After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey.
- I changed my main Fastmail password to be very secure and impossible to remember (for me at least).
- I created a base password which is still pretty hard to remember and requires my Yubikey.
I store both of these logins in Lastpass so my process for logging into Fastmail is:
- Log into Lastpasswith 2fa
- Go to the Fastmail site where Lastpass fills the username and base password fields
- Put the cursor at the end of the base password filled by Lastpass and press the Yubikey button which fills the rest of the password and logs me in
As the base password and my very strong password are both stored in Lastpass do I actually gain anything from using 2fa with Fastmail?
Presumably if someone gets into my Lastpass account they have my key and can either use the base password and my key or just use the strong password.
Is it more secure to use a less strong base password (that I stand a greater chance of remembering) and not storing it in Lastpass? If more of the services I use start supporting 2fa is it more secure for me to store strong base passwords in Lastpass than share a medium strength password between services whilst using 2fa?