[ithipster]

i do not advocate for lastPass, you should not allow ANYBODY handle YOUR passwords. but. the premise of your argument is utterly and completely wrong.

"I got redirected to lastpass.com/update_phone.php ... I get redirected to a php file in the root of the webserver?"

no and no. by looking on a URL you can not say anything about the "root" location, whatever you mean by the "root". and you was not redirected to any "file" at all, there are no files in the space of URLs. and ".php" part is not telling you anything about the server's internals (i have a couple of servers written in Erlang, i can create a couple of ".php" URIs for you if you wish.)

YOU MAKE UNJUSTIFIED ASSUMPTIONS -- this is THE primary reason for the mistakes you alleged in your article -- WHAT AN IRONY!!!!