Hacker News Reader

Comment by eknkc | Hacker News Reader

Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain.

1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find useful.

View on HN

I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.

What's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.

1Password's browser extension v4, in contrast, fills in the form only when you press a key combination (⌘-\ on OSX), and has you enter your master password into a dropdown from the OSX Menu Bar, and not inside the browser frame. Pretty snazzy all around.

Aha, I see the distinction now. Thanks. Enough to simply disable autofill in LastPass then? I'm loathe to learn a new system because of such a seemingly small size vulnerability.

LastPass has me enter the master password in a pop up window when I click on the icon from the extension (firefox/chrome), although I suppose that's maybe not as good as an independent application?

Exactly.

I can, not only disable autofill in the Lastpass configuration, but also set to require password reprompt for any of my credentials. I could also individually disable autofill for any credential.

Please should first know how something works before criticizing.

Just because there's no autofill doesn't mean you don't have a password manager.

[Disclosure: I work for AgileBits, the makers of 1Password]

In 1Password 4, there is no auto-filling. People can use Ctrl-\ or Cmd-\ to tell 1Password to "fill this page". In versions prior to 4, auto-fill was an option. (I'm not sure which versions had what defaults.)

Oh I know. I use 1Password. I forgot to mention that your solution works better but I believe blazingice mentioned it above.

Everybody needs a few critical passwords that they should memorize and not use shortcuts with. My email and Paypal passwords are very strong; to break them you have to either keylog/shouldersurf/whatever, or else brute force an attack for quite a few characters. Nor will you find joy with alternate ways of getting in, such as security questions. If I used a password manager, its password would be another critical one, but even so I probably wouldn't use it for accessing my other crucial accounts.

A lot of my other accounts can be more easily hacked, but relatively little harm would be done if they were. I think one of my MMO accounts -- to a game I no longer play -- actually was.

Are you saying that yahoo web mail lets senders create forms with submit actions? That's.. Horribly broken.

But tumbler allows JavaScript redirects to phishing sites, so yahoo standard I guess.

HTML email is an abomination, but...

If a form doesn't have a submit action, what's the point of the form?

If you have HTML and CSS, why not have forms?

Gmail does this too.. It intercepts the action though, lets you choose if you really want to send.

Not sure it would be that easy. LastPass only auto fills known domains, so you would have to spoof that too.

Hence why they said:

"send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain."

Then you disable autofill. Problem solved.

True....but now if I suggest LastPass to anyone I have to remember to opt-out of this feature.

I am actually a LP user, but I would prefer it was more secure by default.

With LP, auto-fill is an opt-in, per-domain feature.

Wouldn't Yahoo be exactly the type of site that you would opt-in to autofill for?

Why not disable auto-fill and auto-submit in your global preference?

Reply on news.ycombinator.com