Wicked LastPass phish could trick users into giving up their master passwords

The weakest defense against the dark art of hacking is still you.

This humbling fact was proven once again when 27-year-old CTO of Praesidio and weekend hacker Sean Cassidy unveiled a proof-of-concept LastPass phishing hack that could trick unsuspecting users into entering their user name and, more worrisome, their master password in a fake LastPass login window.

While Cassidy's hack is fairly complex piece of coding work, the hack still, ultimately, relies on tricking someone into believing that they're using a real LastPass login window. LastPass is the popular (8 million users), free password management utility that will create, manage, and store passwords behind an encrypted wall. All you need to do is remember one password and then the app will auto-fill passwords, credit card info and more on any site where you use it. Read more...