HELP FILE

Should I be concerned about reports that my master password can be stolen?

    LastPass always has security as top of mind.

    We offer the following tips and clarifications:

    • Strong antivirus software and multifactor authentication are the best line of defense against an on-path attacker. LastPass Teams and LastPass Business account admins can enforce the use of multifactor authentication through LastPass security policies.
    • We strongly warn that you should not enable the "Remember Email" option. Enabling this significantly reduces your security to your LastPass account. LastPass business account admins can use a security policy that prevents the "Remember my password" option from being checked, rendering the entire possibility of the vulnerability null and void.
    • LastPass is built with AES256+CBC with PBKDF2 rounds that are adjustable per user in Account Settings.
      Note: The recommended and default number of password iterations rounds is 100100.
    • LastPass Teams and LastPass Business admins can enforce a particular limit of iterations via security policy.
    • If your computer is infected by a virus that can't be detected by antivirus software, there are other significant problems that you will need to address.