<story><title>Phishing attack against Lastpass</title><url>https://www.seancassidy.me/lostpass.html</url></story><parent_chain></parent_chain><comment><author>pwman</author><text>LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012:  &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;code.google.com&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=39511&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;code.google.com&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=39511&lt;/a&gt;&lt;p&gt;We do a lot to try to protect our usage of viewports using iframes, but it&amp;#x27;s not good enough and we&amp;#x27;ll figure out a way to do better.  LastPass has generally told people to use the extension directly to login as it&amp;#x27;s more secure, we&amp;#x27;ll need to go further here as well.&lt;p&gt;Sean was clever using &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;chrome-extension.pw&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;chrome-extension.pw&lt;/a&gt; which looks close -- but LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake, mitigating this a great deal.  This has existed for a long time before Sean&amp;#x27;s report and we did not implement as a response to Sean&amp;#x27;s bug report -- we implemented it as a general way for people to know about password resuse and to be notified of being phished.&lt;p&gt;Making this practical is a lot tougher than email phishing -- you really need an XSS on a page that people use to login, and unlike email phishing it is immediately caught.</text></comment>
<story><title>Phishing attack against Lastpass</title><url>https://www.seancassidy.me/lostpass.html</url></story><parent_chain></parent_chain><comment><author>jnevill</author><text>This is of the devil. It needs to be burned with fire and the ashes should be sunk in the Mariana trench and the trench should be filled with dirt that has been cursed by a witch that was formerly dead but was reanimated by Cthulhu and then rekilled, burned with fire, and buried on the opposite side of the earth.&lt;p&gt;Everything here is usual phishing stuff, but that Chrome-Extension.pw url is disturbing combined with the lastpass API stuff.</text></comment>