Master password for forum login?

What do you love about LastPass? What do you hate about it? Tell us why you like it, why you don't, and why.

Moderators: admin, anatoly_LP, chantieLP, JoeSiegrist, robyn

Master password for forum login?

Postby danieljb » Sun Oct 15, 2017 8:07 pm

Am I mistaken or did I just have to enter my master password to login to this website to provide casual feedback?
Isn’t this a bad idea?
danieljb
 
Posts: 6
Joined: Thu Jun 08, 2017 6:10 pm

Re: Master password for forum login?

Postby ihartley » Wed Oct 18, 2017 8:13 am

You should be registering on the forum with a different password. NEVER use your master password anywhere else!
ihartley
 
Posts: 109
Joined: Mon Jun 27, 2011 5:33 pm

Re: Master password for forum login?

Postby danieljb » Wed Oct 18, 2017 11:47 am

I know I should, and I thought I did, but I come to the site today, and it automatically logs me in, try to change the forum password and I find myself going through the lastpass recovery process. Can somebody please explain what's going on here? Seems to be no separation between logging into the forum and logging into lastpass.
danieljb
 
Posts: 6
Joined: Thu Jun 08, 2017 6:10 pm

Re: Master password for forum login?

Postby jpenny84 » Wed Oct 18, 2017 11:57 am

It's single sign on. You log into LastPass, and the session authenticates you with the forum. There is no separate password. Your master password is not stored in a forum database.
jpenny84
 
Posts: 7532
Joined: Tue Mar 06, 2012 9:10 pm

Re: Master password for forum login?

Postby danieljb » Wed Oct 18, 2017 11:59 am

Thanks for clarifying that.
danieljb
 
Posts: 6
Joined: Thu Jun 08, 2017 6:10 pm

Re: Master password for forum login?

Postby ihartley » Thu Oct 19, 2017 2:40 pm

jpenny84 Wrote:It's single sign on. You log into LastPass, and the session authenticates you with the forum. There is no separate password. Your master password is not stored in a forum database.


Then it needs to be changed quick-smart!. In that past you had a separate login/password. Now you're telling me that (probably) the same information that allows me to access my LP Vault in a web browser is being sent to software written by phpBB. So by hacking and replicating this someone could gain access to my vault via a browser??

Sounds like an incredibly bad idea to me. My LP master password, and any session/authentication keys should be between LP and me - not some BB software full of holes.

I hope someone can tell me this is not the case.
ihartley
 
Posts: 109
Joined: Mon Jun 27, 2011 5:33 pm

Re: Master password for forum login?

Postby danieljb » Thu Oct 19, 2017 3:52 pm

Pretty sure they just did, I’m imagining it’s like oauth, when you log into sites via google or Facebook, main site tells the forum who we are, and a session is kept alive on the forum without the need for storing the password.
danieljb
 
Posts: 6
Joined: Thu Jun 08, 2017 6:10 pm

Re: Master password for forum login?

Postby ihartley » Fri Oct 20, 2017 9:09 am

OK, I understand. But it is not up to LP to decide to automatically log me into its forum or any other site without my specific authorization.

More specifically (and legally) I do not have to agree to any terms of use, age verification nor any other terms. LP are setting a very dangerous precedent in providing credentials without my agreement. More specifically, it is credentials that I cannot revoke - and that is an even bigger can of worms.

LP really need to think about this long and hard. Will other LogMeIn products/services also now get my credentials without my say so.......
ihartley
 
Posts: 109
Joined: Mon Jun 27, 2011 5:33 pm

Re: Master password for forum login?

Postby gord998 » Tue Oct 24, 2017 8:22 am

I agree that it's too dangerous to use my master password to log into a forum. There should be some way to log in without using the most significant password I have.
gord998
 
Posts: 2
Joined: Sun Oct 22, 2017 8:02 am

Re: Master password for forum login?

Postby allanonmage372 » Sun Nov 12, 2017 6:38 pm

But that's the last password you have to remember.

Get it? Punny right! Ok, I'll see myself out....
allanonmage372
 
Posts: 12
Joined: Sun Nov 12, 2017 5:38 pm


Return to Feedback

Who is online

Users browsing this forum: No registered users and 15 guests