Thousands of LastPass users have been locked out of their accounts - here’s what to do if you’re affected
New security upgrades are causing big problems for many LastPass users
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A number ofLastPassusers have reported struggling to access their accounts due to security upgrades from the company.
The issues began in May 2023, when thepassword managerannounced some upcoming changes andwarned usersthat they would have to log back into their accounts and reset their multi-factor authentication (MFA).
However, many users have reported being locked out of their accounts even after resetting their codes on theirauthenticator apps, such asGoogleAuthenticator or even LastPass' very own.
Lock-out
To make matters worse, affected users can’t even access LastPass support, since this requires logging in too. Instead, they are prompted to reset their authentication app over and over in the client, as the system fails to recognize the new codes users have set up as instructed.
What is 2FA and MFA?>Why MFA isn’t enough to protect you>Hackers are stealing browser cookies to glide past MFA
As expected, users have been taking toTwitterand theLastPass community forumto vent their frustrations.
LastPass said that in-app messages and emails were sent out notifying customers to reset their MFA well in advance of the actual announcement to the security upgrades.
The company has sinceclarifiedwhat the security upgrades actually entail. It has now strengthened its Password-Based Key Derivation Function (PBKDF2), an algorithm “that makes it difficult for a computer to check that any 1 password is the correct master password during a compromising attack.”
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The default minimum number of passwords iterations post-upgrade is now 600,000. In order to carry out this upgrade, LastPass says it was necessary to log users out of their accounts and require them to reset their MFA.
“You must log in to the LastPass website in your browser and re-enroll your MFA application before you can access LastPass on your mobile device again. You cannot re-enroll using the LastPass browser extension or the LastPass Password Manager app,” it furtheradded.
LastPass was previously featured on our list of the best password manager solutions, but sinceusers' vaults were stolenvia a series of breaches at the company, we took the decision to remove it.
The vaults were encrypted, and there was no indication that the threat actors managed to crack them - only if they managed to guess your master password could they gain access. However, other personal data that were stolen from customers, such as contact and billing information, were not encrypted.
Lewis Maddison is a Reviews Writer for TechRadar. He previously worked as a Staff Writer for our business section, TechRadar Pro, where he had experience with productivity-enhancing hardware, ranging from keyboards to standing desks. His area of expertise lies in computer peripherals and audio hardware, having spent over a decade exploring the murky depths of both PC building and music production. He also revels in picking up on the finest details and niggles that ultimately make a big difference to the user experience.
Nokia confirms data breach leaked third-party code, but its data is safe
Best CDN provider of 2024
Audio-Technica AT-LP70XBT vs Victrola Hi-Res Onyx: which is the best Bluetooth turntable?
