LastPass users get TOR blocking security feature

LastPass has added two new security features to its popular online password management system; access via TOR (The Onion Router) has been disabled and users can now limit logins to specific countries.

Premium users of the system can already enable two-factor authentication (or limit access to specific computers) as well as increase SHA-256 iterations to confuse brute-forcing of passwords but the company hopes that outlawing access via the anonymising TOR system will cut off another avenue of attack.

“Because TOR has been associated with hackers who employ it to stay anonymous, and since the majority of LastPass users don’t have a reason to use TOR, you can now disallow logins from TOR. We recommend checking this option if you never use TOR,” the company announced.

Users can add another security layer by limiting the IP addresses from which a login attempt can be made to a home country, for instance the US. This can be adjusted to add other countries from a check list while travelling.

When it comes to the password problems experienced by many sites in recent months, LastPass can at least say it was slightly ahead of the game; in 2011 the company alerted its users after suffering what it believed was an attack on the systems holding the master passwords for a portion of its user base.

For most companies this would be serious enough but LastPass is a password repository. The passwords were carefully encrypted and the exact nature of the attack was probably less severe than first thought (the company later said) but a compromise of such a system could be potentially devastating.

Given the obvious risk to users with less complex passwords, LastPass later advised users to change their master password. Many of the security developments seen since then stem from the huge risk that compromise posed to the company’s business.

“If you’re not using multifactor authentication, we highly recommend looking into the available options. There are both free and Premium multifactor authentication options that help you better protect your stored data by requiring that a second piece of data be submitted when logging in to your account,” LastPass has recommended.