The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user vaults were taken and later state as fact they were not taken in that same statement from Monday. The value of two-factor authentication appears to only protect normal online client access to the users' vault via their master password.

My question is: if they are mistaken about the user vaults not being taken then does the two-factor protection not become completely irrelevant?


2 Answers 2


As LastPass is a proprietary service, giving definitive answers about it can be difficult. I can say that I have seen no documentation that 2-factor authentication (2FA) would protect you from a side door attack where your data is stolen from the server. That said, 2FA does provide added security against an attack via the API.

So, it seems to me that the statement about 2FA is meant to reassure the public and encourage more secure practices rather than provide a strategy to protect against similar LastPass attacks.


Yes, if the encrypted vault is stolen from the server, the 2FA doesn't help. However if your master password is strong, the hacker would not be able decrypt the vault as it will be encrypted by your master password.

2FA is is useful when the user's master password is stolen (or weak). In that case 2FA would stop the attacker from downloading the encrypted vault. Also, according to Lastpass official statement, the hashes of master password were stolen, not the encrypted vault. In that case, 2FA adds additional security since if the hacker is able to brute hash to get master password, he still can't login to download the encrypted vault.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .