LastPass users get TOR blocking security feature

And ability to restrict IP address to named country

LastPass has added two new security features to its popular online password management system; access via TOR (The Onion Router) has been disabled and users can now limit logins to specific countries.

Premium users of the system can already enable two-factor authentication (or limit access to specific computers) as well as increase SHA-256 iterations to confuse brute-forcing of passwords but the company hopes that outlawing access via the anonymising TOR system will cut off another avenue of attack.

"Because TOR has been associated with hackers who employ it to stay anonymous, and since the majority of LastPass users don't have a reason to use TOR, you can now disallow logins from TOR. We recommend checking this option if you never use TOR," the company announced.

Users can add another security layer by limiting the IP addresses from which a login attempt can be made to a home country, for instance the US. This can be adjusted to add other countries from a check list while travelling.

When it comes to the password problems experienced by many sites in recent months, LastPass can at least say it was slightly ahead of the game; in 2011 the company alerted its users after suffering what it believed was an attack on the systems holding the master passwords for a portion of its user base.

For most companies this would be serious enough but LastPass is a password repository. The passwords were carefully encrypted and the exact nature of the attack was probably less severe than first thought (the company later said) but a compromise of such a system could be potentially devastating.

Given the obvious risk to users with less complex passwords, LastPass later advised users to change their master password. Many of the security developments seen since then stem from the huge risk that compromise posed to the company's business.

"If you're not using multifactor authentication, we highly recommend looking into the available options. There are both free and Premium multifactor authentication options that help you better protect your stored data by requiring that a second piece of data be submitted when logging in to your account," LastPass has recommended.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Brand Page

Stories by John E Dunn

Latest Videos

More videos

Blog Posts