Millions of people count on password managers to safeguard their accounts and help them keep track of their passwords. By serving as a sort of master-key for their accounts, password managers can encourage good digital hygiene, such as using long, complex and unique passwords.
But a major vulnerability in one of the most popular password managers, LastPass, shows how even the tactics users hope will protect them online can still leave them vulnerable - and how just hard it is to keep up with what technology to trust.
Tavis Ormandy, a member of a Google team that hunts for unknown software bugs, discovered the LastPass problem Tuesday - calling it a "complete remote compromise." A distant attacker could potentially take over users' LastPass accounts and gain access to their troves of passwords - at least, if they visited a website designed to exploit the vulnerability while using the LastPass browser extension with Firefox, according to a blog post from LastPass.
LastPass pushed out an update Wednesday fixing the problem. At the same time, it also acknowledged an issue that similarly exposed user passwords and was disclosed to LastPass by security researcher Mathias Karlsson last year.
The company fixed the problem Karlsson discovered back when he told them about it, but it wasn't made public until Wednesday when Karlsson published a blog post explaining the bug. Industry best practice is for researchers to wait until after problems have been fixed to talk about them, but companies don't always publicly announce when they've made major fixes.
This isn't the first time password managers have had security problems. Back in 2014, researchers uncovered security problems in LastPass and four other password managers. Just last year, researchers were able to sneak a malicious program into the Apple App Store that could steal passwords from iOS and OSX's built-in Keychain password management tool, as well as from popular password manager 1Password.
Earlier this week, a government agency also waved developers away from another common account security strategy: Using SMS text messages to deliver two-factor authentication codes. Two-factor authentication is one of the best, basic steps people can take to secure their accounts - it works by having a user verify their identity by using another method beyond a password, most often by entering a unique code sent to them via text message.
But new draft guidance from the National Institute of Standards and Technology argues using SMS texts for two-factor authentication shouldn't be considered secure because the number associated with an account might change hands or the code might be intercepted if sent to a number registered through an online service, including Skype or Google Voice. Instead, the guidance suggests alternatives such as using secure apps for two-factor authentication, a method already offered through Google and some other services.
Both the LastPass issues and the government's concerns about SMS texts for two-factor authentication show why it's so hard for people to stay on top of their online security: Best practices are always changing, and what was once considered the gold standard can quickly become obsolete.
The Washington Post
Fri Jul 29 2016
A distant attacker could potentially take over users' LastPass accounts and gain access to their troves of passwords
Allahyarham Tun Hanif Omar legenda PDRM - Razarudin
Tan Sri Razarudin Hussein menyifatkan Allahyarham Tun Mohammed Hanif Omar sebagai legenda besar dalam bidang kepolisan negara.
Tun Hanif Omar dikebumi di Makam Pahlawan
Jenazah Allahyarham akan dimandikan dan disembahyangkan di Masjid Negara terlebih dahulu.
'Ayah letak tugas, kerjaya nombor satu' - Anak Tun Hanif
Allahyarham Tun Mohammed Hanif Omar meletakkan kerjaya yang melibatkan keselamatan rakyat serta negara sebagai perkara paling utama ketika hayatnya.
KPN ucap takziah kepada keluarga Tun Hanif Omar
Razarudin mewakili keluarga Sang Saka Biru mengucapkan takziah kepada keluarga bekas KPN Tun Mohammed Hanif Omar.
Sofia Jane raih anugerah Pelakon Wanita Terbaik di Festival Filem Asia ke-21
Secara keseluruhan naskhah arahan Badrul Hisham Ismail itu juga berjaya merangkul Anugerah Most Original Film.
Mesir, rakan usaha dapatkan gencatan senjata di Gaza
Mesir sedang berusaha mendapatkan satu gencatan senjata di Semenanjung Gaza dengan sokongan Amerika Syarikat (AS) dan Qatar, kata Menteri Luar Mesir, Sameh Shoukry pada Jumaat.
MediaTek lancar cip Dimensity 6300 dengan teknologi 6nm
Ia dihasilkan dengan teknologi 6nm TSMC dengan konfigurasi dua teras Cortex-A76 sehingga 2.4GHz dan enam teras Cortex A55 sehingga 2.0GHz.
Filem Sheriff pamer sisi berbeza Kamal Affandi sebagai pegawai polis
Filem Sheriff menemui penonton di pawagam mulai 18 April.
Bursa Malaysia dijangka mengalami keadaan tidak banyak berubah minggu depan
FBM KLCI dijangka turun naik dalam julat 1,528 hingga 1,560 minggu depan, dengan sokongan serta-merta pada 1,520, diikuti oleh 1,508.
Noktah kemiskinan tegar, isu kewarganegaraan dibincang bersama MPN PKR Sabah
Anwar yang juga Presiden PKR berkata MPN PKR Sabah telah mengutarakan kepentingan memesatkan usaha menoktahkan kemiskinan tegar di Sabah.
#GempakSpot: Instagram removes 'Following' tab
Now you no longer have to get into petty fights with your significant other.
Sekat berita palsu, mesej WhatsApp hanya boleh di'forward' kepada 5 individu
Hal ini demikian bagi mengelak maklumat yang salah dan khabar angin tersebar secara berleluasa.
Beli-belah guna Ringgit Malaysia di aplikasi Amazon
Syarikat Amazon melancarkan ciri terbaru dalam aplikasi untuk pengguna membeli-belah sebanyak 45 juta barangan yang boleh dihantar ke satu dunia dihantar ke seluruh dunia melalui peranti mudah alih.
Aplikasi baharu AirAsia jamin pengalaman penerbangan lebih selesa
Penumpang AirAsia kini boleh menikmati pengalaman penerbangan yang lebih lancar dengan aplikasi mudah alih terbaru AirAsia.