nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Passwords visible without further authentication in Edge extension

noidea

Hi all, I've been looking for a password manager and decided to give LastPass a go. I'm using Edge so I installed the Edge extension and logged in. However, when I'm logged in, all my passwords in the vault are openly accessible and can be displayed without any further authentication. I think this is bad because whoever is using my computer at that moment can browse (see) all my stored passwords. In both browsers I've ever used to save passwords (Chrome and Edge), there is an extraauthentication required when you want to display a stored password. Am I missing something?

Find more posts tagged with

Accepted answers

formermember

You can do this on a password-by-password basis or globally,

For a global solution, in your account settings you can specify that the master password must be re-entered to perform certain actions. See this:

https://support.logmeininc.com/lastpass?articleID=1194872421

For each individual password, check the "Require Master Password Reprompt" checkbox in the password edit screen:

8330i2320C2CE82D06A94

All comments

formermember

You can do this on a password-by-password basis or globally,

For a global solution, in your account settings you can specify that the master password must be re-entered to perform certain actions. See this:

https://support.logmeininc.com/lastpass?articleID=1194872421

For each individual password, check the "Require Master Password Reprompt" checkbox in the password edit screen:

8330i2320C2CE82D06A94

noidea

Thank you for the quick response!

I managed to achieve what I wanted by setting LastPass to require master password for accessing a site. Setting this only for sites' passwords broke autofill on my iPad (Safari). Besides, it didn't protect the passwords from being shared anyway.

Anyway, I still think this is not very well thought-out. Both iOS and Android applications use automatic locking, so when you want to access the vault, you need to provide some authentication to unlock them. Why doesn't the browser extension use the same mechanism where you can stay logged in but if you want to access the vault, you need to re-enter master password?Setting this for particular parts of the vault is a workaround which I think doesn't provide the same level of security (what about all the other stuff which can be in the vault?) or comfort (the current settings are account-wide, so they apply also to mobile apps where I don't need to protect passwords because the vault itself is protected).

noidea

After some more experimenting and thinking, it seems to me that what I wrote in my previous comment makes less sense than I thought. 🙂 The vault is either accessible or not, no matter if it is autofill or anything else which wants to read it. So in order to make the extension work the same as the mobile apps, I would have to make it log out after some time. That is possible but quite inconvenient, as I would have to log back in when using autofill (the same way I have to provide fingerprint scan in the mobile apps).