
Can you give an example?
Re:LastPass bug leaks credentials from previous site
by zarify on Monday September 16, 2019 @06:29PM
(#20989184)
There was this example from 2017. https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-u...
I seem to remember reading about similar stuff done elsewhere, but don't remember the details (or apparently a useful search term :P).