3 ms·
If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about ke
by redwards510 11y ago
If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password. BeEF can pop up a LastPass phishing prompt if you just happen to load the wrong javascript file.
Using just one string of characters to protect ALL of your passwords is insane.
- gherkin0 11y ago> If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password... Though even with 2FA, couldn't a sophisticated keylogger grab your password database after you've authenticated and downloaded it?
- ja27 11y ago> If you are using LastPass without 2FA There is no 2FA with LastPass. Don't believe me? Set up a LastPass account and turn on 2FA. Go log in on an untrusted browser. Enter your password. At the 2FA prompt screen, there is a giant red "If you lost your Google Authenticator device, click here to disable Google Authenticator authentication" link. That's right. They give the attacker the option to disable 2FA for your account.
- indianburger 11y agoThey send you an email and only with the link in the email can you login. Email is the second factor here.
- imaginenore 11y agoIf you got a keyloggers on your machine, you are already fucked, and 2FA won't help you. The keyloggers can simply steal your passwords straight from the browser when LastPass fills them in.