Seven embedded trackers in the LastPass Android app (The Register)

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,505
A security researcher has recommended against using the LastPass password manager Android app after noting seven embedded trackers. The software's maker says users can opt out if they want.

German infosec bod Mike Kuketz spotted LastPass's trackers in analysis produced by Exodus, which describes itself as "a non-profit organization led by hacktivists [whose] purpose is to help people get a better understanding of the Android applications tracking issues."

The Exodus report on LastPass shows seven trackers in the Android app, including four from Google for the purpose of analytics and crash reporting, as well as others from AppsFlyer, MixPanel, and Segment. Segment, for instance, gathers data for marketing teams, and claims to offer a "single view of the customer", profiling users and connecting their activity across different platforms, presumably for tailored adverts.

LastPass has many free users – is it a problem if its owner seeks to monetise them in some way? Kuketz said it is. Typically, the way trackers like this work is that the developer compiles code from the tracking provider into their application. The gathered information can be used to build up a profile of the user's interests from their activities, and target them with ads.

Even the app developers do not know what data is collected and transmitted to the third-party providers, said Kuketz, and the integration of proprietary code could introduce security risks and unexpected behaviour, as well as being a privacy risk. These things do not belong in password managers, which are security-critical, he said.

Kuketz also investigated what data is transmitted by inspecting the network traffic. He found that this included details about the device being used, the mobile operator, the type of LastPass account, the Google Advertising ID (which can connect data about the user across different apps). During use, the data also shows when new passwords are created and what type they are. Kuketz did not suggest that actual passwords or usernames are transmitted, but did note the absence of any opt-out dialogs, or information for the user about the data being sent to third parties. In his view, the presence of the trackers demonstrates a suboptimal attitude to security. Kuketz recommended changing to a different password manager, such as the open-source KeePass.

Do all password apps contain such trackers? Not according to Exodus. 1Password has none. KeePass has none. The open-source Bitwarden has two for Google Firebase analytics and Microsoft Visual Studio crash reporting. Dashlane has four. LastPass does appear to have more than its rivals. And yes, lots of smartphone apps have trackers: today, we're talking about LastPass.
A LastPass spokesperson told us: "No sensitive personally identifiable user data or vault activity could be passed through these trackers. These trackers collect limited aggregated statistical data about how you use LastPass which is used to help us improve and optimize the product.

"All LastPass users, regardless of browser or device, are given the option to opt-out of these analytics in their LastPass Privacy Settings, located in their account here: Account Settings > Show Advanced Settings > Privacy. We are continuously reviewing our existing processes and working to make them better to comply, and exceed, the requirements of current applicable data protection standards."
 

enaph

Level 28
Verified
Honorary Member
Top Poster
Well-known
Jun 14, 2011
1,787
Even the app developers do not know what data is collected and transmitted to the third-party providers, said Kuketz
That's just great.
Good thing is that there are a lot of alternatives so people are not really forced to use this crap.
First their not well performed stunt with free version limitations and now this. Looks like it's going to be a tough year for LastPass.
 

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,505
This is the worst i ever heard.
Let's hope people get this message.
There are good alternatives available:
Do all password apps contain such trackers? Not according to Exodus. 1Password has none. KeePass has none. The open-source Bitwarden has two for Google Firebase analytics and Microsoft Visual Studio crash reporting. Dashlane has four. LastPass does appear to have more than its rivals. And yes, lots of smartphone apps have trackers: today, we're talking about LastPass.
 

Ink

Administrator
Verified
Staff Member
Well-known
Jan 8, 2011
22,361
The warning signs were there, but we ignored it.

1. 2015 - LastPass acquired by LogMeIn.
2. 2019 - LogMeIn acquired by Private Equity Firms.

Moving on, we can switch to better services.
 

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,505
@bitwarden
are you going to allow to disable the two trackers? I need to know before i renew

of course. btw we use firebase for syncing devices (not analytics/tracking) and crash reports to support a wide range of mobile devices. both are absent from our f-droid version if desired https://github.com/bitwarden/mobile

Limitations​

Since the Bitwarden F-Droid build does not include Firebase Messaging, push notifications for live sync updates of your vault will not work. Manual vault syncing is required.
 

SumTingWong

Level 28
Verified
Top Poster
Well-known
Apr 2, 2018
1,706
This is the worst i ever heard.
Let's hope people get this message.
Them developers are lying like I can smell it through my computer monitor with my eyes closed. What chu mean they don't know who and what third party they signed and allowed data to be transmitted. It is funny now that you have given your important account username and password to stored in this "Secure password stored app" and now data got transmitted to some third party that the app developers "don't know" anything about it.

Time to switch write down your account information onto your notebook. No one knows it beside you, God, and ghost.
 

Divine_Barakah

Level 29
Verified
Top Poster
Well-known
May 10, 2019
1,854
Our Windows version does not use Firebase and offers an opt-out from our internal system. We use Firebase to track crashes on iOS and Android. We’re looking at discontinuing its use even on these platforms.
Sticky Password response. According to , Sticky Password uses two trackers.
938C45C3-298C-4445-B1AF-02CEA3F104FB.png
 

SpiderWeb

Level 10
Verified
Well-known
Aug 21, 2020
468
It's only a matter of weeks now before Google bans LastPass app and extension for being malicious. It's always the same story.

Some shady company buys a smaller company with a great reputation and promises not to change anything. Then they add their malware. App gets banned.
 

Divine_Barakah

Level 29
Verified
Top Poster
Well-known
May 10, 2019
1,854
It's only a matter of weeks now before Google bans LastPass app and extension for being malicious. It's always the same story.

Some shady company buys a smaller company with a great reputation and promises not to change anything. Then they add their malware. App gets banned.
Well, Dashlane is no different and it was banned by Google before. Dashlane extension is not available on Mozilla store and it needs to be installed directly from Dashlane website. Lastpass and Dashlane are on my blacklist now.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top