Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies. The LastPass community is already very security-conscious, but it’s always helpful to review general best practices for online security and ensure you’re following them: Reducing Your Personal Risk Starts with Good Cyber Hygiene At LastPass, investigating and responding to security reports – and customer concerns in general – is our highest priority and we strive to always improve our internal processes. We’ve identified and resolved the procedural issue to ensure future reports are handled correctly. Because this report did not come through our bug bounty program, proper steps were not taken to escalate and resolve it in a timely manner. In addition to strengthening the app, the report highlighted needed improvements to our support process.

In summary, Android users should update their LastPass Authenticator to the latest version. If you’ve recently had a phone lost or stolen and need to re-enable multi-factor authentication, follow our recommended steps. At no time did the identified workaround allow access to the TOTP secrets used to generate the one-time codes. Using the reported workaround to access someone’s temporary codes would have been difficult since it requires access to the device, and the one-time codes are useless without the username and password for the services they are used. Now when the fingerprint/PIN feature is enabled, users must provide their fingerprint or PIN code in order to view the one-time code. When a researcher discovered a workaround for the extra the PIN/fingerprint prompt, our engineering team fixed the issue that allowed the workaround and the update is available now. LastPass Authenticator is one of the only multi-factor authentication apps to offer this extra protection on iOS and Android.

The LastPass Authenticator App gives users the option to require a fingerprint and/or PIN to open the app, offering an extra level of security if you were to lose your phone while it was unlocked. The app received attention this week for allowing someone to view the TOTP (multi-factor) codes on Android without requiring a fingerprint or PIN. We wanted to let the LastPass community know about a recent improvement to our LastPass Authenticator app.

Lastpass totp