7 Ways to Make Your LastPass Account Even More Secure

So you know you should be using strong passwords to protect your online accounts. And you ran the LastPass Security Challenge to help you keep improving your passwords. But did you know there are even more security features in LastPass that can help you better protect your account and the data you store in it? Check out these seven security features, and challenge yourself to enable at least one today:

1. Lock Down Your Account with Multifactor Authentication

Multifactor authentication, or two-factor authentication, requires that a second piece of information be entered before allowing access to your account. This essentially creates another barrier to entry if someone’s trying to gain unauthorized access to your account.

LastPass supports 10 multifactor authentication options, so choose the one that works best for your workflow and enable it in your LastPass Settings in your vault. If you have a smartphone, we recommend checking out Duo Security, Toopher, or Google Authenticator. For LastPass Premium users, we recommend checking out the YubiKey.

2. Restrict Access to A Specific Country

Lock down your account by only allowing access from a specific country or countries. For example, if you only ever login from the US, then you would restrict access to the US. Open the “Settings” menu in your LastPass vault to adjust your restrictions. If you plan to travel, just be sure to add any new countries before you leave, and remove them when you return!

3. Logoff Automatically When You’re No Longer Browsing

Keep your LastPass account safe from prying eyes by setting it to logoff automatically. In the LastPass browser extension icon, you can launch the Preferences menu to enable the autologoff options. You can set LastPass to logoff automatically after a set period of time when the browser is either closed or goes idle.

4. Reprompt for the Master Password

LastPass can also prompt you for your master password when you take specific actions (viewing a password, editing secure notes, etc) or when you’re launching specific websites (such as banking or billing logins). The password prompts help protect your account from prying eyes, should someone start browsing while you’re still logged in to LastPass. Turn these prompts on in the LastPass Settings menu from your vault, or edit a specific login in your vault to reprompt on a site-by-site basis.

5. Monitor Account Activity with Security Notifications

LastPass can alert you to certain actions taken within your account, which can help you confirm changes you made as well as identify any unauthorized access to your data. In the Settings menu in your vault, go to the “Security” tab to manage your email preferences, where you can enable the alerts for master password changes, email address changes, site login username or password changes, and more.

6. Keep LastPass Activity Hidden with a Secret Email Address

Rather than have LastPass send critical account notifications to your primary email address, you can set up a secondary, secret email address that is only used as a security email for LastPass.

Once you add this email address in your Settings under the “Security” tab, this means that any sensitive notifications, such as those for account recovery or disabling multifactor authentication, will be sent to the security email address rather than your primary email address. So even if someone gets access to your primary email address, they won’t be able to login to LastPass if you’ve locked it down with a strong master password, multifactor authentication, and an obscure security email address.

7. Combat Keylogging with One Time Passwords

If you know you’ll be traveling or using an untrusted computer, like that in a library, hotel, or even at a friend’s, use a “throwaway” password to login to your account. The throwaway password, or one time password, works exactly like it sounds – the password that’s generated for you can only be used to login to your account once.

Generate the throwaway passwords by clicking the menu at the top right of your vault and launching the one time passwords page. You can generate as many as you need and print off the list to be carried with you. When you login at www.LastPass.com you can choose the One Time Password login option, and type in one of the OTPs. This protects you from keylogging by allowing you to bypass entering your master password with the secure one time password.

28 Comments

  • Anonymous says:

    #7 One-time passwords has a major deficiency and is, in my view, too unsafe the way Lastpass implement it. They should do it the way Fastmail.fm do – that is, allow the user to generate the one-time password list but to specify a prefix and a suffix character string that is not printed, but that the user must add to the printed one-time password to make up the full password. This is very simple and would render the possession of the one-time password list useless to an unauthorised person.
    I have suggested this to Lastpass in the past but it seems they are tone deaf. And I don’t see any evidence that Lastpass are reading this thread, so I’m probably wasting my time again.

  • amin says:

    why you wont add add lastpass extension to google chrome!?
    google Chrome accept extensions now!
    im a premium user and want to use it in my chrome!
    most people dont use safari!