Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled.

The procedure is described here:

It goes along these lines:

  1. Go to the account recovery page.
  2. Enter the e-mail address you use as login to LastPass
  3. You now receive an e-mail with instructions on how to proceed, and a locally stored One-Time-Password has been enabled.
  4. Using this password you should be able to restore access to your password database without using your master password. (I don't know how this works, but maybe LastPass has a 2nd copy of your password database encrypted using this OTP in addition to the database encrypted using the master password.)

But as many people have their mail program setup to the mail account they use as login to LastPass doesn't this mean that if somebody gets access to your machine and manage to login then they can:

  • Enable the locally stored OTP using the recovery link.
  • Read the instructions sent to you by e-mail because the also have access to your local email program.
  • Gain full access to your entire password database.

And they can do so without knowing your master password?

Is there something I have misunderstood?

share|improve this question
1  
Any secondary access mechanism, by definition, increases your security risk. Instead of one password, now you have two. – tylerl Sep 25 '12 at 5:22
1  
For anyone reading this and wondering how to disable it; In your Last Pass Menu on your browser extension go to: Preferences > Advanced > And un-tick "Save a disabled One Time Password locally for Account Recovery". You will have to do this everywhere Lastpass is installed. – Andy Smith Sep 25 '12 at 12:06

2 Answers

up vote 4 down vote accepted

I do view the local OTP as a security risk, however, there is an option to disable it in the browser extensions (at least for firefox and chrome). I always disable local OTP on each browser after installing the lastpass extension, which means, of course that I will loose my vault if I forget my master password. I think it would be more secure if lastpass had the local OTP disabled by default. I guess they had to make some trade-off between security and user dissatisfaction when they forget their password.

share|improve this answer
up vote 6 down vote

There are several way to implement such functionality, but basically yes all represent significant security risks, especially since they posses your password database too.

LastPass might offer some emergency contact information for disabling this feature if your machine got stolen. You could avoid using LastPass for any passwords that provide financial or deeper identifying information as well.

There are several open source password database programs like KeePass and KeePassX that store your entire password database locally.

share|improve this answer
So I guess, to stay more secure, one should turn this feature off in LastPass. Thanks for the pointer to KeePassX. I am already using it. However, I miss something like Yubikey challenge-response which is used by Password Safe to keep my database even safer. Unfortunately, this is (not yet) supported by KeePassX or Password Gorilla. – mgd Jun 9 '12 at 21:53
There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even. – Jeff Burdges Jun 9 '12 at 23:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.