Hacker News Reader

Could someone explain me better the posted code that was vulnerable? I don't understand it. What's the returned value?, what is URL and url?, why the extension is expecting there must be a @ inside the url?

Thanks! :-)

View on HN

Very simply, I have a password stored for "login.example.com". LastPass knows that companies like to change URLs - so next week it might be "userlogin.example.com" or "secure.example.com/login" or "www2.uk.vpn1.example.com" etc.

Essentially, LastPass made the mistake of writing code which said "If you see `example.com` anywhere in the URL - assume that you're on the right site.

LastPass will allow you to automatically fill in the username and password as soon as you visit a site (I think this is an optional feature).

An attacker convinces you to visit "badsite.wtf/@example.com/". LastPass sees the "example.com" and autofills the password field. The site has some JavaScript to detect the filled in details - and steals them.

Ok, when is ever used a @ in the middle of url? I've never seen it.

Also, what's the return value of the funcion?, and why are there 2 variable named URL?

http://user:password@example.com is valid syntax to supply u/p. Also, I suspect uri is first used up above in code we're not shown.

Reply on news.ycombinator.com