Comment

Comment by harshreality

Playing Devil's advocate (as in, I agree with you, site A should never under any conditions ask people to enter their password for site B):

Lastpass does encourage visitors to that page to change their LNKD pw on LNKD and anywhere else it might be reused. The checker form is placed below that recommendation.

Anyone inclined to enter their (old?) LNKD pw on the Lastpass page would probably enter it on some other "leakedin" password checker page that's less secure. At least Lastpass tries to be trustworthy.

Regarding your point (2), I don't think it matters if the LNKD vulnerability has not been patched. Everyone should still change their LNKD pw, because the compromise might have been temporary. I agree that Lastpass and everyone else encouraging a LNKD password change should emphasize not to reuse passwords, but universally, and not specific to LNKD.

parent harshreality 14 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton