Hacker News Reader

Thanks for this detailed description!

Is there a way to close the entry point for evil JS? For example, can you tell the extension to stop touching the DOM and injecting any code. That way the username/password can be only interacted with via the browser's chrome button?

View on HN

No practical one. The extension needs full access to the data in order to push it into a page's forms or to update them via the admin UI ("Lastpass Vault").

I believe the Chrome Web Store does check an extension's signing certificate before updates are published, so security wise that's a good thing, but realistically it remains the weakest part of Lastpass's overall design.

Reply on news.ycombinator.com