A number of LastPass users have reported struggling to access their accounts due to security upgrades from the company.

The issues began in May 2023, when the password manager announced some upcoming changes and warned users that they would have to log back into their accounts and reset their multi-factor authentication (MFA).

However, many users have reported being locked out of their accounts even after resetting their codes on their authenticator apps, such as Google Authenticator or even LastPass’ very own.

Lock-out

To make matters worse, affected users can’t even access LastPass support, since this requires logging in too. Instead, they are prompted to reset their authentication app over and over in the client, as the system fails to recognize the new codes users have set up as instructed. 

As expected, users have been taking to Twitter and the LastPass community forum to vent their frustrations. 

LastPass said that in-app messages and emails were sent out notifying customers to reset their MFA well in advance of the actual announcement to the security upgrades.

The company has since clarified what the security upgrades actually entail. It has now strengthened its Password-Based Key Derivation Function (PBKDF2), an algorithm “that makes it difficult for a computer to check that any 1 password is the correct master password during a compromising attack.”

The default minimum number of passwords iterations post-upgrade is now 600,000. In order to carry out this upgrade, LastPass says it was necessary to log users out of their accounts and require them to reset their MFA.

“You must log in to the LastPass website in your browser and re-enroll your MFA application before you can access LastPass on your mobile device again. You cannot re-enroll using the LastPass browser extension or the LastPass Password Manager app,” it further added.

LastPass was previously featured on our list of the best password manager solutions, but since users’ vaults were stolen via a series of breaches at the company, we took the decision to remove it. 

The vaults were encrypted, and there was no indication that the threat actors managed to crack them – only if they managed to guess your master password could they gain access. However, other personal data that were stolen from customers, such as contact and billing information, were not encrypted.  

Go to Source

Follow us on FacebookTwitter and InstagramWe are growing. Join our 6,000+ followers and us.

At TechRookies.com will strive to help turn Tech Rookies into Pros!

Want more articles click Here!

Deals on Homepage!

M1 Finance is a highly recommended brokerage start investing today here!

WeBull. LIMITED TIME OFFER: Get 3 free stocks valued up to $6300 by opening & funding a #Webull brokerage account! “>Get started >Thanks for visiting!

Subscribe to our newsletters. Here! On the homepage

Tech Rookies Music Here!

Disclaimer: I get commissions for purchases made through links in this post at no charge to you and thanks for supporting Tech Rookies.

Disclosure: Links contain affiliates. When you buy through one of our links we will receive a commission. This is at no cost to you. Thank you for supporting Teachrookies.com

Disclaimer: This article is for information purposes and should not be considered professional investment advice. It contains some forward-looking statements that should not be taken as indicators of future performance. Every investor has a different risk profile and goals. All investments have risks. Always do your own research or hire an expert before investing and trading.