4 ms·
The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well." Does anyon
by xur17 10y ago
The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well."
Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.
- johnl1479 10y agoLikely in the sense that the attacker cannot login into your account using the stolen credentials, as the second factor would not be in their possession.
- xur17 10y agoThe article links to lastpass multifactor [0] though. I agree that having multifactor enabled on the site the credentials were stolen for would block this attack. [0] https://helpdesk.lastpass.com/multifactor-authentication-options/ https://helpdesk.lastpass.com/multifactor-authentication-opt...
- johnl1479 10y agoHm, you are right. I am not sure how LP multi-factor auth would prevent this.
- tyleraldrich 10y agoI assume it's because LastPass sends you the multi factor auth request before accessing your passwords (and therefore before allowing the autofill js stuff to use your password). I don't actually use LastPass so I'm not 100% sure, but this would be the most likely case imo
- xur17 10y agoThey only send the multi factor auth request when you first login to your account in the browser (and then every 30 days). Once you are logged in, autofilling works exactly the same.
- bj0 10y ago> I assume it's because LastPass sends you the multi factor auth request before accessing your passwords This would seem like a logical assumption, but I have found that it works differently (at least on the firefox plugin). If I have auto-fill enabled, the password for a site I am looking at is filled in before the MFA prompt pops up. I can even ignore the MFA pop-up and click login and get into the website.