@
kersbal Lastpass 不是在官方论坛回复的，而是直接回复了新闻媒体
LastPass CTO Sandor Palfy said:
"This particular vulnerability, in LastPass for Applications, our legacy, local Windows Application (which accounts for less than .2 percent of all LastPass usage) was brought to our attention by researchers through our Bug Bounty Program.
In order to read the memory of an application, an attacker would need to have local access and admin privileges to the compromised computer. We have already implemented changes to LastPass for Applications designed to mitigate and minimize the risk of the potential attack detailed in this report.
To mitigate the risk of compromise while LastPass for Applications is in a locked state, LastPass for Applications will now shut down the application when the user logs out, clearing the memory and not leaving anything behind."
第二天就发布了 patch。而且，lastpass 的漏洞没有 1password 严重，lastpass 只会解密用户正在使用的密码，而 1password 一上来就解密整个 database。
https://www.zdnet.com/article/critical-vulnerabilities-uncovered-in-popular-password-managers/到今天，lastpass 在 lock 状态下已不会泄露任何密码，而在 unlock 状态下也只会泄露用户正在使用的密码（所有 password manager 都会这样）。而 1password 没有发布任何修补，只是一味的将责任推给用户。