Blog post about the sploit here from the authors: https://news.ycombinator.com/item?id=10217551
That seems a rather important detail. Thanks for the link.
> That seems a rather important detail.
It's also against LastPass's best practices. When you click that button (Remember my password) you get this:
"Are you sure you want to have LastPass remember your password? This will significantly decrease the security of your LastPass account!"
If an attacker is already physically in my office then I've got bigger problems.
I'm using Linux and my /home directory is encrypted. My laptop automatically logs out after a pretty short inactivity (2 minutes, unless I'm using certain apps like VLC in which case, it logs out after half an hour) essentially locking the access to my /home directory.
With that being said, having to type in my master password over and over again seems like a bit of an overkill.
I have a long master passphrase - too long to type on a touchscreen keyboard in any convenient amount of time and where there's a non-trivial risk that somebody peering over my shoulder (think - using it on the bus) could spy it. So in that case I resort to using the fingerprint-unlock feature (which I assume is the security equivalent of 'save master passphrase' or at least token).
I am aware that this might open me up to other attacks - an adversary dusting my fingerprints off my tablet, etc. Curious though as to whether this is an attack vector for the same or a similar type of process to what the authors are describing (haven't read their blog post, just the Black Hat description).
So at the very least you still have your passwords kept in a relatively secure keychain manager and not inside the app stored in plain text of some sort.
http://jolt.law.harvard.edu/digest/telecommunications/court-...
(Fwiw - I use LP, no master password saved, no iOS finger print access)
The rationale I use personally is that the master password might be stored in a retrievable format on my phone, but the phone itself is encrypted (iOS 8). And the convenience factor is strong enough (it's really convenient!) that I'm not discouraged from using strong passwords like I otherwise might be.
Unless someone sneakily borrows my phone and fingers while I'm sleeping, I don't think I'm at much risk.
It could, however, mean that your master password is in a cleartext or Apple-recoverable iTunes (local) or iCloud backup of your phone.
This was also somewhat reassuring:
"As always, we made a responsible disclosure to LastPass. I want to stress how easy it was to work with the security team. The where very responsive and worked on fixing the issues we reported immediately. They also followed up with us from time to time and asked for our thoughts on every fix. It was a real pleasure to work with team!"