Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled.

The procedure is described here:

It goes along these lines:

  1. Go to the account recovery page.
  2. Enter the e-mail address you use as login to LastPass
  3. You now receive an e-mail with instructions on how to proceed, and a locally stored One-Time-Password has been enabled.
  4. Using this password you should be able to restore access to your password database without using your master password. (I don't know how this works, but maybe LastPass has a 2nd copy of your password database encrypted using this OTP in addition to the database encrypted using the master password.)

But as many people have their mail program setup to the mail account they use as login to LastPass doesn't this mean that if somebody gets access to your machine and manage to login then they can:

  • Enable the locally stored OTP using the recovery link.
  • Read the instructions sent to you by e-mail because the also have access to your local email program.
  • Gain full access to your entire password database.

And they can do so without knowing your master password?

Is there something I have misunderstood?

share|improve this question
1  
Any secondary access mechanism, by definition, increases your security risk. Instead of one password, now you have two. –  tylerl Sep 25 '12 at 5:22
1  
For anyone reading this and wondering how to disable it; In your Last Pass Menu on your browser extension go to: Preferences > Advanced > And un-tick "Save a disabled One Time Password locally for Account Recovery". You will have to do this everywhere Lastpass is installed. –  Andy Smith Sep 25 '12 at 12:06
    
Must say I'm VERY surprised by this feature. If my laptop is stolen it would just take a couple of clicks to get access to all my passwords and on top log me out of LastPass since they would have changed the password. Other users are also concerned about this: forums.lastpass.com/viewtopic.php?f=7&t=144125 , forums.lastpass.com/viewtopic.php?f=12&t=144265 –  Patrick Dec 9 at 9:11

3 Answers 3

up vote 2 down vote accepted

I have actually tried to use account recovery with LastPass just to test this on Mar 5 2014. Lastpass sends you a link good for 48 hours via the email account associated with Lastpass. You need to access this link from a browser with a Lastpass plugin installed. If this plugin was used to access the lastpass account with the email address used for the account recovery, and if One Time Password was enabled, you will be taken to your vault and offered the chance to change your master password. HOWEVER, if you don't change your master password, you will still be left in your lastpass vault, with your various logins visible. You cannot export them without knowing the master password, but you can look at (edit) the various individual logins. Thus someone could take for example your bank login information without ever changing your master password. You might never know this has happened. This presumes that someone has access to your email account, for example, if you left it open on your computer when you stepped away.

I think turning off One Time Password is a very good idea. And the One Time Password in advanced options in the plugin, is PER MACHINE. So any other browsers you use, or portable versions, or if you ever logged into lastpass from someone's computer using their browser and plugin.

I think LastPass should probably disable One Time Password by default, even though some users would probably forget their master password and lose access to their password vault. Lastpass should at least make the One Time Password account wide, not per machine. So you don't have to remember every machine you ever logged from.

share|improve this answer
    
Thank you very much for taking the time to test this out! I am not sure if I knew that One Time Password is per machine and I agree completely with your conclusion: turn OTP off. –  mgd Mar 6 at 14:36

There are several way to implement such functionality, but basically yes all represent significant security risks, especially since they posses your password database too.

LastPass might offer some emergency contact information for disabling this feature if your machine got stolen. You could avoid using LastPass for any passwords that provide financial or deeper identifying information as well.

There are several open source password database programs like KeePass and KeePassX that store your entire password database locally.

share|improve this answer
    
So I guess, to stay more secure, one should turn this feature off in LastPass. Thanks for the pointer to KeePassX. I am already using it. However, I miss something like Yubikey challenge-response which is used by Password Safe to keep my database even safer. Unfortunately, this is (not yet) supported by KeePassX or Password Gorilla. –  mgd Jun 9 '12 at 21:53
    
There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even. –  Jeff Burdges Jun 9 '12 at 23:45

I do view the local OTP as a security risk, however, there is an option to disable it in the browser extensions (at least for firefox and chrome). I always disable local OTP on each browser after installing the lastpass extension, which means, of course that I will loose my vault if I forget my master password. I think it would be more secure if lastpass had the local OTP disabled by default. I guess they had to make some trade-off between security and user dissatisfaction when they forget their password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.