Is LastPass' locally stored One-Time-Password recovery a security problem?

Question

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled.

The procedure is described here:

• http://helpdesk.lastpass.com/account-recovery/

It goes along these lines:

1. Go to the account recovery page.
2. Enter the e-mail address you use as login to LastPass
3. You now receive an e-mail with instructions on how to proceed, and a locally stored One-Time-Password has been enabled.
4. Using this password you should be able to restore access to your password database without using your master password. (I don't know how this works, but maybe LastPass has a 2nd copy of your password database encrypted using this OTP in addition to the database encrypted using the master password.)

But as many people have their mail program setup to the mail account they use as login to LastPass doesn't this mean that if somebody gets access to your machine and manage to login then they can:

• Enable the locally stored OTP using the recovery link.
• Read the instructions sent to you by e-mail because the also have access to your local email program.
• Gain full access to your entire password database.

And they can do so without knowing your master password?

Is there something I have misunderstood?

Answer 1

I have actually tried to use account recovery with LastPass just to test this on Mar 5 2014. Lastpass sends you a link good for 48 hours via the email account associated with Lastpass. You need to access this link from a browser with a Lastpass plugin installed. If this plugin was used to access the lastpass account with the email address used for the account recovery, and if One Time Password was enabled, you will be taken to your vault and offered the chance to change your master password. HOWEVER, if you don't change your master password, you will still be left in your lastpass vault, with your various logins visible. You cannot export them without knowing the master password, but you can look at (edit) the various individual logins. Thus someone could take for example your bank login information without ever changing your master password. You might never know this has happened. This presumes that someone has access to your email account, for example, if you left it open on your computer when you stepped away.

I think turning off One Time Password is a very good idea. And the One Time Password in advanced options in the plugin, is PER MACHINE. So any other browsers you use, or portable versions, or if you ever logged into lastpass from someone's computer using their browser and plugin.

I think LastPass should probably disable One Time Password by default, even though some users would probably forget their master password and lose access to their password vault. Lastpass should at least make the One Time Password account wide, not per machine. So you don't have to remember every machine you ever logged from.

Answer 2

There are several way to implement such functionality, but basically yes all represent significant security risks, especially since they posses your password database too.

LastPass might offer some emergency contact information for disabling this feature if your machine got stolen. You could avoid using LastPass for any passwords that provide financial or deeper identifying information as well.

There are several open source password database programs like KeePass and KeePassX that store your entire password database locally.

Answer 3

I do view the local OTP as a security risk, however, there is an option to disable it in the browser extensions (at least for firefox and chrome). I always disable local OTP on each browser after installing the lastpass extension, which means, of course that I will loose my vault if I forget my master password. I think it would be more secure if lastpass had the local OTP disabled by default. I guess they had to make some trade-off between security and user dissatisfaction when they forget their password.