4 ms·

LastPass doesn't support U2F at all. They only support the Yubikeys in the less-secure one-time-password mode.

• lrvick 8y ago
  Lastpass 2FA is just used for account management and sync anyway. It has no role in the secret crypto. If your attacker phishes the master password your synced passwords are all compromised.
  • bskap 8y ago
    Wouldn't they also need access to a device that already synced your passwords? That essentially switches your computer to be the second factor, albeit one that's more easily compromised with malware. And if they already have malware on your computer, you're probably hosed anyway since the passwords have to be decrypted at some point. If all they managed to do was trick me into entering my master password on a dummy login page, the sort of phish that U2F is designed to protect against, U2F would still keep me protected while OTP wouldn't.