I am a LastPass user, which I use with the browser extensions.
Lately it occurred to me that it should not be too hard to create a fishing browser extension that
- would replace LastPass upon install,
- look exactly like last pass,
- Behave like LastPass up to the submission of your password, and
- Simply send your login information to some email address upon submission.
My questions are:
- Is that a known hack?
- If not, why wouldn't it work/be easy to implement (beyond making the user install the extension, which can be done using traditional fishing techniques)?
- If it is, is there any ways to protect oneself against that kind of threats? Does LastPass recommend something in this matter?
My question is about LastPass in particular, but I guess the same issue occurs for any keychain software, and I'd be happy to hear about those (for example, 4. if there is a threat at all, does any keychain software offers a better protection than LastPass?)