0

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened several times to me, it weites something like xcvcvc....457 and sends.

My yubikey is, as far as I know, a 2FA on LastPass, so it cannot be used to log in by itself alone (how do I verify that?).

Anyways, suppose someone has my lastpass password and access to an old authentication token that I sent previously accidentally, but that I re-logged with a newer on on LastPass. Will this person be able to log in to my account? In other words, are these like a rolling code where the old ones get invalidated?

What if I have 3 yubikeys setted up in my LastPass as 2FA, and I accidentally send a code from yubikey 1, but log with yubikey 3? Will this invalidate yubikey 1's accidental token?

Improve this question

1 Answer 1

Reset to default
2

The older Yubi-key/FIDO tokens contain 3 fields: The Key ID, the Sequence #, & the actual OTP. Lastpass is supposed to remember the most recent Sequence # seen from each key & ignore any attempts to use OTPs from an earlier part of the sequence. Merely editing the old string to show a later sequence number would invalidate the OTP, so that's not an issue.

The answer to the question in your last paragraph is that only a later use of Key 1 in FIDO mode will invalidate the OTP you'd sent in error.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .