https://deepquest.code511.com/blog/2017/03/lastpass-domain-design-flaw/