LastPass users get TOR blocking security feature
- — 02 August, 2012 13:07
- ( 2 Comments )
LastPass has added two new security features to its popular online password management system; access via TOR (The Onion Router) has been disabled and users can now limit logins to specific countries.
Premium users of the system can already enable two-factor authentication (or limit access to specific computers) as well as increase SHA-256 iterations to confuse brute-forcing of passwords but the company hopes that outlawing access via the anonymising TOR system will cut off another avenue of attack.
"Because TOR has been associated with hackers who employ it to stay anonymous, and since the majority of LastPass users don't have a reason to use TOR, you can now disallow logins from TOR. We recommend checking this option if you never use TOR," the company announced.
Users can add another security layer by limiting the IP addresses from which a login attempt can be made to a home country, for instance the US. This can be adjusted to add other countries from a check list while travelling.
When it comes to the password problems experienced by many sites in recent months, LastPass can at least say it was slightly ahead of the game; in 2011 the company alerted its users after suffering what it believed was an attack on the systems holding the master passwords for a portion of its user base.
For most companies this would be serious enough but LastPass is a password repository. The passwords were carefully encrypted and the exact nature of the attack was probably less severe than first thought (the company later said) but a compromise of such a system could be potentially devastating.
Given the obvious risk to users with less complex passwords, LastPass later advised users to change their master password. Many of the security developments seen since then stem from the huge risk that compromise posed to the company's business.
"If you're not using multifactor authentication, we highly recommend looking into the available options. There are both free and Premium multifactor authentication options that help you better protect your stored data by requiring that a second piece of data be submitted when logging in to your account," LastPass has recommended.
Get exclusive access to CSO, invitation only events, reports & analysis. 
Comments
Ben Mylan
1
Interesting when a password manager has a security breach I don't think I'd trust my data with this company.
Charles Wale
2
Ben, the company did not suffer a security breach.
They though they had, jumped the gun a little and warned everybody. When they found out that they hadn't been breached, they then informed everyone again, but that bit does not get the publicity.
In my mind, the fact that they were transparent when they thought they had a breach is a positive move for a company that is storing passwords. They have shown that they will warn you when they have something in their logs that they cannot explain. This is a positive thing!