I also did not have a "Select all" box but was able to check the first entry, scroll down, hold shift, and check the last box which then selected all items in between. So I removed all of 600 of my accounts in about 20 seconds. Hope this helps someone.

Shift+Click to select a range is so second nature by now I don’t think it would have occurred to me to look for (or on the flip side, create) a dedicated “all” button.

Shouldn't be a second nature, that is a good old well known useful pattern like right click for context menu, very essential. Even if new methods are coined by some local reasons old and generic ones should be remembered to avoid the hopeless chaos the UX partisans push us into nowadays, doing things differently for the sole sake of doing differently.

Just me of course but I don't think I'd guess that without certain UI cues. With checkboxes for eg I wouldn't even think of shift clicking. Not disagreeing, just thinking aloud :)

When there is no obvious UI option, you at least gotta try it!

For me it’s second nature in desktop applications and file management, but I never assume that the any specific web dev has added it. (And tbh: I have less and less confidence in web code in general.)

I don't think that's dark UX, it's just shitty UI design. What bugs me the most about LastPass is how it tries to be so damned helpful and offers to fill in credentials on sites that they clearly don't belong to, or offers to save credentials on a site where I alredy clicked "don't save" 1000 times, no really, I don't want to save my private passwords in my company vault thank you very much, why the f$%& don't you have a "don't bug me again" checkbox in this sh*$$y popup?!

Something something Hanlon's razor.

I did it in the web UI in a couple minutes with down-space-down-space-down-space....

Also make sure to go to Advanced Options, View Deleted Items, and purge them from there.

That's how I did the last one hundred or so in the end too. Someone also said shift click works to select everything as well, I tried it but it didn't work for me in Safari.

It's become so clear that users of a SaaS deserve more control how their data is used and stored.

You should absolutely be able to crypto-shred your data from such an important service. This experience sounds awful.

I had migrated away a year or so ago. Tried to log in to confirm, it did not work. Tried password reset. No reset email. So that’s good… I guess.

I remember deleting my acct. not sure if I manually deleted entries before though.

That said - if a data breach includes backup access… is your account ever really deleted?

Something like this might work, open DevTools and do: document.querySelectorAll('[type="checkbox"]').forEach(function(el) {el.checked=true;})

The checkboxes are buttons :)

<button class="itemCheckbox" tabindex="17" aria-label="Select"></button>

Oh dear... looks like the guy that decided to store the URLs in the clear also does the web design

wdym by store the URLs in the clear ?

From the article (emphasis added):

“The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs …”

You need to compare the URLs at least for equality in order to resolve conflicts, which is most straightforwardly done server-side. You could maybe do some sort of content-defined encryption to them, but I’m not sure how useful that would be. So storing the URLs in the clear is unfortunate but not inherently dumb.

(As to how KeePass implementations deal with this problem when on top of a single synced file: they mostly don’t, data loss is not uncommon[1].)

[1] https://www.ctrl.blog/entry/keepass-file-conflicts-android.h...

for (item of document.getElementsByClassName('vault-item-displayname')) { item.click() }

The fact that it ends in `.php` is not inspiring confidence. It's 2022, it's so easy to make pretty URLs.

Cool URIs don't change

A URI ending in .php is not cool (never was), and this advice is most important for content (articles etc.), not necessarily for account management pages.

Which is why you shouldn't include implementation details in your URL.

Obfuscation isn't security etc etc

I wasn't commenting on the security implications. My point was that bleeding implementation details like .php in your URLs is silly because that URL might end up being served by a Node app one day.

But on the security point, a URL ending in .php does imply a "we just YOLO'd a bunch of bare scripts into the webroot" application architecture, which is not confidence inspiring as a user and sure looks attractive to pentest.

BTW, if you're exporting your data, check that it's all there. I had the unpleasant experience of noticing Lastpass either has a buggy implementation or intentionally giving an incomplete export. I ended up needing to manually copy credentials over one by one.

I hate Lastpass so much.

It is a little weird — I vaguely recall that the sort of “diplomatic” answer about password managers has been for a while something like “well, you should use keepass and just keep things local, but if you want to ease of use, lastpass is not too bad.” So that went right out the window I guess.

I mostly use keepass, but for some accounts I don’t really care about I’ve started using the built in Firefox/iOS stuff. Giving that a second thought about now…

open the dev console and use Javascript. Find the input element to check and create a query that sets them all to checked with https://developer.mozilla.org/en-US/docs/Web/API/Document/qu...

I'm not able to delete my account. The modal that opens is empty. I think they've disabled it.

Just deleting the account won't solve the issue anyway.

I am resetting all the passwords for all my accounts. It's super annoying and it will days for me to reset all the passwords. But thankfully I have MFA for all important stuff.

Just type this in the web console for now:

for (item of document.getElementsByClassName('vault-item-displayname')) { item.click() }

Send them a data deletion request. This service makes it easy to do so: https://yourdigitalrights.org/d/lastpass.com