A Password-Exposing Bug Was Purged From LastPass

Developers of the LastPass password manager have patched a vulnerability that made it possible for websites to steal credentials for the last account the user logged into using the Chrome or Opera extension. He also described three other weaknesses he found in the extensions, including: the handle_hotkey didn't check for trusted events, allowing sites to generate arbitrary hotkey events; a bug that allowed attackers to disable several security checks by putting the string "https://login.streetscape.com" in code; a routine called LP_iscrossdomainok that could bypass other security checks. "To exploit this bug, a series of actions would need to be taken by a LastPass user including filling a password with the LastPass icon, then visiting a compromised or malicious site and finally being tricked into clicking on the page several times," LastPass representative Ferenc Kun wrote. On the whole, I still recommend most people use password managers unless they devise another technique to generate and store strong passwords that are unique to every account.