0

I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (which I get from Google Authenticator on my phone).

However, if I go back to the form from which I triggered the login, the password is now filled in. (This site, as many others are, is set to autofill, but not autosubmit).

How is this possible? Is LastPass's MFA broken?

1 Answer 1

3

As far as I understand only your master password is used to derive the key to protect your secret (https://lastpass.com/support.php?cmd=showfaq&id=6926)

2nd factor is used to avoid an attacker to get access to the encrypted data from the lastpass servers only (download it for local decryption). Not for encryption/decryption. I cant find a reference stating this, but also not any reference saying that they do use it for encryption. And it seems true since they can just disable it for you (https://helpdesk.lastpass.com/multifactor-authentication-options/)

Probably it asks it to update the local encrypted database cache for offline usage (https://helpdesk.lastpass.com/your-lastpass-vault/), but if you cancel, it still can use the old data from a previous fetch. I´m speculating a bit on this part, but makes sense. They could refuse the usage of the data after the 2nd factor fail locally, but that also would break offline usage and would not protect the data from an attacker that already has the master password and access to the encrypted data.

6
  • 1
    LastPass should not be caching passwords. That would be a vulnerability. Jan 8, 2016 at 15:07
  • I mean the encrypted password database. This one is cached for offline usage. Editing to make it clearer.
    – CristianTM
    Jan 8, 2016 at 15:08
  • 1
    The answer would be stronger if you added a link to the doc for offline backup. I think this is a good possibility, BTW. Jan 8, 2016 at 15:18
  • Added links to the information that I gave :)
    – CristianTM
    Jan 8, 2016 at 15:20
  • I can find an option to clear my local cache, but not to do so automatically on logout. Hmm!
    – fredley
    Jan 8, 2016 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .