Martin Vigo

Here's a fun one: https://www.martinvigo.com/email2phonenumber/ The more places you use the same email address, the greater your exposure.

I disagree that they've had a good track record. https://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-… https://twitter.com/tqbf/status/836619941805764609 https://twitter.com/taviso/status/843965519371812864 I've seen very few security researchers recommend it, while they will recommend other services.

It's probably worth noting, this exploit requires the user to save their master password locally. While it's not obvious from the blackhat blurb, it's stated by the author in their more detailed blog post [1] Additionally, this behavior is something that LastPass advises against: "Are you sure you want to have LastPass remember your password? This will significantly decrease the security of your LastPass account!" [1] http://www.martinvigo.com/a-look-into-lastpass/

I don't understand why so many password managers go through so much trouble to implement auto-fill. This one has an interesting approach that seems to be slightly less intrusive than what, say, Lastpass is doing but I still don't really see the value outweighing the cost. Yes, auto-fill - if implemented well - can add some convenience for the user but it usually adds a significant amount of complexity to the codebase and comes with some challenges regarding security. In fact, LastPass' autofill feature is/was the root cause of some very scary vulnerabilities[1]. Copy&paste is simple, broadly understood and supported in much the same way on every single platform. And in my experience, it's really not that much slower than auto-fill. It seems to me that most password managers these days are to tick off a list of features rather than focussing on security and usability. Mind you, Secret 2 is definitely not the best example for this - I actually quite like the clean look and simple user interface. Still, it seems like most people nowadays are judging the value of a password manager by the number of features rather than, say, security. <shameless-plug>Padlock[2] is a minimalist, open source password manager without auto-fill, browser-integration or any other 'advanced' features. We believe that when it comes to features, less is often more, and it seems there is plenty of people agree with…

2019: LastPass leaks credentials from previous site. https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 2017: Design flaws in LastPass two factor authentication. http://www.martinvigo.com/design-flaws-lastpass-2fa-implementation/ 2016: More LastPass security vulnerabilities. https://palant.de/2016/09/16/more-last-pass-security-vulnerabilities 2015: Even the LastPass will be stolen. http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-i…

The problem I tend to think of is that they store the urls in the clear, so an attacker (who can bypass SSL) will potentially be able see which sites you have passwords saved for. There's a writeup that mentions it here: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-i…

I've read multiple independent audits of the LastPass client (such as http://www.martinvigo.com/a-look-into-lastpass/) that haven't found any major issues, and for the issues they do find the LastPass team has always responded promptly. On the server side, LastPass's service is basically just encrypted blob synchronization, so the software doesn't particularly matter.

>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a software engineer who wasn't a security researcher found a bug[4], which again, gives all your passwords. 4. The bug in (3) wasn't fixed properly, which lead to this [5] Other bugs, but not as terrible as the ones I listed above Jul 27 2016 [6] Mar 25 2017 [7] Jun 17, 2015 [8] Nov 17, 2015 [9] You are also forgetting a whole another class of attacks - Phishing [10] [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1209 [2]: https://news.ycombinator.com/item?id=13924737 [3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1217 [4]: https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-… [5]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&des… [6]: https://bugs.chromium.org/p/project-zero/issues/detail?id=884 [7]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&des… [8]: http://www.businessinsider.com/security-expert-describes-lastpass-vuln… [9]:…