LastPass - Developer Console Warning Message

[Techabilla]

I ran the JS snippet to extract my vault yesterday but did not notice the following message that now appears:

Stop!​

This is a feature for developers and researchers! If you are not a developer or researcher, pasting something here could cause your account to be compromised

Perhaps this has always been there, or then again perhaps it's something new...

EDIT: To be clear, this message is generated by a bit of LastPass JS delivered as 'reqaccts_js_bundle'.

 

[PHolder]

The Web Developer console is dangerous if misused, but it has nothing to do with Lastpass. You could get a string messaged to you from a site (email or otherwise) that could, for example, send your Chrome password database to a third party.

 

[rfrazier]

Try this to export your data:

If you're running the Lastpass plugin in the browser, click the icon for the plugin in the toolbar at the top. Click account. Click fix a problem yourself. Click export vault items. I don't remember what happens next but it should be pretty obvious.

Hope that helps.

May your bits be stable and your interfaces be fast. Ron

 

[SeanBZA]

Drops a csv file into the default downloads directory you have, and BW can import it.

 

[Techabilla]

Thanks folks. I had no difficulty exporting the vault, I just thought it was interesting that LP put that message in the dev console at some point, and wondered if it was a direct response to either SN904, or Wladimir Palant's original blog post in December. I seem to recall Steve suggesting we should grab the vault as quickly as possible in case LP engineered against the use of the simple JS snippet.

For what it's worth, I'm moving to 1Password since I like the idea of the Secret Key and am happy to pay for what I hope will be good service.

 

[PHolder]

I just thought it was interesting that LP put that message in the dev console

As I said, the message is from the browser itself and NOT from LP.

For example: https://forums.opera.com/topic/56011/how-to-remove-the-warning-message-in-dev-console

 

[Techabilla]

As I said, the message is from the browser itself and NOT from LP.

For example: https://forums.opera.com/topic/56011/how-to-remove-the-warning-message-in-dev-console

No - it only appears in dev consoles opened from an active LastPass session (or even the logon screen).

Following either of these links leads to a JS bundle...

... and in the actual code:

The minified bundle will download from LastPass (parameter not required) e.g. https://lastpass.com/m.php/reqaccts_js_bundle

If you un-minify, you can find the following clause buried in the middle of hundreds of other definitions:

I doubt that the browser is injecting this, and even if it was, what 'account' is it referring to?

 

[miquelfire]

Well, it could refer to the account of whatever site you're visiting. Kind of like those scam messages we see everywhere now.

 

[Techabilla]

Well, it could refer to the account of whatever site you're visiting. Kind of like those scam messages we see everywhere now.

Nah. I'm used to working in the Chrome developer console, and this is the first time I've ever seen the message. Plus all the evidence I already posted.

 

[miquelfire]

I'm just saying if the browsers were to add that message.

 

[StevenW]

Facebook does the same thing. Users are told to copy and paste random JavaScript from the internet to "unlock" special features and their account gets taken over.

 

[miquelfire]

I think browsers should have a message, sort of like how Firefox has the warning for about:config, at least to use the console. If it weren't for the tech support scammers who will blank your view of the screen to change how things look with your bank account, I'm not sure how to handle the "Don't show again" checkbox. The people who would need to see it are likely the ones who would have that option selected without them ever seeing it because they fell for a tech support scam.