Flaws Found in Popular Web-Based Password Managers

Here's a link to a PDF of the actual study.

I have used LastPass for years so this is interesting. The 2 areas the researchers identified with vulnerabilities in LastPass were in the bookmarklet feature (using a Javascript bookmarklet to enter username/password to the current site versus using the browser-specific extension) and in one-time passwords (OTP).

I use neither of these features. The bookmarklet would be used for a browser that does not support extensions such as Safari or Chrome on a mobile device. Firefox and Chrome, the 2 I use, do not require the use of a bookmarklet on a desktop.

The other area was when using OTP which I also don't use. I don't share access to my vault in this manner and doubt that it's a commonly used feature.

We've talked a lot about security on this forum and the same issues exist with any password manager that exist for other security products - absent a full security audit whose results are made public we're reliant on the manufacturer's assurance of security.