LastPass - Can MFA stop hackers from cracking a local vault?

Question

After the recent LastPass security incidents (where old backup copies of users' encrypted vaults have leaked), I was wondering if an account had MFA configured at the time, it makes a difference for hackers to crack-open such a vault locally.

Or is MFA just a measure to throttle logins to the LastPass servers, if a hacker knows your email and master password, which is pretty useless security?

Or to frame the question in a more StackOverflow compatible way: how does one mitigate the effects of the LastPass leak, and having an MFA is a mitigation in itself?

Answer 1

MFA is just for logins, not for the encryption of the vaults themselves.

And, no, that control is not "useless". Just not useful in this case.

Answer 2

Encryption is deterministic, given an input and key, it will always decrypt. There is no way to involve a random number sent over text in the process. Further decryption isn't really authenticating the decryptor, so the acronym doesn't really fit. The user's MFA has no bearing on an offline attack against the encrypted stores.

how does one mitigate the effects of the LastPass leak

There is something to take from MFA. Remember the multiple factors know, have and are. If an attacker can exfiltrate ("know") both the encrypted data and the key, it's game over. If the key can be turned into something one has it's a lot stronger. This is what we do with HSMs. These have strong assurances that private portions of key material can never leave the HSM. One has to "have" the HSM (or more accurately have access to the HSM) to decrypt anything. Given an HSM is standard practice for most cloud based storage of PII hopefully LastPass did this and these encrypted backups will stand the test of time.

Final pedantry:

One could simply attack the crypto involved, bypassing the need to "have" the HSM involved. But this is probably akin to guessing what code the user was sent over SMS. Not impossible, but improbable on the scale of a useful attack.