Password Manager Discussion.

Pretty good return time on an answer.

You're running this in Windows?

 

Yes, good turn around. W8.1 + FF43.0.4x64

 

Has anybody tried masterpasswordapp?

http://masterpasswordapp.com/

 

LOL, it's using Java for the desktop, no thanks.

 

Bad news about Keepass.

http://www.engadget.com/2016/06/04/keepass-wont-fix-security-hole-due-to-ads/

 

Thanks dogbite, interesting, i am on Keepass 1.x but it may have the same issue i think.

Rules.

 

I never let apps autoupdate. This is not the first, nor the last case.

http://news.softpedia.com/news/asus...s-over-http-with-no-verification-504880.shtml
http://news.softpedia.com/news/leno...rator-app-amid-security-concerns-504810.shtml

 

KeePass doesn´t autoupdate.
http://keepass.info/help/kb/sec_issues.html#updsig

 

Thanks

 

Looks like LastPass has some issues.

 

EC to audit Apache HTTP Server and Keepass
https://joinup.ec.europa.eu/node/153614

 

Can you say more about what the issues are?

 

http://www.theregister.co.uk/2016/0..._millions_of_lastpass_users_who_visit_a_site/

 

What now?

My master pass on lastPass is really strong, but...

Just now I added multi authentification by means of Authenticator.

Exported and imported my accounts to :
https://keepersecurity.com/en_GB/user-guides/guide-browser-extensions.html

Am I missing an important element here?

 

LastPass details the problem and fix: https://blog.lastpass.com/2016/07/lastpass-security-updates.html/
This is limited to lastpass add-on for Firefox.

 

Already addressed by lastpass one year ago... Read the link in my previous post

EDIT: Ooops, I see that AutoCascade post is gone now....

 

Thanks!

 

I didn't realize the 2nd report was a year ago. The author didn't share that part unfortunately.

The report by Taviso though was just a day or so ago and LastPass responded quickly but it also doesn't mean he's done finding holes in it.

 

This is a good example of how responsible disclosure should work. By the time you hear about the vulnerability, the issue is already fixed by the vendor. So kudos to Ormandy and the LastPass team.

 

+1

 

LastPass bug report details: https://bugs.chromium.org/p/project-zero/issues/detail?id=884

 

Potentially some 1Password vulns to come next?
Link: https://twitter.com/taviso/status/760231214812844032

 

This is another eye opener, it's probably best not to use any extensions for password managing.

 

The LastPass extension has already been updated to address the issue.