Hacker News Reader

Comment by banachtarski | Hacker News Reader

Now I'm confused. It says it in the title? Where might the confusion stem from?

If people don't know that LastPass has a 2FA app, they might think LastPass Authenticator is the password manager app, and is affected by this bug. As a matter of fact, a number of commenters seem to think exactly that.

Right but I guess to me "password management" and "authentication" are two entirely separate concepts (i.e. authorization vs authentication being separate English words).

I can authorize someone to do something. I authenticate that a person is who he or she claims to be.

The combo username password authenticate the person as much as it authorize them to access the service.

Different meaning but connected nonetheless.

It only says it in the title if you're already familiar with Lastpass's apps offerings.

I happen to be familiar so I can read "LastPass Authenticator app" and know it is referring to their 2F/Google Authenticator competitor. But in the general sense Lastpass "Authenticator" could be the name of their password manager for all people know.

It could be titled e.g. "Lastpass's two factor authenticator app is insecure." Still accurate but also less vague for people unfamiliar with Lastpass's different apps.

Most people will only use the password manager app. I didn't realise they make a different authenticator app and assumed that this was about the password manager.

Reply on news.ycombinator.com