Hacker News Reader

Perhaps the crypto passwords were stored in the unencrypted URL field, or could be understood from data in there.

https://twitter.com/SwiftOnSecurity/status/16060717986671738...

Seems very likely, it's now known (maybe always was) that metadata fields aren't encrypted. If Twitter poster added those keys to a 'metadata field's then they were clear text.

LastPass has a LOT to answer for.

Reply on news.ycombinator.com