3 ms·
I'm not too worried because anything important that I have in LP is protected by 2fa. It's notable that the author says his accounts are protected by 2fa, but I
by Sakos 4y ago
I'm not too worried because anything important that I have in LP is protected by 2fa. It's notable that the author says his accounts are protected by 2fa, but I don't understand how LP being hacked would allow an attacker to defeat that.
- mmmmkay 4y agohe said his seed phrases were in lastpass. There is no 2fa protection for private keys if the assets are in his crypto wallet and he's custodying them.
- Sakos 4y agoRight, should've remembered reading that. Am I the only one who thinks that's a crazy thing to put in LP?
- k_roy 4y agoKind of? I can see it both ways. It is putting all your eggs in one basket. The flip side is your vault is supposed to be protected enough that shouldn't be an issue.
- Sakos 4y agoAnother comment rightfully points out that the vault itself is only protected by a password. I don't think that's protected enough if it's on cloud storage.
- scott00 4y agoHe said there wasn't much value in the wallets. Doesn't strike me as crazy to keep a small amount in something convenient. You see a similar convenience/security trade off made by big players, with immediate transactional needs satisfied by online/hot wallets and reserves held in offline/cold wallets.
- Sakos 4y agoThat's true.
- mdaniel 4y agoJust for your consideration, I'd bet good money that the 2FA only protects against login credential stuffing, but the vault data is only protected by your master password and can be attacked offline and indefinitely
- Sakos 4y agoI mean the individual accounts are protected by 2fa. I have an account or two where I know the password has been leaked but they're so unimportant that I can't be bothered to change the passwords. They still can't get in without my approval.