Hacker News Reader

Comment by viraptor | Hacker News Reader

It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696

(to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")

View on HN

It seems that you didn't see: https://twitter.com/taviso/status/758143119409885185

  Full report sent to LastPass, they're working on it now. Yes,
  it's a complete remote compromise. Yes, I promise I'll look at
  1Password.

I did see it. Not sure what you mean by this.

Did you see the reply from a 'former Lastpass engineer'?

> @taviso Are you looking at their binary? (I'm a former lastpass engineer)

> @ejcx_ Yes.

> @taviso Ahhh. I never touched it. Very neglected. There's a lot of stuff between message passing between extension and binary that is scary

https://twitter.com/ejcx_/status/758080992724738048

Lastpass have fixed it - search for Tavis in https://blog.lastpass.com/2016/07/lastpass-security-updates....

https://bugs.chromium.org/p/project-zero/issues/detail?id=88...

Reply on news.ycombinator.com