Breaking LastPass: Instant Unlock of the Password Vault

Re:Breaking LastPass: Instant Unlock of the Password Vault by Spivak on Thursday April 09, 2020 @11:03AM (#22823206)

The short version: LastPass doesn't use the login keyring to save the master password when it's saved opting to instead store it in a local file.

I think it's funny that these things are considered vulns since I can't even count the number of random dev tools (hello awscli that needs a 3rd party wrapper to use the keyring) that need password and keys just lying around in plaintext files.

Filevault, Bitlocker, and LUKS are the only real defense against this sort of thing since once you hijack a logged in session the best you can do is make attacks harder, not actually stop them.

[ Parent | on HN ]

Re:Breaking LastPass: Instant Unlock of the Password Vault by abjKT26nO8 on Thursday April 09, 2020 @03:26PM (#22826234)

As far as I understand, Apple's Keychain lets you save passwords and then grant access to them on per-application basis, instead of leaving them lying in text files for any program to read. Could anybody confirm that? I've never had a Mac, but I've been thinking about this issue for quite some time.

(EDIT: TFA doesn't clarify that.)

[ Parent | on HN ]

Re:Breaking LastPass: Instant Unlock of the Password Vault by 0xff00ffee on Thursday April 09, 2020 @01:54PM (#22825296)

Why doesn't it though? The paper referred to in this "ad" is from 2013. That's 7 years ago. And LastPass is very good at responding to issues. Clearly they don't see this as a problem?

[ Parent | on HN ]