0

I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (which I get from Google Authenticator on my phone).

However, if I go back to the form from which I triggered the login, the password is now filled in. (This site, as many others are, is set to autofill, but not autosubmit).

How is this possible? Is LastPass's MFA broken?

3

As far as I understand only your master password is used to derive the key to protect your secret (https://lastpass.com/support.php?cmd=showfaq&id=6926)

2nd factor is used to avoid an attacker to get access to the encrypted data from the lastpass servers only (download it for local decryption). Not for encryption/decryption. I cant find a reference stating this, but also not any reference saying that they do use it for encryption. And it seems true since they can just disable it for you (https://helpdesk.lastpass.com/multifactor-authentication-options/)

Probably it asks it to update the local encrypted database cache for offline usage (https://helpdesk.lastpass.com/your-lastpass-vault/), but if you cancel, it still can use the old data from a previous fetch. I´m speculating a bit on this part, but makes sense. They could refuse the usage of the data after the 2nd factor fail locally, but that also would break offline usage and would not protect the data from an attacker that already has the master password and access to the encrypted data.

6
  • 1
    LastPass should not be caching passwords. That would be a vulnerability. – Neil Smithline Jan 8 '16 at 15:07
  • I mean the encrypted password database. This one is cached for offline usage. Editing to make it clearer. – CristianTM Jan 8 '16 at 15:08
  • 1
    The answer would be stronger if you added a link to the doc for offline backup. I think this is a good possibility, BTW. – Neil Smithline Jan 8 '16 at 15:18
  • Added links to the information that I gave :) – CristianTM Jan 8 '16 at 15:20
  • I can find an option to clear my local cache, but not to do so automatically on logout. Hmm! – fredley Jan 8 '16 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.