lastpass browser extension security risk

Adding an extra layer, like a password vault, is not going to make things better. We have decades of experience with this just with regard to one layer of passwords. That means it's going to be very hard to get people to do it. Good security is hard in practice because people are always going to default to the most convenient/simple way to accomplish their goal, and at this point, most of our security measures require someone to expend extra energy. Here's another question to ask: 'Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl+F for the URL, and then Ctrl+C out the username and password every time they want to visit a site? Also, is everyone going to create a correlated entry every time they make a new account?' Whether it will happen to you personally, nobody can tell of course. I can clearly see that on some websites trying to exploit LastPass users can actually be lucrative. How likely it is that bad guys will actually try to target LastPass? They seem to have at least 10 million users judging by AMO and Chrome Web Store numbers. But the typical threat is 'merely' losing all your LastPass data to a random website you are visiting (or a hacked ad script running on it). The recent vulnerability reported was particularly bad, launching an arbitrary external application is really as bad as it goes - this could have resulted in a malware infestation. LastPass keeps the attack surface unnecessarily large and they are pretty bad at securing it.

As I explained several times already, the issue is a structural one. It would be naive to assume that this was the last of them. The claim that vulnerabilities still exist was unsourced six months ago - now you have proof that they do. Thank you for the reminder, I added the disclaimer noting that I develop Easy Passwords.

Lastpass browser extension security risk