Hacker News Reader

Comment by tyingq | Hacker News Reader

>Must be a compromised browser extension at this point

Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit.

Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility.

Edit #2: Some of the larger js files do have a fair amount of the size as arrays of localized text, error messages, lists of numbers, etc. But it is still a lot of JS.

View on HN

> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript.

For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs, etc.) and the compressed image that contains all of this easily fits in 16MB SPI NOR flash with a few megs to spare.

Does your product have any images or localized text that could balloon the size?

Nope.

So that explains why it’s so small then.

If you measured the proportion of localized text and images in the 25MB of javascript mentioned above, please post these numbers. Otherwise nothing's been explained.

There's 4.3 megabytes of plain text in the KJV bible. Is LastPass' localization longer than the bible?

https://www.gutenberg.org/cache/epub/10/pg10.txt

Wow, how can this amount of files be justified?

And how did this breached exactly happen?

> Wow, how can this amount of files be justified?

File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.

Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".

To be fair, orthogonal just means something that’s at a right angle to another line. I’ve heard people refer to something that is opposite, or an antonym to parallel (or in sync) as orthogonal.

Here it means "perpendicular". A high dependency count is perpendicular to the goal of reducing exposure as much as possible.

Seems like a pretty good metric of complexity to me, particularly when it comes to a security audit. Having a lot of packages packaged up in the extension corresponds to having a lot of source code you have to vet, lest it be an avenue of attack.

"total of 25MB of javascript" is a good metric of the complexity of the application's code, and correspondingly the difficulty of auditing it (I'd say 25 MB of JS code make it infeasible).

25MB of plaintext lines of javascript code is absolutely an indication of the complexity

File count and general "bloat" is an indicator of the quality of the engineering in the product. Especially for a security product _minimalism_ should be evident -- nobody with good security sense would want or allow anything not truly necessary to the product's functionality to be included.

There's a lot of room between "super trivial" and "needlessly complex" -- it shouldn't be either.

Trusting a cloud-based third party with my passwords is a non-starter for me.

I posted the GP, with the sizes, etc. I think they do have a somewhat hard problem to solve though. They probably also want to minimize remote calls so that the extension is functional offline, is more secure, etc. Which would drive the size up, especially with localized errors, etc.

> The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript.

i wonder if any of that is log4j ( :

How could it be log4j if it’s JavaScript and not Java?

Reply on news.ycombinator.com