Top all-time · #1144
Labs Detectify
Company blog · labs.detectify.comsecurity
Labs Detectify is the company blog at labs.detectify.com, writing about security. Since 2014, 58 different Hacker News readers have linked it 77 times, most often “LastPass autofill exploit”. It is still writing: the last post was on 2026-09-10, and you can follow it by feed.
Too few sampled comments (28) to say how often HN recommends it.?
Why HN links it
HN readers link Detectify Labs security research, mostly on LastPass vulnerabilities and password manager autofill flaws, plus nginx misconfigurations, subdomain takeover and OAuth account hijacking.
Summarised by Claude from a sample of 28 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
For ethical hackers and those interested, Detectify Labs is your go-to source for writeups, guidance, and security research.
Most-linked posts?
- LastPass autofill exploit14 people · 15 mentions · first linked 2016-07-27
- Account hijacking using “dirty dancing” in sign-in OAuth-flows4 people · 4 mentions · first linked 2022-07-07
- A deep dive into AWS S3 access controls – taking full control over your assets3 people · 3 mentions · first linked 2017-07-13
- The story of EV-SSL, AWS and trailing dot domains3 people · 3 mentions · first linked 2016-10-06
- Popular Google Chrome extensions are constantly tracking you by default3 people · 3 mentions · first linked 2015-11-19
- Middleware, middleware everywhere – and lots of misconfigurations to fix2 people · 3 mentions · first linked 2021-02-26
- I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)2 people · 2 mentions · first linked 2018-01-12
- Hacking CloudKit: How I accidentally deleted your Apple shortcuts2 people · 2 mentions · first linked 2021-09-13
- How Patreon (probably) got hacked – Publicly exposed Werkzeug Debugger2 people · 2 mentions · first linked 2015-10-02
- Slack Bot Token Leakage Exposing Business Critical Information2 people · 2 mentions · first linked 2016-04-28
What Hacker News says?
"Probably refers to"? That you don't know what "secure" refers to is itself a problem. But more problematic is anyone's defense of Google Chrome's architecture while overlooking that that architecture is implemented with secret software which you aren't allowed to vet, alter, or share with others (parts of software freedom). This proprietary software apparently allowed for sending Google every URL a Chrome user type…
Comment linking /2015/07/28/how-i-disabled-your-chrome-security-extensions/
on “Firefox is back. It's time to give it a try”Submitted LastPass autofill exploit as a story · 1008 points
HN discussionIt's confusing that the LastPass site is claiming only Firefox is impacted. [1] Whereas the security researcher's site (detectify.com) shows the vulnerability running in Chrome. [2] Furthermore, the current live version on Firefox addons repository is 3.x [3], which the LastPass team claims is not vulnerable. [1] [1] https://blog.lastpass.com/2016/07/lastpass-security-updates.... [2] https://labs.detectify.com/2016/…
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “LastPass autofill exploit”Submitted Hacking Slack using postMessage and WebSocket-reconnect to steal your token as a story · 343 points
HN discussion> Password managers really shine at times like these I agree on some levels, but password managers can and have had vulnerabilities[0] that can allow the gmail password to be populated despite the wrong domain. Given that the autofill adds legitimacy and reduces friction, it could make this particular scenario go from bad to worse. [0] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “The closest I've ever come to falling for a Gmail phishing attack”Submitted How to Hack APIs in 2021 as a story · 334 points
HN discussionBack in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature to download remote code and add it to the extension so to say. As long as that practice is allowed, source review would not help. [1] https://labs.detectify.com/2015/11/19/chrome-extensions-aka-...
Comment linking /2015/11/19/chrome-extensions-aka-total-absence-of-privacy/
on ““Stylish” browser extension steals all your internet history”Submitted How I hijacked the top-level domain of a sovereign state as a story · 295 points
HN discussionThere was a follow-up to this released last week by Frans Rosen on Detectify Labs that looked into middleware in general and still applicable to nginx: https://labs.detectify.com/2021/02/18/middleware-middleware-...
Comment linking /2021/02/18/middleware-middleware-everywhere-and-lots-of-misconfigurations-to-fix/
on “Common Nginx misconfigurations that leave your web server open to attack”Submitted I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018) as a story · 240 points
HN discussionYou might find this follow up research interesting. It says gixy doesn't cover all: https://labs.detectify.com/2021/02/18/middleware-middleware-...
