People downloaded this tool to keep their passwords safe. But it had a major flaw

But a major vulnerability in one of the most popular password managers, LastPass, shows how even the tactics users hope will protect them online can still leave them vulnerable - and how just hard it is to keep up with what technology to trust.

Tavis Ormandy, a member of a Google team that hunts for unknown software bugs, discovered the LastPass problem Tuesday - calling it a "complete remote compromise." A distant attacker could potentially take over users' LastPass accounts and gain access to their troves of passwords - at least, if they visited a website designed to exploit the vulnerability while using the LastPass browser extension with Firefox, according to a blog post from LastPass.

LastPass pushed out an update Wednesday fixing the problem. At the same time, it also acknowledged an issue that similarly exposed user passwords and was disclosed to LastPass by security researcher Mathias Karlsson last year.

The company fixed the problem Karlsson discovered back when he told them about it, but it wasn't made public until Wednesday when Karlsson published a blog post explaining the bug. Industry best practice is for researchers to wait until after problems have been fixed to talk about them, but companies don't always publicly announce when they've made major fixes.

This isn't the first time password managers have had security problems. Back in 2014, researchers uncovered security problems in LastPass and four other password managers. Just last year, researchers were able to sneak a malicious program into the Apple App Store that could steal passwords from iOS and OSX's built-in Keychain password management tool, as well as from popular password manager 1Password.

Earlier this week, a government agency also waved developers away from another common account security strategy: Using SMS text messages to deliver two-factor authentication codes. Two-factor authentication is one of the best, basic steps people can take to secure their accounts - it works by having a user verify their identity by using another method beyond a password, most often by entering a unique code sent to them via text message.

But new draft guidance from the National Institute of Standards and Technology argues using SMS texts for two-factor authentication shouldn't be considered secure because the number associated with an account might change hands or the code might be intercepted if sent to a number registered through an online service, including Skype or Google Voice. Instead, the guidance suggests alternatives such as using secure apps for two-factor authentication, a method already offered through Google and some other services.