EvaDec 24, 2022
Pour one out for all of the security practitioners who are going to have to spend the holidays patiently explaining that using a password manager is still good, actually, to people who have glanced at a headline about the latest LastPass breach.
Show threadDavid Short 🇪🇺 🇵🇸 🏳️‍🌈Dec 24, 2022
@evacide I have always wondered about this. Given that the password manager has to send all your passwords to the browser in plain text, why not use the built-in password storing function of the browser? This would seem to reduce the attack surface?
Show threadTroed SångbergDec 24, 2022
@dwasmkuk @evacide But they don't, or am I misunderstanding you? The password manager "sends" the passwords encrypted to your browser and they're then decrypted when you view or fill the forms.
Show threadDavid Short 🇪🇺 🇵🇸 🏳️‍🌈Dec 25, 2022
@troed @evacide that begs the question about the key used to encrypt the manager/browser comms. If the browser knows the key and is compromised, an attacker would have that key. Unless modern browsers have a dedicated API that allows pass through of encrypted passwords directly to the remote service?
Show threadTroed Sångberg

@dwasmkuk The browser does not know the key - the user has to input it after a reboot / regularly etc. The strength of that user-known master password is what protects the (now leaked) vaults.

(I'm a LastPass user, with a very strong master password. I haven't done any mitigation, yet)

Dec 25, 2022 at 9:14amWeb
Show threadDavid Short 🇪🇺 🇵🇸 🏳️‍🌈Dec 25, 2022
@troed do you enter the key/master password into the browser or into Lastpass?
Show threadTroed SångbergDec 25, 2022
@dwasmkuk LastPass plugin or LastPass binary installation on the platform. Your question was whether the browser _knows_ the master password (as it does when using a browser keystore) which it doesn't.
Show threadDavid Short 🇪🇺 🇵🇸 🏳️‍🌈Dec 25, 2022
@troed how are the individual passwords passed over the plugin/browser interface? In plain text?