I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (which I get from Google Authenticator on my phone).
However, if I go back to the form from which I triggered the login, the password is now filled in. (This site, as many others are, is set to autofill, but not autosubmit).
How is this possible? Is LastPass's MFA broken?
As far as I understand only your master password is used to derive the key to protect your secret (https://lastpass.com/support.php?cmd=showfaq&id=6926)
2nd factor is used to avoid an attacker to get access to the encrypted data from the lastpass servers only (download it for local decryption). Not for encryption/decryption. I cant find a reference stating this, but also not any reference saying that they do use it for encryption. And it seems true since they can just disable it for you (https://helpdesk.lastpass.com/multifactor-authentication-options/)
Probably it asks it to update the local encrypted database cache for offline usage (https://helpdesk.lastpass.com/your-lastpass-vault/), but if you cancel, it still can use the old data from a previous fetch. I´m speculating a bit on this part, but makes sense. They could refuse the usage of the data after the 2nd factor fail locally, but that also would break offline usage and would not protect the data from an attacker that already has the master password and access to the encrypted data.
