Hacker News Reader

Comment by craftyguy | Hacker News Reader

> What makes LastPass inferior to these other options?

Well, for one, the very first sentence of the article here.

The article whose "exploit" requires handing your unlocked phone to someone?

> (Edit #1, 7.30pm GMT): A lot of people are saying that this flaw requires physical access. However, as I pointed out above, you don’t need physical access, a maliciously installed application can easily access the activity and capture the code.)

So you don't need physical access you just need to install a malicious application? Okay then.

Why can one application even explore and access the views of another?

Accessibility APIs

You'd be surprised how many people (not on HN) use extremely weak (or no) unlocking mechanisms for their devices. It overlaps with the set of folks who would want to use LastPass because of how easy it is.

Do you know what is easier than using last pass for people who use weak unlocking mechanisms? Using the same password everywhere.

I'd be surprised if there was any overlap at all where you claim.

Well, I have several family members that fall in the "I use a pattern to unlock my phone or do not use anything to lock it, but store passwords in Last Pass" category. So I guess you're wrong.

And which just got revealed,and will probably be fixed.

The article that is literally not about Lastpass's password manager?

Lastpass Authenticator is not their password manager. It is a Google Authenticator competitor...

If they have a history of shitty security practices (this app), then why should we fully trust other apps they make?

You're going to double down on completely misreading the article and misquoting as to why their Password Manager is insecure? Come on...

Here, since you can't be bothered to do your own research before jumping to conclusions:

https://www.theverge.com/2017/3/22/15023062/lastpass-securit...

https://www.pcworld.com/article/2936621/the-lastpass-securit...

https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...

None of which has anything to do with this thread, your claims, or your erroneous claim that the article was about their password manager. Keep doubling down...

Reply on news.ycombinator.com