2

I am using LastPass together with a YubiKey Neo. If someone got ahold of my master password (e.g. keylogger), and a copy of my encrypted password vault, would they be able to decrypt it? Or does the YubiKey setup add another layer to that encryption?

3

With LastPass, YubiKey is only used for authentication purposes to be able to download your vault and/or login to your LastPass account on their servers. YubiKey is not however used for encryption purposes, so the use of 2FA with LastPass (or YubiKey) does not influence the encryption of the vault. It just makes it harder to potentially compromise your account by logging in as you, so 2FA should be enabled as a best practice.

The LastPass database itself is encrypted locally using AES-256 with your master password as a factor to generate a PBKDF2-SHA256 hashed key. That key, stored locally (not your master password) with symmetric AES-256 encryption is your master password. But, essentially, your master password is this key and could be used to decrypt files locally -- so if someone copies your local lastpass vault and has the master password, regardless of YubiKey, it could be compromised.

References:

https://lastpass.com/support.php?cmd=showfaq&id=6926 https://lastpass.com/whylastpass_technology.php

1

Two factor authentication with Last Pass is only applicable to logging into the service or operation within the application itself. If somebody has a copy of your encrypted database, then only the password itself is relevant.

Yubikey's proprietary "touch to authenticate with a string of characters" method uses a key id and incrementing counter which is not useful for encrypting data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.