How do I use the LastPass Authenticator for MFA?

How do I use the LastPass Authenticator for MFA?

LastPass Authenticator is a “multi-factor” authentication application for Android, iOS, and Windows mobile devices.

Multi-factor authentication (aka “MFA”) is the process of requiring more than just a password to authenticate to a web site, service or application.  There are three “factors” of authentication:

1. Something you know (generally a password/passphrase)
2. Something you have (generally a TOTP – see below)
3. Something you are (biometrics, like your fingerprint, face-shape, iris pattern, retina pattern, etc)

“TOTP” is short for time-based one-time password.  It means a code (normally 6 digits) that changes frequently (eg every 60 seconds) which only you and the authenticating server (eg web site) know.  You generally share the “seed” for the pattern that creates those codes by scanning a “QR” code (those funny squares with lots of tiny black and white squares inside them).

There are lots of examples of TOTP applications, including Google Authenticator.  LastPass Authenticator is an optional alternative to Google Authenticator, but they do essentially the same thing and support the same web sites and services.

The purpose of using LastPass Authenticator is to store the MFA TOTPs that other third-party web sites and services might require you to record in order to (multi-factor) authenticate to them.

LastPass Authenticator gives you three ways to see and use your TOTP code:

• Simply reading and typing the code into the relevant web site or service
• One-tap push notifications (you just hit the big green “allow” or “approve” tick in your LastPass Authenticator application when prompted, assuming you were trying to log into a web site or service at the time!)
• SMS 6-digit codes.  This is not a recommended option as SMS is an inherently insecure way to send messages.

Note: Feature availability may vary depending on your account type.

Setting up and configuring your account

1. Log in to LastPass and access your Vault.
2. Select Account Settings in the left navigation.
3. Click on the Multifactor Options
4. Click the Edit icon for the LastPass Authenticator.
5. For the “Enabled” option, select Yes from the drop-down menu.
6. For the “Permit Offline Access” option, use the drop-down menu to choose from the following:
   1. Select Allow if you wish to allow access to LastPass even when you are offline. This will store an encrypted Vault locally so you can log in without using Multifactor Authentication in case of a connectivity issue.
   2. Select Disallow to prevent offline access, which requires the use of Multifactor Authentication and to be connected to the internet when using LastPass.
      Note: If this option is selected and you are not connected to the internet and/or https://lastpass.com is not available, you will be unable to access your Vault. 
7. When finished, click Update.
   • 
8. Enter your Master Password, then click Continue.
9. When prompted, click Enrol.
10. When a new web browser window or tab appears, click Set up mobile app, then proceed to the next steps.

Setting up the LastPass Authenticator app on your mobile device

1. Install the LastPass Authenticator on your mobile device for iOS or Android, which is supported on Android OS 4.0.3 (Ice Cream Sandwich) or later.
2. On your web browser window, click Next to proceed with the enrolment, then open the LastPass Authenticator app on your mobile device.
   • 
3. If you have already used LastPass on your phone for a different account or application, tap Add new account. Otherwise, do the following:
   1. Tap the Add icon on the bottom of your device screen.
   2. Tap Scan Barcode.
   3. Using your mobile device’s camera, scan the barcode displayed on your web browser window.
4. From your computer, click Set up text message.
5. Enter your mobile phone number and click Next.
6. A text message is sent to your mobile device containing a verification code. Enter the code into your web browser, then click Finish text setup.
7. Click Activate, then click Done.
8. In your Vault, click OK on the confirmation messages.
   • 

Using the LastPass Authenticator

1. Open the LastPass Authenticator app on your mobile device.
2. On your desktop web browser or using the LastPass mobile app, log into LastPass.
3. You can verify your login in the following ways:

• On your mobile device, tap Approve in the Mobile Authenticator app to verify your login, which automatically logs you in to your LastPass account on your web browser. If desired, check the box to enable the option, “Trust this device for 30 days” and provide a device name, then click Authenticate. 
• On your web browser, enter the 6-digit code displayed in the mobile app. If desired, check the box to enable the option, “Trust this computer for 30 days” and provide a computer name, then click Authenticate. 
• On your web browser, click Send SMS passcodes to have an SMS message containing a verification code sent to your mobile device. Once received, enter the code in your web browser,
  • It is possible to check the box to enable the option “Trust this computer for 30 days” and provide a computer name.  For best security, we recommend against using that option.
• Then click Authenticate.
  •