No email from LastPass. Dealing with sign in problems.
Hi everyone, Leo Notenboom here for askleo.com. Ask Leo is supported in large part by my patrons,
of which I'm very, very thankful. If you are interested in supporting, Ask Leo and getting
access to patron content visit askleo.com/patron. Thanks. I was on a trip recently and while
I was on that trip something kind of scary, to be honest, happened with LastPass.
But it turns out not only was it not really as scary as the first reaction
might have you believe. But LastPass was doing everything right, it was my fault
for overlooking something that I tell you guys about all the time. On the first night on a trip
out of town. I was in my hotel and I fired up my laptop and I needed to log into LastPass.
Which is fine. I have LastPass set so that it isn't automatically logged in when I open
up that laptop because it's a portable device. I take it with me when I'm traveling. I don't
want a thief to have access to my LastPass vault by default. So what I did is I went to log in.
Except that when I did, I got a message from LastPass that it had sent email to me that I
needed to confirm I was who I said I was. LastPass evidently noticed that I was in a
different location, which is one of the things that definitely factors in 2 security from any
online service. When they you see you logging in from a different location, they need to take
extra steps, perhaps to make sure that it really is you and not someone else who happens to have
stolen your account credentials. Great extra security is a good thing. I do appreciate wanting
to keep my account secure. I want it to be kept secure. Here's the problem. I never got the email.
The email never arrived that evening. I basically had no access to that LastPass vault.
It took me a few minutes. As you can imagine, that's kind of…. What do I do? Well, here's
what I do, and in fact I realized that this was never ever going to be a disaster of any sort.
I got the immediate problem solved because I had LastPass on my phone
and it was logged in and logged in properly. So for the immediate problem, the sites that
I was attempting to log into, that required an entry from my LastPass vault, I simply
carefully, slowly transcribed the password from my phone to my keyboard and I logged in.
That allowed me to get on with what I needed to get done that evening.
The other thing I realized, of course, is that I have backups. I backup my LastPass vault
in plaintext once a month or thereabouts. And in fact it was a couple of weeks prior
to my trip that I had taken my last backup of my LastPass vault. So if in fact for whatever reason,
I would never lose access to the vault. I have my backups, I have all of the entries in that vault.
If I don't, let's say I haven't been backing up or for whatever
reason I didn't have access to my backups. I still have password recovery on all of these
accounts that I have entered into my LastPass database. If I don't have the database that I
don't have the backups, all I need to do is a password recovery on the accounts I need
to gain access to and I'm back in again, it's not a problem. It's an inconvenience,
don't get me wrong, but it's not a problem. So that evening I managed just fine by using my phone
to get the passwords I needed to log in to get what I needed to get done, done. And I slept fine
knowing that I had all of these alternatives. Even if I couldn't log into LastPass for the duration
of my trip. Now. The good news is, of course that I was able to get back into my account.
What I ended up doing was mentioning on Twitter, of all things, to LastPass. I tagged LastPass in
a couple of tweets that said, hey, you know this is kind of troublesome. I should be able
to log into my account. I'm happy to respond to an email, but I have to get the email.
What's the deal? They responded. They responded in an interesting way and you can see here on
the screen, I screen captured their response on Twitter, but the bottom line was that yes, they
did send email to the verification email address. I had long ago apparently set up an alternate
email address with LastPass and it was that email address, not my primary one that LastPass
was sending this verification request to. And sure enough, when I went to log into that other account
that I obviously don't log into very often, there they were.
There were the verification requests that came from LastPass.
That made total sense. I had simply forgotten that I had set up this security
alternate email address associated with my LastPass account.
Now LastPass could honestly have done an ever so slightly better job. They could have indicated
that the message was being sent to this alternate email address, or even if they didn't want to say
that explicitly, it would have been good for them to include. I'll just say a clue that it might not
go to the primary address. With that clue, I would have known to have looked at all of my other email
addresses because I don't delete email addresses. The email address that I've been using for this
it's a 25 year old email address. I've had it since before I left Microsoft.
Great, I just needed to remember that. Oh yeah, it was being used for this
and LastPass was going to send its recovery email to that email address.
Once I was able to set this up and respond appropriately to the email verification,
that was done. Obviously, once I got the email from LastPass on this alternate email account,
I was able to log in just fine and everything was back to normal. I have made one change since.
Doing that, the email address that I was using for this purpose, it's an
email address. Like I said, I've had forever and I probably will never ever give it up,
but it's not an email address I tend to use for this kind of thing, so I've actually switched the
alternate email address I now have associated with LastPass to an email address that I use
specifically for that purpose to an email address that goes to a completely different service.
And to an email address that actually notifies me on my phone whenever email arrives. So I would
have gotten notification that an email message had arrived unexpectedly on this other account had I
had this set up beforehand. I want to be clear.
Everything worked, everything worked the way it was supposed to work. The piece that failed
was me. I neglected to remember that I had set up an alternative email address with LastPass.
I neglected to check that email account for any incoming messages during this time.
That's on me. Yeah, they could have hinted at that. Maybe I should check alternate email
addresses, but ultimately it's still all on me. LastPass did everything right. They properly kept
my account secure by requiring me to make an extra step when I logged in from an unfamiliar location.
That's good security. This is not an indictment of password vaults. If anything,
it's just the opposite. LastPass clearly is invested in keeping your vaults secure. That's
what most people are afraid of when they start using a LastPass or any other password vault.
Clearly they keep it secure and I really appreciate that. The other thing though,
is that as I said earlier, even if I lose access to my LastPass vault completely, which was
never going to happen, this was not that scenario. I have backups which I can use. So of course I
encourage you to back up your password vault. Whatever password vault you happen to be using,
back it up in plaintext so that you're not tied to any specific format.
And then of course, secure that backup in some appropriate way, but
backing up your vault is one of the most important things you can do to protect yourself from the
worst from losing access to your password vault, and of course, even without backups I always had
account recovery on each of the individual accounts that I really needed access to.
Yep, that would have been a pain again. In my case it was never on the table because I had
the backups, but it would have been a pain. But that's all it is. It is not a disaster.
It is simply varying degrees of inconvenience. So that's what happened to me.
Remember your alternate email addresses. Make sure to keep them up to date. The real problem
here would have been had I set an alternate email address years ago that I no longer had access to.
This is one of the reasons that I keep my email addresses pretty much forever, and one
of the things that I see happening a lot is that people will set up an alternate email address,
forget about it, lose it, and then lose access to something like an email account or something
else that is a little bit more significant than simply losing access to your own password vault.
Hope that was helpful. Hope that was instructive. If you have
comments or questions or would like related links on this article, visit askleo.com/135181.
I'm, Leo Notenboom this is askleo.com.