Multifactor trust broken

What do you love about LastPass? What do you hate about it? Tell us why you like it, why you don't, and why.

Moderators: admin, anatoly_LP, chantieLP, robyn, JoeSiegrist

Multifactor trust broken

Postby OneWheel » Sun Feb 03, 2019 7:23 am

I use YubiKey multifactor authentication. When challenged I select the option to trust for 30 days and I also have "Skip 30 day expiration for trusted clients" option enabled in my advanced settings. This works fine most of the time, with the occasional blip where I must re-trust my already trusted PC, I assume this might be because my ISP has allocated me a new dynamic IP address. However just recently I have started recieving multiple prompts to trust my PC. I use my YubiKey and all apperads well for a few seconds then I seem I am still logged out, I then get challenged again and it seems to be successful second time. Then I close my browser and reopen only to be challenged again! I have multiple Firefox profiles and as a result get challenged for each plus all the other browsers I use. This is becoming realy frustrating.

On top of this my wife had to go through the same process on or single PC yesterday. The YubiKey authentication was accepted and she was able to access her vault. Then later she recieved an email say access had been blocked and she must verify by clicking the link. The email listed my PC IP address, for which the YubiKey authentication had been accepted and my wife was successfully accessing her vault.

What is going on? Are we alone in these frustrations? It is making me lose faith in LastPass and raises doubts about the integrity of their product and safety of my credentials.

I just want to be able to say this PC is trusted, I do it once an asIP does not chnage I can then sign in using any browser/profile without being repeatidly challenged. Is this so hard?
OneWheel
 
Posts: 4
Joined: Mon Aug 08, 2016 2:57 am

Re: Multifactor trust broken

Postby OneWheel » Sun Feb 03, 2019 7:29 am

p.s. I also have "Show My LastPass Vault After Login" unchecked but LastPass hjas now taken to ignoring this and loading my vault post login in the current tab. Forcing me to use the back button to return to the original page which sometimes fails as the site does not support such navigation :-(
OneWheel
 
Posts: 4
Joined: Mon Aug 08, 2016 2:57 am

Re: Multifactor trust broken

Postby afh » Mon Feb 04, 2019 7:40 pm

Same Here. Super annoying! It just started happening to me at work today. Was there a recent update? I sent a report request to them an hour or so ago. I have tried their recommended solutions, but they don't work.
afh
 
Posts: 2
Joined: Sat Dec 01, 2018 9:34 pm

Re: Multifactor trust broken

Postby jonat » Mon Feb 04, 2019 8:37 pm

I have a similar issue - in Chrome (but not Firefox). I've had a lengthy exchange with LP Support about it, but none of the suggestions (nuke everything and reinstall, new profile, etc.) fix the problem. Worse, I also have Duo Security enabled as a second factor and, in the past, I would always get the Duo prompt rather than Yubikey, unless there was no network. Not anymore. Oddly, when I first (re)install LP I get the Duo prompt, but after that it's always Yubikey.

This is new behavior within the past week.

At least I don't get the "access blocked" message.
jonat
 
Posts: 2177
Joined: Thu Dec 09, 2010 8:42 pm

Re: Multifactor trust broken

Postby OneWheel » Tue Feb 05, 2019 4:07 am

For me Chrome is fine, I am only having this issue with Firefox. I have now added all my Firefox profiles as new people in Chrome and using that exclusively for my browsing. Lastpass seems to behaving as expected in Chrome but this is not the solution I am looking for, I prefer Firefox and would like Lastpass to operate consistently in all major browser so I am free to choose the browser which most suits me.
OneWheel
 
Posts: 4
Joined: Mon Aug 08, 2016 2:57 am

Re: Multifactor trust broken

Postby jonat » Tue Feb 05, 2019 11:55 am

I even tried completely uninstalling Chrome, then reinstalling. No luck. If I disable Yubikey, leaving Duo enabled, that seems to work but is obviously an unacceptable workaround. Support finally agreed to escalate my problem report to "Level 3".
jonat
 
Posts: 2177
Joined: Thu Dec 09, 2010 8:42 pm

Re: Multifactor trust broken

Postby aboutToChangePasswordManagers » Tue Feb 05, 2019 11:01 pm

This is the worst software I've ever used. It's just garbage. Do you have a QA team? I can't believe I feel like I'm locked into this absolute shit, and I hate it.
aboutToChangePasswordManagers
 
Posts: 2
Joined: Thu Aug 17, 2017 7:55 pm

Re: Multifactor trust broken

Postby smcneece » Wed Feb 06, 2019 10:07 am

Same issue here, latest Firefox, all three systems I work on keep asking for my Yubikey. Hey lastpass perhaps use some of our doubled subscription prices to hire a QA team.
smcneece
 
Posts: 5
Joined: Fri Aug 19, 2011 9:35 pm

Re: Multifactor trust broken

Postby jonat » Wed Feb 06, 2019 2:15 pm

I suspect that the January 31 update is responsible for breaking this. Frustratingly, my support conversation keeps getting responses from different support techs who don't read the whole thread, so I get lots of useless "try this..." replies. My observation above that disabling Yubikey allows "remember this computer" (assuming you have another second factor, which I do) suggests that the bug is specific to Yubikey support.
jonat
 
Posts: 2177
Joined: Thu Dec 09, 2010 8:42 pm

Re: Multifactor trust broken

Postby jonat » Thu Feb 07, 2019 12:35 pm

FWIW, my support ticket on this is #9445221.
jonat
 
Posts: 2177
Joined: Thu Dec 09, 2010 8:42 pm

Next

Return to Feedback

Who is online

Users browsing this forum: No registered users and 15 guests