LastPass Account Recovery on Mobile - beta

pakos

Dear LastPass users,

As you all know, LastPass takes away the burden of remembering passwords – and getting locked out of your accounts. But what if you forget your LastPass Master Password? That’s the one password you still need to remember, and as a direct result of our Zero Knowledge security model, resetting it is not as easy as on an ordinary website.

Enter Account Recovery on Mobile. Available on [url=https://testflight.apple.com/join/fy7LvHVA:1v1jlurz]iOS Testflight[/url:1v1jlurz] and the [url=https://play.google.com/store/apps/details?id=com.lastpass.lpandroid&hl=en_US:1v1jlurz]Android Beta[/url:1v1jlurz] channels, users who have downloaded and logged into the LastPass iOS/Android beta apps can recover their accounts very easily.

Try this new feature out, and give us feedback! Note: at this time, we only recommend testing this feature with two-factor authentication disabled.

1 - Enable Mobile Account Recovery in the Security menu

2 - Log out and press “Forgot Password” on the login screen

3 - Enter your email and press “Recover Account”

4 - Confirm your fingerprint and then enter your new master password. That’s it!

5 - Now log in with your new master password

Download the iOS version via Testflight: https://testflight.apple.com/join/fy7LvHVA
Get the Android app by navigating to the Play Store page and opting in into the beta program: https://play.google.com/store/apps/deta ... d&hl=en_US

Any questions or feedback? Drop us a note here on the forums.
The LastPass mobile team

mike808137

Please, please tell us that someone thought about this from a security perspective and that the following are TRUE:

• Any mobile device that is NOT using the "(All)" identity (i.e. has a RESTRICTED ACCESS role) is UNABLE to change the "Mobile Account Recovery" and enable this feature. i.e. A device cannot ELEVATE its privilege from an existing non-privileged role (restricted access), which is what any identity other than "(All)" is.
• Any mobile device that is NOT using the "(All)" identity (i.e. has a RESTRICTED ACCESS role) is UNABLE to authorize a "Recover Account" action based on a fingerprint authentication. The fingerprint authentication only means the user is allowed to USE the device. Not control your LastPass MasterPassword!

Please confirm this huge security flaw doesn't exist in this new feature.

Phone users (allowed by fingerprint) are NOT the same as LastPass account administrators (allowed to reset the Master Password).