3

In this article about increasing the security of LastPass the author suggests:

For additional security, you can have LastPass send security-related emails to a special security email address instead of your normal email address. For example, password hint emails, account recovery emails, and multi-factor authentication disable emails will all be sent here.

This email should be an extra-secure email address only you know about – if someone gains access to your day-to-day email account, they won’t be able to access your LastPass vault without access to your security email account.

Is this good advice or is it just an unnecessary complication having another e-mail address? Is the idea that an e-mail address not frequently used would appear in fewer databases and is therefore less likely to be (randomly) hacked?

This article focuses on LastPass, but would such an e-mail account be good for other things such as receiving password resets for other e-mail accounts?

Improve this question
2
  • I have an account over at thexyz.com and what I really useful is the unlimited aliases that allow me to never input my real email address unless I wish to.
    – user47266
    May 25, 2014 at 14:10
  • 1
    One thing I would be concerned about with this approach is "notification" e-mails. For example, you would probably not check this e-mail account often, but if a site tells you that someone has tried to hack in (e.g. too many password guesses), you might not see it there until you happen to check your "security" e-mail site (which probably wouldn't be nearly as frequent as your personal e-mail).
    – Jonathan
    Nov 28, 2014 at 16:47

2 Answers 2

Reset to default
3

It is not a bad idea, but the key point here is not just having a separate e-mail but to enforce compartimentalisation of access. Here's a scenario:

  • you have your regular e-mail on @gmail
  • you have your "secure" e-mail on @hotmail (oh well..)
  • you check both e-mail from the same web browser
  • that browser is not up to date, or you stumble upon a 0-day vulnerability that compromises your system and end up with some malware installed on your machine

Surely an attacker cannot access your secure e-mail remotely; they just have to wait until you check it from your insecure browser, and capture the keyboard, or take screenshots, or what not.

As you are aware, there's no silver bullet in computer security; it's a matter of risk analysis and deciding what level of protection you want.

For example, you could (in increasing order of security/paranoia):

  • open the secure e-mail from a different web browser (making sure it's up to date)
  • ...or from a different machine (physically separated)
  • ...or limit your 'insecure' web browsing to a VM

Further alternatives include toying with virtualisation (think Qbes OS), etc.

Improve this answer
1

I think the idea is that you have a completely separate email only for this. As with access to this email account you could get access to all of your passwords, you would want to limit the exposure of this email to LastPass only.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .