LastPass goes public over security vulnerabilties
Cloud-powered password management service LastPass has spoken publicly about a pair of security flaws reported in August 2013 for the first time, but says that users have nothing to fear from the bugs.
LastPass is a popular cross-platform password management service, which stores users' usernames, passwords and other private details on remote servers. These details are reversibly encrypted using a master password, meaning that LastPass users need only remember a single password while having the ability to use a unique and complex password for every site and service they use.
It's a handy way of dealing with the issues surrounding secure passwords, but one that introduces a single point of failure: if an attacker gains access to the target's LastPass account, the attacker automatically gains access to every single site stored within the database - unless, of course, two-factor authentication is being used. That makes security vulnerabilities in the service a serious concern, and LastPass has confirmed that two such vulnerabilities were reported to the company in August last year.
