LastPass puts vulnerable in scare quotes.
But to my understanding, with this bug session information to the website could have leaked, and they don't seem to address this. Could an attacker have hijacked logins?
But to my understanding, with this bug session information to the website could have leaked, and they don't seem to address this. Could an attacker have hijacked logins?
"However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."
It still means people could have hijacked your session, which is what GP was referring to.
I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
It would appear the session info would be compromised, but the login credentials would be protected.
Deleted comment
This tweet shows someone getting credentials from Yahoo Mail: https://twitter.com/markloman/status/453502888447586304
I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?