LastPass was vulnerable, a white hat hacker at Google’s Project Zero claimed Tuesday. A patch for the problem was out by Thursday, Engadget is reporting.
Tavis Ormandy, a researcher affiliated with Google’s security research team Project Zero, sarcastically asked if anyone actually uses LastPass on Twitter yesterday, adding that he found a bunch of fundamental security problems with little more than a quick glance, Betanews is reporting. LastPass is the most popular password storage service on the planet, with millions of users.
Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.
— Tavis Ormandy (@taviso) July 26, 2016
Ormandy has sent a report of the security problems to LastPass, who have patched up the issues. The issue, LastPass says, is that a malicious website could access the Firefox extension without the user even knowing, and do things like delete passwords from the service. The issue is fully solved now.
Here are the details of the vulnerability I reported https://t.co/2fWFyBFzUm https://t.co/3HaEQRJEqa
— Tavis Ormandy (@taviso) July 28, 2016
Google’s Project Zero team routinely researches security flaws online, both in Google services and those created by other companies. Flaws are reported to the appropriate companies, who have 60 days to resolve the issue. At that point, Project Zero makes the flaws public. The idea is to encourage companies to fix the issues, and in this case that seems to be working: LastPass told Ormandy that a fix is on the way.
So we won’t know what problems Ormandy found for a while. But if you want to read something scary right now, researcher Mathias Karlsson also found a terrifying LastPass flaw malicious sites could use to grab all your passwords in bulk, if users leave the automatic login feature enabled.
“First, the code parsed the URL to figure out which domain the browser was currently at, then it filled any login forms with the stored credentials,” Karlsson wrote in a blog post outlining the issue. “However, the URL parsing code was flawed (bug in URL parsing? shocker!).”
LastPass was quick to respond to the problem, and even paid Karlsson a $1,000 bounty for finding and reporting the issue.
Karlsson, for his part, thinks password managers are worth using, despite flaws like this.
“They are still much better than the alternative (password reuse),” Karlsson wrote.
Having said that, disabling autofill might be a good idea, on LastPass and similar services.
The absolutely absurd idea of putting a touchscreen display on a mouse isn't exactly new. Turtle Beach already did it with its Command Series MC7, which features a 2.25-inch control screen. But apparently, even that wasn't ridiculous enough for Arctic Fox Technologies. Its new Super Mouse looks like someone took the chunky old Atari ST mouse, slapped a touchscreen and scroll wheel on it, and called it an upgrade.
The result is a rather unusual-looking mouse that is now on Kickstarter, starting at $199. And as ridiculous as it looks, some of its features are genuinely intriguing.
Apple is less than a day away from launching its highly anticipated OLED MacBook Pro with a touch-sensitive screen. But it appears that the upgrade is going to cost a pretty penny. According to a report by Bloomberg, Apple is reportedly eyeing a starting price of $2,899 for the 14-inch MacBook Pro, while the 16-inch version could start at $3,399 in the US.
"At $2,899, the 14-inch model would mark the highest starting price for a new MacBook Pro model, surpassing the $2,799 Apple charged for a 17-inch version introduced in 2006," says the report. The report claims that Apple is targeting a minimum price hike of $400 for its upcoming redesigned 14-inch and 16-inch MacBook Pro models.
I've spent a good amount of time digging into the spec sheet of the new M6 MacBook Pro (14-inch), and for all intents and purposes, this is a classic Apple "chip and connectivity" refresh. It's not a full redesign. The chassis, Liquid Retina XDR panel, speakers, ports, and battery, all of them carry over unchanged.
However, the M6 brings more cores, stronger on-device AI, higher memory bandwidth on the larger configs, and modern wireless. Here’s the practical rundown of what actually improved, and whether those gains are worth your money.