Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've recently started using LastPass and one of the things you can set as a policy for you password vault is

Prevent offline access when using Google Authenticator. The local cache can be accessed without a second factor when using Google Authenticator [unless this policy is enabled]

How can they enforce that? If they somehow encrypt my password db with a key returned by the google authentication procedure then how can they allow offline access in the first place? And if they don't encrypt it with something from google then how can they prevent offline access?

share|improve this question

1 Answer 1

They probably wrote a 'server' module for it. GA uses shared secrets. Their module would have the same secret as your GA client.

If so, the next question is: how are they securing the shared secret? The GA pam module suffers the same issue. Each linux server needs either the same shared secret (very bad) or you need a domain for each server (hard to scale). More on the GA pam module here: https://www.wikidsystems.com/WiKIDBlog/5-issues-enterprises-should-consider-before-using-google-authenticator-for-ssh.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.