News for hackers. Stuff that matters.

A comment on On Password Managers. Parent comment

Re:On Password Managers by ihattendorf on Thursday July 20, 2017 @03:33PM (#14815602)
This isn't a bug, this is due to the offline access option. If your machine has the database locally cached, 2FA won't do anything because your database won't be encrypted with 2FA (not possible), just your master password. An attacker could just copy the cached database and decrypt it with your master password. All 2FA does is restrict who can download your database (both initial and updates), not decrypt it. If you don't like this behavior, disable offline mode.

This is just fear mongering.

[ Parent | on HN ]
Re:On Password Managers by BugsJustFindMe on Friday July 21, 2017 @12:51AM (#14818140)
> This isn't a bug

Boo hoo. Did I say it's a bug? I said it's a security issue. It's also an exceptionally stupid thing to have as standard behavior without warning. It demonstrates poor priorities and ideas about safety on the part of LastPass.

[ Parent | on HN ]