Security Incident March 2023 Update & Actions - LastPass This database was encrypted, but the separately-stored decryption key was included in the secrets stolen by the threat actor during the second incident.” “Backup of LastPass MFA/Federation Database – contained copies of LastPass Authenticator seeds, telephone numbers used for the MFA backup option (if enabled), as well as a split knowledge component (the K2 “key”) used for LastPass federation (if enabled). Im at least more skeptical of anything incoming now. Well, prep for the possibility of social engineering with somebody knowing a lot about you. If that wasn’t bad enough, it also includes the phone number you used for the MFA backup option. So now they don’t need your device to use MFA on your accounts.

You take the seed and the current timestamp and can calculate the code. The service then stores that seed and uses it to compare your code.

This is what the QR codes are actually representing when you add MFA.

Was just reading over the LastPass official communication again, and they did confirm that if you used LastPass Authenticator, your seeds were stolen AND the decryption key for those seeds.Ī seed is often a single word such as “butter” or “sand” or “stupid”.

Last pass qr code