TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Bypassing LastPass’s “Advanced” YubiKey MFA: A MITM Phishing Attack

3 pointsby CtrlAltT5wpmalmost 5 years ago

1 comment

CtrlAltT5wpmalmost 5 years ago
This point, mentioned in the article, bears repeating, especially if you aren&#x27;t familiar with Lastpass or their 2FA:<p>Lastpass uses Yubico&#x27;s one-time password, which is more similar to TOTP than it is to FIDO&#x27;s U2F (which Yubico had a hand in). Lastpass has had this for YEARS, long before U2F was even a thing, or before Lastpass was bought by LogMeIn.<p>10 years or so ago (back when I was a paying user of LP), the Yubico OTP was a really nifty bit of security, and probably state-of-the-art, at least to a user like me. Now, not so much. I don&#x27;t know if this feature has a future, or if there are any plans to phase it out, since U2F is more secure. I&#x27;m not sure if there are really any existing applications for it, but this isn&#x27;t my field of expertise; there might be something novel that can be done.<p>What I DO know is that users of Lastpass have been asking for U2F as an option for several years now, with no real movement on LP&#x27;s part. If a one man outfit like Bitwarden, or a famously reticent company like 1Password, can implement U2F, Lastpass has no excuse (to be fair, 1Password&#x27;s reluctance to implement a second factor was understandable when they didn&#x27;t have a cloud component in their software).<p>Unfortunately, the only thing that will likely move LP is if Yubico announces they&#x27;re dropping the OTP feature entirely.