4 ms·
There is an account recovery mechanism available to those with a LastPass extension that is or was logged in to the account in question. Dropbox is the same way
by superuser2 11y ago
There is an account recovery mechanism available to those with a LastPass extension that is or was logged in to the account in question. Dropbox is the same way - if you forget your Dropbox password you can use your logged-in copy to get an authenticated session and change your password.
It will be news if there's an account recovery mechanism that can be exploited by a total stranger without access to your copy of Chrome/FF.
You would expect that 2FA could be bypassed for the locally cached password database, since AFAIK there is no such thing as requiring an OTP to decrypt the ciphertext that you have, only to prove to a server that you know the TOTP secret.
Lastpass discloses that you can turn off 2FA for new logins by proving ownership of an email address. You can set a separate email address for this purpose, and I believe also turn it off.