Comment linking /2021/02/18/middleware-middleware-everywhere-and-lots-of-misconfigurations-to-fix/
on “Common Nginx misconfigurations that leave your web server open to attack”Submitted Popular Google Chrome extensions are constantly tracking you by default as a story · 169 points
HN discussionDon't forget that the LastPass chrome extension has been tricked in the past to extract passwords from arbitrary domains. It's still important to use your brain when clicking links and invoking LastPass's autofill functions. https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “We Got Phished”Submitted How Patreon (probably) got hacked – Publicly exposed Werkzeug Debugger as a story · 32 points
HN discussionWrote about this a week ago: https://labs.detectify.com/2017/12/20/security-questions-are...
Comment linking /2017/12/20/security-questions-are-not-secure/
on “Your Mother’s Maiden Name Is Not a Secret”Submitted Slack Bot Token Leakage Exposing Business Critical Information as a story · 26 points
HN discussionI don't think I'd call them a 'sham'. They're not advertising something they don't do. I think they do everything that they say they do[1]. If this was a case where someone was able to get plaintext passwords from lastpass's server, you'd be right. The first thing I think people should realize is that there are vulnerabilities in every software, and addressing that fact goes a long way. I doubt that they weren't fol…
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “LastPass RCE vulnerability fixed”Submitted Hacking CloudKit: How I accidentally deleted your Apple shortcuts as a story · 19 points
HN discussionIt's definitely a fine sanity check but I'd have to really think about whether it's a barrier. Immediate things I worry about are around URL parsing. Is evil.com<insert something here>steampowered.com going to pass as "steampowered.com" when it isn't? Will it handle punycode? All sorts of shit can go wrong when parsing a URL, and it's a real world problem when people implement the mitigation you're describing[0]. ht…
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “Valve and HackerOne: how not to handle vulnerability reports”Submitted Chrome Extensions – AKA Total Absence of Privacy as a story · 17 points
HN discussionPHP has some Easter eggs which reveal contributor credits in response to a request with certain GET parameters. This can be used to fingerprint the server version: https://labs.detectify.com/2012/10/29/do-you-dare-to-show-yo...
Comment linking /2012/10/29/do-you-dare-to-show-your-php-easter-egg/
on “No Easter Eggs in Curl”Submitted How I exploited TLS-SNI-01 to issue Let's Encrypt certs using shared hosting as a story · 9 points
HN discussionUsing 1Password to store your 2fA seed makes it single factor because your password and second factor are stored in the same place. This is not a good idea. Yubikeys in U2F mode are better than any OTP because they protect you against phishing attacks. 1Password auto-filling arguably has this property too, but you should disable that sort of password manager behavior: https://labs.detectify.com/2016/07/27/how-i-made…
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “Guide to Using YubiKey as a SmartCard for GPG and SSH”Submitted How the celebrity hack could have been done as a story · 8 points
HN discussion> So if you cracked my LastPass vault - good luck with that, 2FA considered Well, the traditional[1] way to break[2] LastPass is to ignore individual accounts and go after poor coding technique[3]. 2FA won't help you there. [1] https://www.wired.com/2015/06/hack-brief-password-manager-la... [2] https://techcrunch.com/2011/05/05/password-manager-last-pass... [3] https://labs.detectify.com/2016/07/27/how-i-made-lastpa…
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “Flaws in deterministic password managers”Submitted Slack bot token leakage exposing business critical information as a story · 7 points
HN discussion>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a s…
Comment linking /2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/
on “Ask HN: What is your password management solution?”Submitted How I disabled your Chrome security extensions as a story · 7 points
HN discussionApparently they were compromised via a publicly exposed Werkzeug debugger: http://labs.detectify.com/post/130332638391/how-patreon-got-...
Comment linking /post/130332638391/how-patreon-got-hacked-publicly-exposed-werkzeug
on “Gigabytes of user data from hack of Patreon donations site dumped online”Submitted Building an XSS Polyglot Through SWF and CSP as a story · 6 points
HN discussion
