When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites.

How does it know? Are these hard-coded into LastPass, or is there some markup or HTTP header or something on Live.com that specifies its credentials can be shared with other domains?

  • when you go to microsoft.com (as of Aug 31 2015) the "sign in" link at the top right takes you to a sign in page that has a URL beginning with "login.live.com" Is this what you see? if not please confirm that the URL of the sign in page is something other than login.live.com – Owen Aug 31 '15 at 16:46
  • This is a vendor-support question, not an InfoSec question. – schroeder Aug 31 '15 at 17:16
  • @schroeder: Whether a question is "vendor support" or not shouldn't depend on the answer. The answer here happens to be "they hard-coded it," but I had no way of knowing that without knowing the answer. It could very easily have been an HTML or HTTP feature I wasn't aware of. – BlueRaja - Danny Pflughoeft Aug 31 '15 at 18:38
  • Either way, there is no InfoSec impact. If it was HTML or HTTP, then the question should be asked on another site, like SuperUser, or such. – schroeder Aug 31 '15 at 18:57

Lastpass uses a preconfigured and extensible set of site aliases to make two or more domains equivalent.

Here is a snapshot from my account settings page. YMMV.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.