<story><title>LastPass autofill exploit</title><url>https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/</url></story><parent_chain><item><author>Alpacalex</author><text>If you&amp;#x27;re using a *nix system: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.passwordstore.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.passwordstore.org&amp;#x2F;&lt;/a&gt; I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)</text></item><item><author>SaturateDK</author><text>I want an alternative, got a good one?</text></item><item><author>crdoconnor</author><text>Exactly this. I&amp;#x27;m abandoning them now.</text></item><item><author>y04nn</author><text>The fact that LastPass consider that a flaw in their system that could have put them on their knees is only worth 1K is quite frightening if you are relying on them for your security.</text></item><item><author>mcs</author><text>Please correct me if I am mistaken, but couldn&amp;#x27;t this have been implemented into an iframe that when ran could send the passwords to another remote server?&lt;p&gt;If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via short-url redirect interstitial pages, or an ad network&amp;#x27;s javascript, etc. Given the potential damage, I&amp;#x27;d say there is a missing zero or two on that reward amount, in my opinion.</text></item></parent_chain><comment><author>veeti</author><text>Does this still have the problem of leaking metadata (site names, etc.) in plain text? I don&amp;#x27;t want to manually obfuscate them.</text></comment>
<story><title>LastPass autofill exploit</title><url>https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/</url></story><parent_chain><item><author>Alpacalex</author><text>If you&amp;#x27;re using a *nix system: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.passwordstore.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.passwordstore.org&amp;#x2F;&lt;/a&gt; I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)</text></item><item><author>SaturateDK</author><text>I want an alternative, got a good one?</text></item><item><author>crdoconnor</author><text>Exactly this. I&amp;#x27;m abandoning them now.</text></item><item><author>y04nn</author><text>The fact that LastPass consider that a flaw in their system that could have put them on their knees is only worth 1K is quite frightening if you are relying on them for your security.</text></item><item><author>mcs</author><text>Please correct me if I am mistaken, but couldn&amp;#x27;t this have been implemented into an iframe that when ran could send the passwords to another remote server?&lt;p&gt;If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via short-url redirect interstitial pages, or an ad network&amp;#x27;s javascript, etc. Given the potential damage, I&amp;#x27;d say there is a missing zero or two on that reward amount, in my opinion.</text></item></parent_chain><comment><author>oslavonik</author><text>I&amp;#x27;ve been amazed by Pass, but couldn&amp;#x27;t find a thorough review between Pass and KeePass(x). Is one safer than the other?</text></comment>