Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've recently started using LastPass and one of the things you can set as a policy for you password vault is

Prevent offline access when using Google Authenticator. The local cache can be accessed without a second factor when using Google Authenticator [unless this policy is enabled]

How can they enforce that? If they somehow encrypt my password db with a key returned by the google authentication procedure then how can they allow offline access in the first place? And if they don't encrypt it with something from google then how can they prevent offline access?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

How can they enforce that?

The browser plugin will not store the data permanently on your local machine if Permit Offline Access is set to Disallow. It is only available while your internet connection is active and your session with LastPass is current.

If they somehow encrypt my password db with a key returned by the google authentication procedure then how can they allow offline access in the first place? And if they don't encrypt it with something from google then how can they prevent offline access?

They don't encrypt the password DB with the 2 factor authentication key - only with your master password (or rather a key derived from it). The 2FA key only determines whether their server allows you access to the password DB and is not used in decryption.

There's a little bit of further information here.

share|improve this answer

They probably wrote a 'server' module for it. GA uses shared secrets. Their module would have the same secret as your GA client.

If so, the next question is: how are they securing the shared secret? The GA pam module suffers the same issue. Each linux server needs either the same shared secret (very bad) or you need a domain for each server (hard to scale). More on the GA pam module here: https://www.wikidsystems.com/WiKIDBlog/5-issues-enterprises-should-consider-before-using-google-authenticator-for-ssh.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.