Hacker News Reader

Comment by jzl | Hacker News Reader

Agreed that the vault blob almost certainly hides all of this, but the question still remains about how the logo is initially obtained. There still might be a leak to lastpass when the logo url is first requested.

And if the extension is pulling the logo from the web then there is also a leak to each site whenever it pulls (rather than to lastpass itself).

Best case scenario: the extension comes with a list of the most common logos baked into it. But if that's the case, why would it save a logo url. Hmm ...

I'm pretty sure we'll be hearing back from Lastpass on this one.

View on HN

there is also a leak to each site

That's not really a leak unless you're keeping a password to some site without actually using the site and don't want the site to know you've done this. But that probably doesn't come up often in practice.

Or if you want to use one account stored in your vault from a location you don't want associated with your other service memberships?

Well, sure, but any out-of-band communication is potentially a leak. If the extension pulls every logo whenever you run it (notwithstanding whatever caching is used, if any), then every site that has a logo could track when you open the extension at all. There are other potential issues here too ... like if a maliciously formed logo image could be used to crash the extension, etc..

Those aren't great examples, but any out-of-band information leak is a bad thing to have. Even if there are no known exploits now there might be future exploits that haven't been anticipated. A common issue when it comes to security.

How can the site tell you're using the extension? And so what if it does? The site can guess you're using a password manager by noticing the instant password entry. The malicious logo, that's really a problem for your browser to deal with. Using an extension to help you talk to a site you already talk to is not really a leak, given the purpose of such extensions.

A lone request for the logo image with no other simultaneous requests in the log could probably be gleaned as a lastpass extension lookup.

And again in this scenario (which we don't know if it's accurate, yet) it's pulling the image for every site with a logo whenever you browse the vault. So your IP address could be leaked to a site that you don't want to know your whereabouts at that moment.

Forensic information is forensic information. A security-conscious tool should not be increasing one's forensic footprint.

Reply on news.ycombinator.com