Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me.
Almost never actually fills in my passwords (often have to click copy password), often thinks I am on a different website than I am, or just gives me an empty white box when I click the LastPass button.
They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.
Their approach is somewhat unique though. Once you log into any Apple device with a secure enclave (including all current macbooks, iphones, and ipads) that device becomes a second factor for authenticating future logins (which is prompted via an OS-level popup instead of a separate app or hardware dongle). So your computer itself can be the second factor which means you don't ever notice the 2FA enforcement, unlike most other systems that use a TOTP code or dongle.
What do you mean? They still have browser extensions for all major browsers.
1. https://chrome.google.com/webstore/detail/lastpass-free-pass...
I use Firefox and the LastPass extension without needing to use the Mac app.