91–93 of 93 posts
Earlier quoted context omitted.
How can you set LastPass to globally disable auto-fill and auto-login? I checked again and I couldn't find any options in the extension or vault settings.
Using the Chrome extension, auto-fill is under Prefereces > General > and auto-login is under Preferences > Advanced.
Earlier quoted context omitted.
Hence why they said: "send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain."
Then you disable autofill. Problem solved.
I am actually a LP user, but I would prefer it was more secure by default.
Earlier quoted context omitted.
I am curious, is there a way to do OTPs with offline databases? I tried poking around with the add-in, but couldn't quite determine whether the implementation could properly protect from replay attacks, most notably whether a copy of the xml file used and the matching old OTP would be enough to unlock a newer database file.
It's impossible to use OTP as part of an encryption key without some sort of oracle that could do the decryption without the OTP.
In theory you could guarantee the OTP going forward, but it would be impossible to protect going backward, which kind of kills the whole point.