The threat scenario described by the article: If someone within LastPass wanted to gain access to your passwords (e.g. rogue employees, or via court order) there is a way that the extension could be made to upload your vault key back to LP <i>if</i> you click on certain things within the extension, namely some parts of the preferences, or something like that. Any such change would be publicly detectable, but could theoretically be targeted to avoid widespread notice. So in other words, the vault itself is not fundamentally flawed, but the design of the current extension doesn't proactively firewall against LastPass turning into a bad actor.<p>My $.02: Given that all the cloud-based password managers have their own phone (and even desktop) apps, this seems like a moot point since a bad actor could push out an app update that does anything with your keys anyway.<p>As a long-time LastPass user I appreciate this kind of analysis, but this is just not something I have enough cycles in the day to let bother me. BTW the last time I opened my preferences was 3 years ago. LastPass is quite open to scrutiny and what's important is how responsive they are to new findings -- very responsive, from everything I've ever seen. Including many findings from the author of the article.<p>By far the biggest problem with LastPass is that it sometimes just doesn't apply (or misapplies) the password or username to the appropriate form entries, and I have to go find it and copy it. Occasionally it also misses the saving of a new password (that it generated) and I have to put it in the vault by hand. I suspect this is a really hard problem given the massive variety of forms out there, but would be curious to hear if other password managers <i>never</i> have these issues.