Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.
I do. Nobody who goes on HN will be. But the layman who spends 80 hours a week working a minimum wage job who has no time for computers and just wants a Disney vacation for his kids, absolutely would be floored by this. It seems very reasonable to apply conventional logic to computers. You can write all you want on a piece of paper and then throw it away and nobody would see it. The same doesn't apply on the internet, but it's not a big leap for people who barely know how to log in.
I go on HN, and although I'm not surprised that this is possible, nor shocked that it's done, it is the kind of thing I could easily fail to think about, or assume is probably not actually being done by anyone I deal with.
That's actually happened to all the major vendors like LastPass and OnePass, and to some of them it's happened the exact same way multiple times - a UI re-design re-introduces the same JS interop mistake.
some linky links: https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/769378052254015488
I've promoted password managers for a long time! Just not fancy convenient commercial ones, those are a huge mistake.
1Password wrote an extended post in response to that vulnerability talking about defenses and threat models https://discussions.agilebits.com/discussion/70301/backgroun... and I don't see evidence that the vulnerability ever recurred.
And it was not a threat that allowed one website to get passwords for another website. It's true that other password managers have had such vulnerabilities - multiple times - but that's a reason to comparison-shop the various password managers and pick a secure one, not to write off the product category entirely.