The situation at LastPass may be worse than they are letting on
I’m wondering if leaving the URLs in plaintext was actually a good idea, here’s my reasoning:With _random_ passwords which most LastPass users probably generated, the attacker has no way of knowing if a key resulted in a successful decryption unless they login to a particular site.If the URLs were part of the encrypted payload though, a quick string check for “http” or “www” would tell them if a key was correct or not during their brute-force attempts. Maybe a silver lining?