2

I am new to LastPass and I was shocked when I realised that, once I logged in to LastPass browser extension, I could open my vault and view all the passwords even after I had exited my browser and reopened it.

How is this even safe? Is there any way to let LastPass ask for verification before openning my vault or viewing any passwords? If it is not possible, is it advisable to switch to Google Password Manager or similar?

  • This is explained in their documentation along with the settings to do what you ask. – schroeder May 17 '19 at 8:32
2

The Lastpass options available differ quite remarkably between the browser extensions and the website.

To require the master password for every site password view:

  • Login to your account on the website (https://lastpass.com)
  • Click "Account Settings"
  • Open the advanced settings (Button at the bottom of the popover)
  • Look for the section "Warnings", then choose your liking among "Master Password Re-Entry"

I agree that this process unnecessarily convoluted and cumbersome.

Personally, I rarely ever need to actually see a password. I let Lastpass fill out the credentials for me and this works very well on most sites.

However, I suggest you use a second factor like TOTP (wit Google's Authenticator for example) for account login.

| improve this answer | |
2

You need to edit your Lastpass preferences. In Firefox, if I click on the icon for the Lastpass extension and go to Preferences, I can check "Automatically Log out when all browsers are closed", and/or "Automatically Log out after idle (mins)". You can also enable the password reprompt as suggested by other answers.

It's up to you what level of security vs. convenience tradeoff you want to make. The default of staying logged in probably assumes you are on a private computer which will be locked by the OS when you're away from the computer, but that assumption obviously isn't safe in all circumstances.

| improve this answer | |
  • Good point about the trade-offs. You can always lock your computer when you get up. Might be annoying, but it is a good habit to be in. – Jess Mar 15 at 18:15
  • This is the best answer. I set it to log out automatically after 1 minute of inactivity. – Jess Mar 15 at 18:52
0

You can always instruct LastPass to prompt you for password before showing you the password.

  1. Enter edit password page
  2. click on the "advanced settings" at the bottom
  3. check the "require password reprompt" box
  4. save it

You now need to enter your vault password every time you want to know the stored password.

The caveat is that LastPass doesn't offer a vault-wide settings for password repormpt, so you need to set each item manually.

As suggested by @Marcel that there is a vault wide setting under Account Settings > General > Show Advanced Settings, you can instruct LastPass to reprompt vault password for accessing certain item type/action.

| improve this answer | |
  • There is a option to enforce password re-entry in the options on the website. I agree that lastpass's options are very convoluted though. – Marcel May 17 '19 at 5:56
  • Yeah, I just discovered it. – Hartman May 17 '19 at 18:19
0

I think a lot of people don't understand the problem.

The LastPass broswer extension allows you to access the entire vault without entering a master password! The only option is the then lock your computer if you get up in a public space.

I just logged into lastpass.com which looks identical to the browser extension, but it does require you to enter the master password.

Sorry, maybe this is a dumb solution, but you can always ditch the browser extension and use the Windows/Mac desktop application instead. Unfortunately, it is not free

"Please note that the desktop application is not available to LastPass Free account users."

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.