LastPass security breach linked to $35 million stolen in crypto heists
www.theverge.com
Researchers found that almost every victim was a LastPass user.

More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists

  • Rootiest@lemm.eeEnglish
    1·
    2 years ago

    Yeah this.

    Having a backup/recovery for the YubiKey is really just another potential security hole.

    Ideally you have a backup clone of the key in case yours is lost/broken.

    Keeping a recovery seed or backup password instead would be inherently less secure as the YubiKey uses an HMAC challenge-response key rather than a static password/key file.

    A static password or key would be a better target for hackers as it would be easier to crack so having that option would lower your overall security.