News for hackers. Stuff that matters.

A comment on Ask HN: How did my LastPass master password get leaked?. Parent comment

Re:Ask HN: How did my LastPass master password get leaked? by mastazi on Monday December 27, 2021 @06:31PM (#29708278)
- Disable Lastpass MFA and use Google Authenticator (Authy)

could you please explain this point? Isn't LastPass Authenticator equivalent to Google Authenticator, Authy or any other TOTP app? Or is there something that makes it less secure than other apps? Perhaps because it has cloud backups?

[ Parent | on HN ]
Re:Ask HN: How did my LastPass master password get leaked? by trajcek on Monday December 27, 2021 @06:34PM (#29708300)
Honestly after the scare it just seemed stupid that I chose LastPass' own MFA for my LastPass account. Also if they really did get exploited, no idea what it means for their MFA solution.
[ Parent | on HN ]
Re:Ask HN: How did my LastPass master password get leaked? by stjohnswarts on Monday December 27, 2021 @07:50PM (#29708932)
When you do authy (or google auth) it will generate a new set of keys for you and shutdown any old ones associated with the lastpass stuff thus making the old keys useless. Also obviously he should change his master password to a new one.
[ Parent | on HN ]
Re:Ask HN: How did my LastPass master password get leaked? by mastazi on Monday December 27, 2021 @11:41PM (#29710488)
> When you do authy (or google auth) it will generate a new set of keys for you and shutdown any old ones

wouldn't it be the same if you were going the other way around? E.g. switching from Authy to Lastpass Authenticator

[ Parent | on HN ]
Re:Ask HN: How did my LastPass master password get leaked? by macrolime on Tuesday December 28, 2021 @05:43AM (#29712344)
Lastpass MFA is not at all like Google Authenticator. The codes in Lastpass Authenticator are optional and can be bypassed. It's not secure at all.
[ Parent | on HN ]
Re:Ask HN: How did my LastPass master password get leaked? by mastazi on Tuesday December 28, 2021 @04:02PM (#29718133)
> are optional and can be bypassed.

How so? Are you saying that if I sign up for example to Dropbox and use Lastpass Authenticator for the 2FA, there is a way for me to log into Dropbox without retrieving the code from LastPass Authenticator? How would that work?

[ Parent | on HN ]