Millions of people count on password managers to safeguard their accounts and help them keep track of their passwords. By serving as a sort of master-key for their accounts, password managers can encourage good digital hygiene, such as using long, complex and unique passwords.
But a major vulnerability in one of the most popular password managers, LastPass, shows how even the tactics users hope will protect them online can still leave them vulnerable - and how just hard it is to keep up with what technology to trust.
Tavis Ormandy, a member of a Google team that hunts for unknown software bugs, discovered the LastPass problem Tuesday - calling it a "complete remote compromise." A distant attacker could potentially take over users' LastPass accounts and gain access to their troves of passwords - at least, if they visited a website designed to exploit the vulnerability while using the LastPass browser extension with Firefox, according to a blog post from LastPass.
LastPass pushed out an update Wednesday fixing the problem. At the same time, it also acknowledged an issue that similarly exposed user passwords and was disclosed to LastPass by security researcher Mathias Karlsson last year.
The company fixed the problem Karlsson discovered back when he told them about it, but it wasn't made public until Wednesday when Karlsson published a blog post explaining the bug. Industry best practice is for researchers to wait until after problems have been fixed to talk about them, but companies don't always publicly announce when they've made major fixes.
This isn't the first time password managers have had security problems. Back in 2014, researchers uncovered security problems in LastPass and four other password managers. Just last year, researchers were able to sneak a malicious program into the Apple App Store that could steal passwords from iOS and OSX's built-in Keychain password management tool, as well as from popular password manager 1Password.
Earlier this week, a government agency also waved developers away from another common account security strategy: Using SMS text messages to deliver two-factor authentication codes. Two-factor authentication is one of the best, basic steps people can take to secure their accounts - it works by having a user verify their identity by using another method beyond a password, most often by entering a unique code sent to them via text message.
But new draft guidance from the National Institute of Standards and Technology argues using SMS texts for two-factor authentication shouldn't be considered secure because the number associated with an account might change hands or the code might be intercepted if sent to a number registered through an online service, including Skype or Google Voice. Instead, the guidance suggests alternatives such as using secure apps for two-factor authentication, a method already offered through Google and some other services.
Both the LastPass issues and the government's concerns about SMS texts for two-factor authentication show why it's so hard for people to stay on top of their online security: Best practices are always changing, and what was once considered the gold standard can quickly become obsolete.
The Washington Post
Fri Jul 29 2016
A distant attacker could potentially take over users' LastPass accounts and gain access to their troves of passwords
Letusan Gunung Ruang: Gelombang tsunami boleh capai 25 meter
Heruningtyas berkata, potensi tsunami ini mengancam di kawasan sebelah barat Pulau Tagulandang.
Iran beri amaran Israel terhadap tindakan ketenteraan lanjut
Iran memberitahu Majlis Keselamatan Pertubuhan Bangsa-Bangsa Bersatu (UNSC) bahawa Israel mesti dipaksa untuk menghentikan sebarang operasi ketenteraan selanjutnya terhadap kepentingan Iran.
Penumpang kecewa penerbangan dibatalkan tanpa notis awal
Beberapa penumpang di Lapangan Terbang Sulawesi, Indonesia merungut penrbangan mereka dibatalkan tanpa notis awal susulan gunung berapi Ruang meletus sejak kelmarin sehingga mengeluarkan abu bahaya ke udara sekali gus membahayakan keselamatan.
Amaran tsunami boleh mencapai 25 meter
Badan Geologi, Kementerian Tenaga dan Sumber Daya Mineral Indonesia mengingatkan potensi tinggi gelombang tsunami yang diakibatkan oleh letusan Gunung Ruang di Kabupaten Sitaro, Sulawesi Utara mencapai 25 meter.
Banjir di Selangor menurun kepada 364 orang
Banjir di Melaka dan Negeri Sembilan pulih sepenuhnya setakat 8 malam tadi selepas kesemua mangsa dibenarkan pulang ke kediaman masing-masing.
Menurut laporan terkini info Bencana JKM, setakat 6 pagi Jumaat mangsa banjir di Selangor pula sedikit menurun kepada 364 orang pagi ini berbanding 483 yang dilaporkan pada malam Khamis.
Menurut laporan terkini info Bencana JKM, setakat 6 pagi Jumaat mangsa banjir di Selangor pula sedikit menurun kepada 364 orang pagi ini berbanding 483 yang dilaporkan pada malam Khamis.
DXB dijangka beroperasi semula dalam tempoh 24 jam
Terminal 1 dan Terminal 3 telah pun memulakan normalisasi secara beransur-ansur, menyebabkan pergerakan lebih lancar, katanya dalam kenyataan kepada Agensi Berita Emirates (WAM).
Bakal jemaah haji tidak ragu-ragu memilih TH
Berdasarkan reputasi dan kewibawaan menguruskan jemaah haji untuk tempoh yang lama, pasangan suami isteri, Azahar Mahamud dan Rohani Abdul Ghani tidak ragu-ragu memilih TH menguruskan mereka secara muassasah bagi musim haji 1445H/2024M.
UAE masih bergelut selepas ribut
Emiriah Arab Bersatu (UAE) masih bergelut dalam proses pemulihan selepas dilanda ribut yang menyebabkan sebahagian besar aktiviti negara terhenti.
Dua kali tolak tawaran, suami isteri sabar menanti untuk ke Baitullah
Pasangan suami isteri, Azahar Mahamud dan Rohani Abdul Ghani tidak sabar untuk menjadi tetamu Allah di Baitullah bagi musim haji 1445H/2024M, lebih-lebih lagi apabila dua kali menolak tawaran diberikan Lembaga Tabung Haji (TH) sebelum ini.
Lapangan Terbang Antarabangsa Dubai dijangka beroperasi semula dalam tempoh 24 jam
Terminal 1 dan Terminal 3 telah pun memulakan normalisasi secara beransur-ansur, menyebabkan pergerakan lebih lancar.
#GempakSpot: Instagram removes 'Following' tab
Now you no longer have to get into petty fights with your significant other.
Sekat berita palsu, mesej WhatsApp hanya boleh di'forward' kepada 5 individu
Hal ini demikian bagi mengelak maklumat yang salah dan khabar angin tersebar secara berleluasa.
Beli-belah guna Ringgit Malaysia di aplikasi Amazon
Syarikat Amazon melancarkan ciri terbaru dalam aplikasi untuk pengguna membeli-belah sebanyak 45 juta barangan yang boleh dihantar ke satu dunia dihantar ke seluruh dunia melalui peranti mudah alih.
Aplikasi baharu AirAsia jamin pengalaman penerbangan lebih selesa
Penumpang AirAsia kini boleh menikmati pengalaman penerbangan yang lebih lancar dengan aplikasi mudah alih terbaru AirAsia.