I worked at LastPass as an engineer. My 2 cents on the situation

Re:I worked at LastPass as an engineer. My 2 cents on the si... by procinct on Sunday December 25, 2022 @12:57PM (#34129398)

Admittedly, I’m not very knowledgeable with this type of stuff, but would they have chosen to do this so that the browser extension can still show the user when a login is available without the user having to authenticate (they then authenticate to get the login details)

[ Parent | on HN ]

Re:I worked at LastPass as an engineer. My 2 cents on the si... by nicce on Sunday December 25, 2022 @02:06PM (#34130070)

This is likely the reason. Other providers like BitWarden caches the urls for certain time on client side. Even if you lock vault, extension can suggest that here is available login for certain period.

[ Parent | on HN ]

Re:I worked at LastPass as an engineer. My 2 cents on the si... by lxgr on Sunday December 25, 2022 @07:16PM (#34133054)

Locally caching this data seems like a much more reasonable way to implement this and would have completely prevented this data leak without any impact to usability.

[ Parent | on HN ]