Here's a
link to a PDF of the actual study.
I have used LastPass for years so this is interesting. The 2 areas the researchers identified with vulnerabilities in LastPass were in the bookmarklet feature (using a Javascript bookmarklet to enter username/password to the current site versus using the browser-specific extension) and in one-time passwords (OTP).
I use neither of these features. The bookmarklet would be used for a browser that does not support extensions such as Safari or Chrome on a mobile device. Firefox and Chrome, the 2 I use, do not require the use of a bookmarklet on a desktop.
The other area was when using OTP which I also don't use. I don't share access to my vault in this manner and doubt that it's a commonly used feature.
We've talked a lot about security on this forum and the same issues exist with any password manager that exist for other security products - absent a full security audit whose results are made public we're reliant on the manufacturer's assurance of security.
