Hacker News new | past | comments | ask | show | jobs | submit login
Fake app masquerading as password manager LastPass just pulled from App Store (techcrunch.com)
88 points by pg_1234 3 months ago | hide | past | favorite | 24 comments



To be fair, the user's passwords were gonna get exploited anyways using the real LastPass anyways.


I first thought this post was a slight saying the real app was "masquerading as a password manager"


Given LP's multiple security issues, that is an fair argument.


Related: "Fraudulent App Impersonating LastPass Currently Available in Apple App Store"[0](from lastpass, 6 points 7 hours ago), "Fake LastPass password manager spotted on Apple's App Store" (34 points, 5 hours ago, 25 comments)

[0]: https://news.ycombinator.com/item?id=39302640 [1]: https://news.ycombinator.com/item?id=39304732


How does an app like this get approved by Apple? Or do they sneak it in with an update?


It's really not that hard. At the end of the day it's just a human making quick decisions hundreds of times a day. I've had more than my share of rejected updates that get approved after a re-submission with no change.


> At the end of the day it's just a human making quick decisions hundreds of times a day.

My company had a version of our communications app in the app store for several years. We decided to sell private-branded versions for some customers where the only differences were the color palette and logo shown on the login screen.

For the app versions we created for customers, one was approved on first review, another required a couple months of back-and-forth with the reviewer, and the third never got approved.


What's LastPass?

You and I know, but the great majority of the people in the world do not.

And, of course, we only see the cases where the scam app gets through. The success rate for these scams might be pretty low, but from our perspective we wouldn't know.


> What's LastPass?

> You and I know, but the great majority of the people in the world do not.

It's literally an app reviewer's job to know that. Having random people on the street reviewing apps would not be very useful. Although sadly, that may be close to the truth:

https://www.wired.com/story/apples-app-store-review-fix-fail... In a deposition in the Epic lawsuit, Shoemaker said that the qualifications needed to get hired as an app reviewer were that a person “could breathe [and] could think.”


> You and I know, but the great majority of the people in the world do not.

Relevance? When there is already an app called LastPass published by LogMeIn with millions of downloads, clearly you don't approve an app called LastPass published by a "Parvati Patel"


She got into Hogwarts. Seems legit to me:

https://www.cbr.com/questionable-harry-potter-relationships/...

That reminds me, I still have a bunch of long-tail lastpass-compromised passwords to rotate before someone brute forces my vault.


I'm on the same boat...


The scam app was called LassPass.


> Or do they sneak it in with an update?

Every update is reviewed.


I worked on issues similar to this during my time at Apple, but from the search and discovery side of things. You would have bands in Apple Music name themselves genres like "Rock and Roll" or and all sorts of shenanigans.


Shenanigans?

You mean marketing?

:)


We’ll see that’s the rub. Isn’t it? Should someone be able to create a band called Meditation Playlist? Is it fraud? Is it just unethical? Is it neither? It requires human judgment where that line is.


I don't think it's legally "fraud."

I can't say it's unethical either. Some third party made a place where people can publicly post things and try to make them popular.

They're just "hackers", in the positive 80's sense, to me.

The responsibility for "fixing" it or whatever is on the platform.


> The responsibility for "fixing" it or whatever is on the platform.

I agree! It made for interesting search problems to solve for sure.

What are your thoughts on the LassPass app? If they were phishing for LastPass credentials, that's going to be a problem, but if they had a real service then I'm not sure.


This has been an ongoing issue, albeit not with examples this egregious. If there's one thing I hope the DMA provides, it's a compelling case to Apple to more carefully review and reject scams worldwide. Every time an app like this slips through, it makes the platform worse. While some failures are expected, I really want Apple to do better than to let a direct impersonation of a password manager through.


i'm not sure i understand you. you're saying third party app stores will incentivise apple to improve their quality control to better differentiate them from competing app stores?


Yeah, I mean, that's what I would hope? Especially if a competing app store were to surface with "better" standards for this. As someone residing in the USA, I don't directly benefit from the DMA, but I would sure like to have the App Store improve.


Good thing apple has a manual review process.


The walled garden will protect you from this!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: