Hacker News Reader

Comment by redwards510 | Hacker News Reader

If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password. BeEF can pop up a LastPass phishing prompt if you just happen to load the wrong javascript file.

Using just one string of characters to protect ALL of your passwords is insane.

View on HN

If you got a keyloggers on your machine, you are already fucked, and 2FA won't help you. The keyloggers can simply steal your passwords straight from the browser when LastPass fills them in.

> If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password...

Though even with 2FA, couldn't a sophisticated keylogger grab your password database after you've authenticated and downloaded it?

> If you are using LastPass without 2FA

There is no 2FA with LastPass.

Don't believe me? Set up a LastPass account and turn on 2FA. Go log in on an untrusted browser. Enter your password. At the 2FA prompt screen, there is a giant red "If you lost your Google Authenticator device, click here to disable Google Authenticator authentication" link.

That's right. They give the attacker the option to disable 2FA for your account.

They send you an email and only with the link in the email can you login. Email is the second factor here.

Reply on news.ycombinator.com