Recently a login credential was shared with me by another admin to a system we both need access to. Once I logged in I noticed this system offered the option to add a TOTP code generator rather than email OTP codes. I generated the secret key, pasted it into the LastPass record for this system, copied the generated code, and pasted it into the system. The code generator was linked.
Problem is I didn't realize that I was not given edit access to this LastPass record, it was shared with me as "View Only". Should I have realized that sooner? Absolutely!
Also though, should LastPass allow me to click the edit button, paste a secret key, and begin generating codes under a password record I don't have edit access to? Absolutely not.
Getting it sorted out afterwards was a bit of a pain, this would have been much easier if LastPass did not allow you to paste in a TOTP secret key or better yet gray out the edit button for password records you don't have permission to edit.
