Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new Homebrew path and fix security concern #1

Merged
merged 1 commit into from
May 21, 2021

Conversation

woopstar
Copy link

Homebrew switched to use /opt/homebrew/bin as default path now. Add this path to binary findings.

Remove the --trust option from the login command, since this will remove the multifactor option.

The 'login' subcommand will initialize a local cache and configuration folder,
then attempt to authenticate itself with the LastPass servers, using the
provided command line credentials or by interactively prompting (in the case of
multifactor or an unprovided password). The '--trust' option will cause
subsequent logins to not require multifactor authentication. If the
'--plaintext-key' option is specified, the decryption key will be saved to the
hard disk in plaintext.  Please note that use of this option is discouraged
except in limited situations, as it greatly decreases the security of data.

Homebrew switched to use `/opt/homebrew/bin` as default path now. Add this path to binary findings.

Remove the `--trust` option from the login command, since this will remove the multifactor option.

```
The 'login' subcommand will initialize a local cache and configuration folder,
then attempt to authenticate itself with the LastPass servers, using the
provided command line credentials or by interactively prompting (in the case of
multifactor or an unprovided password). The '--trust' option will cause
subsequent logins to not require multifactor authentication. If the
'--plaintext-key' option is specified, the decryption key will be saved to the
hard disk in plaintext.  Please note that use of this option is discouraged
except in limited situations, as it greatly decreases the security of data.
```
@lhaeger lhaeger merged commit 2dbc453 into lhaeger:master May 21, 2021
@Unimatrix0
Copy link

--trust is not generally a security issue, as your computer effectively acts as a 2nd factor after the first login.
The discouraged option lastpass is referring to is --plaintext-key
I suggest removal of --trust change be reverted, or at the very least, made a user choice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants