That’s not bad protection, but Google’s on-device prompt strategy (we’ll cover this later) was even better, blocking 99 percent of bulk phishing attacks, and 90 percent of targeted attacks. The trio found that SMS authentication blocked 96 percent of bulk phishing attacks, and 76 percent of targeted attacks trying to crack into your Google account. In May 2019, Google announced a one-year study it did in partnership with New York University and the University of California, San Diego. That said, SMS authentication is still far better than nothing. If you decide to get your 2FA codes via SMS, for example, the code could potentially be intercepted by hackers, as researchers for Positive Technologies demonstrated in 2017. So it's really not useful, you'll need to copy the password to your clipboard - not really ideal.2FA isn’t foolproof, however. Now, if you want a solution that actually uses the YubiKey for encryption and decryption, you'll have to use something more advanced (without online features) like Keepassium, but as their FAQ says, you cannot use a YubiKey for autofill at all unless you cache the decryption key - which is basically what FaceID does. It is in fact 2FA since your device itself is one factor and your face another. But your biometrics are actually used to 'unlock' (i.e., decrypt) the encryption keys stored in the Keychain in phones (Secure Enclave in Apple, StrongBox in Android and TPM in PCs). In the case of Yubico OTP based 2FA, the LastPass server just verifies the OTP, and does not use it for encryption. The way most YubiKeys are set up, it is not easy to encrypt and sync passwords with a YubiKey. Such inconvenience makes it tedious and therefore less secure (e.g., like how people use sticky notes for passwords when annoying polices like expiring passwords are implemented). It does not make sense to have 2FA every time you unlock your vault, it will get annoying very soon and even then the apps you log in to will save your login information until you manually log out. It exists to prevent people from downloading and decrypting your vault with just your email and master password and it does a pretty decent job at preventing that.

It doesn't require the yubikey at all any more so anyone who has access to my phone could get into the app and access my vault.ĢFA is for login only on password managers.

Lastpass yubikey setup