Storing base passwords in Lastpass

Question

After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey.

• I changed my main Fastmail password to be very secure and impossible to remember (for me at least).
• I created a base password which is still pretty hard to remember and requires my Yubikey.

I store both of these logins in Lastpass so my process for logging into Fastmail is:

1. Log into Lastpasswith 2fa
2. Go to the Fastmail site where Lastpass fills the username and base password fields
3. Put the cursor at the end of the base password filled by Lastpass and press the Yubikey button which fills the rest of the password and logs me in

As the base password and my very strong password are both stored in Lastpass do I actually gain anything from using 2fa with Fastmail?

Presumably if someone gets into my Lastpass account they have my key and can either use the base password and my key or just use the strong password.

Is it more secure to use a less strong base password (that I stand a greater chance of remembering) and not storing it in Lastpass? If more of the services I use start supporting 2fa is it more secure for me to store strong base passwords in Lastpass than share a medium strength password between services whilst using 2fa?

Answer 1

As the base password and my very strong password are both stored in Lastpass do I actually gain anything from using 2fa with Fastmail?

The answer to this "most probably yes".

There is two ways you may gain some security this way:

• In case someone manages to steal your service password (for instance through code injected in your mail client or web browser), you will prevent them from reusing your password at a later time because the OTP generated by the hardware key will not be valid any more.
• Inherently, your password will be "longer" if you add the OTP than if you don't.

However, the real question you should ask yourself is: "Is the additional security worth the additional hassle?" That's a very personal question and no one can answer it but you.

Additionally: I suggest you take a moment to consider how you can regain access to your account in case you lose your key (or access to your password database). This is actually a more important question because, if you're a typical user, that is a risk that is far more likely to materialize than having an account with a strong password being compromised in a way that would have been prevented by adding a hardware token.