Hacker News Reader

Comment by jogjayr | Hacker News Reader

Stupid question: why can't LastPass encrypt the URL as well and decrypt client-side to show the logo, like they do (as I understand it) with passwords?

View on HN

The client still needs to fetch the logos from somewhere so it has to upload a list of URLs to get the logos for. They've just opted to do it when saving a password entry.

It probably wouldn't be infeasible to send the client all the logos they have. The client could then pick them out with no server interaction. There's only going to be thousands of them, tops, and probably only hundreds. Hooray powerlaw.

This might be modestly annoyingly resource intensive for mobile, probably not an issue for desktops.

that seems a better solution, but lastpass would still know that user_x is downloading the google.com logo.

How? The logo image request goes to google.com then, and not Lastpass, right?

I am assuming lastpass have the logos on their domain. if the request goes to google.com then its fine as long as the referer isn't sent.

They can, I don't see why they chose the current implementation over this one, somehow this small leak can let them build a database of browsing habits and target users who use x website...hmmm

They can, probably an oversight. Hopefully once this article makes the rounds they'll reconsider.

an even better solution is who gives a shit about the logos, this a security product.

Reply on news.ycombinator.com