Security News LastPass working on security update for newly discovered vulnerability

[BoraMurdar]

Following the security vulnerability discovered on 22. March,
LastPass Chrome & Firefox Extensions Affected by Critical Bug (Patched)

Following this announcement, the firm acknowledged the vulnerability on Twitter, stating they were aware of what had been reported, and that the team "has put a workaround in place while we work on a resolution". As of 2:49 PM Eastern time US on March 22, extensions for Firefox and Chrome had been released containing the fix, with Opera and Edge add-ons still pending approval. LastPass released a full report on its blog. That, however, was not all.

On March 25, Tavis discovered yet another vulnerability, affecting version 4.1.43, the latest for Google Chrome.

To expand on the issue, LastPass also put up a post today, in which they made it clear that a fix is being worked on. The client side vulnerability discovered over the weekend allows for an attack that is "unique and highly sophisticated". As such, the firm declined to disclose anything specific about either the vulnerability or the patch, until everything is said and done. The reasoning given is that doing so could "reveal anything to less sophisticated but nefarious parties", which is of course not the intention.

As a precaution, until everything is sorted, LastPass recommends you launch sites directly from the vault (to protect your sign-in credentials), use two-factor authentication on every service that offers it, and to stay vigilant to avoid phishing attempts.

Source: LastPass Blog

 

[Ink]

Let's not decide on switching password managers.

Spoiler

Unless you're one of these people;

 

[BoraMurdar]

Let's not decide on switching password managers.

Spoiler

Unless you're one of these people;

Ah...those hard decisions

Spoiler

 

[Kalimirro]

Doing so would allow the attacker to potentially retrieve and expose information from the LastPass account, such as user’s login credentials.

Aw! Get the master password = big fish.

 

[WinXPert]

Let's not decide on switching password managers.

Spoiler

Unless you're one of these people;

Okay, I'll still use password hasher and will not switch to lastpass

 

[_CyberGhosT_]

I use LastPass and am staying right here

 

[509322]

Let's not decide on switching password managers.

Spoiler

Unless you're one of these people;

This is the all-time best post on any security forum... ever

 

[Rodney74]

Tried last pass, and dashlane, then I tried Sticky Password (It's free)..

OMG what a pleasure to use such a nice Password Manager, and auto form filler.

Lastpass was the most difficult, for example saving and deleting passwords.

Dashlane was easy, but filled some forms incorrectly.

Sticky, was the best of all...Very nice especially for free, paid product available in order to sync devices.

 

[ForgottenSeer 55474]

I am also using LastPass and that's it