Hacker News Reader

Comment by UnoriginalGuy | Hacker News Reader

Cannot argue with the results. The whole concept is "impossible" to begin with since even if LastPass hid the content for the development bar (on the LastPass UI) they would eventually still have to submit it to the third party site and you could use the Network tab to grab the raw HTTP request right out of the air.

So I am fine with this weakness. It doesn't impact their core product. This feature is still vaguely useful for less technically literate people, but maybe needs some kind of disclaimer.

View on HN

The sharing feature is legitimate, implying that they can hide it from the sharee is not.

Agreed. On the other hand, I've used it to share passwords with non-geeks, and I wouldn't expect them to be able to retrieve it just with the Chrome inspector. That is the surprising part of the article, at least to me.

I would like to see at least that part fixed, anything else is fine by me at least (if you want their browser to login, the password has to go through the network at some point, so there's really no news here).

Non-geeks probably don't know how to use the chrome inspector, right?

Well, they do if they find instructions to follow to do so to retrieve a LastPass shared password.

I would expect that, no matter how they try to obscure it, it will be retrievable even by non-geeks who find and follow specific instructions to retrieve it.

So I'm not sure how much development effort it's worth to try and obscure it further -- if that's even possible.

LastPass probably ought to be VERY very clear that it's merely slightly obscured, not truly protected, from someone you share it with. Mainly because if someone is confused about this, when they find out it's less protected then they thought, they may begin to doubt LastPass's security in general.

If I were LastPass, I'd reduce the level of obscuring going on, to try to make it even more obvious that a shared password is not protected from the sharee.

IMHO LastPass is clear about it. They say: "Savvy end users could potentially access the password if they capture it using advanced techniques during the login process". I think this sentence conveys the correct meaning to most people reading it (programmers should understand that the feature is not real security just upon seeing it).

I agree that most end-users won't know how to use the inspector, but that's really two clicks on a window of their browser. The blog also goes the complicated way with javascript, but the easiest way (also mentioned) is really really easy: right click on the password, inspect element, click on "properties", scroll down.

Using wireshark or modifying /etc/hosts with a custom html file is surely more complicated.

But what if those non-geeks have other geek friends besides you who are able to retrieve it and have temporary access to their computer?

In that case, it's just like if the feature didn't exist.

I think it's pretty clear that the feature is just obscurity and works only in simple cases. It was pretty clear for me at least from the moment I saw it, and it's clearly written and explained.

Does it make it useless? I don't think so. I'd rather LastPass keep it the way it is (maybe closing down the most simple way to retrieve it, like the inspector) rather than removing it altogether just because it can't be a real security feature.

You could probably proxy the login form via the lastpass server which would insert the correct password and perform the login before passing back the logged in state to the browser.

Perhaps there could be issues because of the origin domain of the cookie though.

We are also using lastpass at it is simply comfortable for sharing accounts. I fully agree that there will always be a way to sniff the details if you are using such a centralized password manager for web-login.

Reply on news.ycombinator.com