Daily Login
Windows Passwordless Login
Configured and Tested
Primary Login
- Enter LastPass email address.
- Insert or leave YK-03 Nano connected.
- Enter security-key PIN if requested.
- Touch the YubiKey.
Alternative Login Methods
- LastPass Authenticator
- Microsoft Authenticator
- Master Password
Notes
YK-03 Nano is the dedicated LastPass passwordless key and normally remains connected to the primary Windows PC.
iPhone Login
Configured
Primary Login
- Face ID
Vault Unlock
- Face ID
Fallback
- Master Password
Notes
Face ID account recovery is enabled.
The iPhone is currently a trusted device.
Testing confirmed that entering the master password on the trusted iPhone did not require an additional YubiKey prompt.
Authentication
Configured
Primary Authentication
- Passwordless using YK-03 Nano (FIDO2)
Alternative Authentication
- LastPass Authenticator
- Microsoft Authenticator
- Master Password
Master Credential
- Master Password changed to a new Diceware-based passphrase.
- The passphrase meets the LastPass complexity requirements.
- A printed recovery copy is stored securely offline.
- The passphrase is also being learned for independent recall.
Confirmed Behaviour
- LastPass currently supports only one registered FIDO2 security key.
- Registering a new FIDO2 key replaces the previous registered key.
Account Recovery
Configured
Authentication methods allow normal login. Recovery methods regain access if authentication or the master password cannot be used.
Recovery Methods
- Printed Master Password
- Recovery One-Time Password (OTP)
- Face ID account recovery
Optional
- SMS Account Recovery
Configuration
- Master Password changed successfully.
- Printed recovery copy created and stored securely offline.
- Recovery One-Time Password generated and stored securely offline.
Recommendation: SMS Account Recovery is not recommended for normal operation because of SIM swap risk. Only enable it if an additional recovery method is specifically required.
Emergency Access
Not Configured
Purpose
Emergency Access allows another trusted LastPass user to request access to the vault after a configurable waiting period. The owner is notified immediately and may reject the request before the waiting period expires.
Recommended Use
- Estate planning.
- Spouse or executor.
- Business continuity.
Notes
Emergency Access is separate from authentication and account recovery.
Hardware
| Key | Model | LastPass Role | Status |
|---|---|---|---|
| YK-01 | YubiKey 5C NFC | Not assigned | Available |
| YK-02 | YubiKey 5C NFC | Not assigned | Available |
| YK-03 | YubiKey 5C Nano | Windows Passwordless Key | Registered and Tested |
YK-03 is dedicated to LastPass. YK-01 and YK-02 remain available for services that support multiple FIDO2 security keys such as Microsoft, GitHub, Google, Proton and Cloudflare.
Configuration Guide
Configure Security Key
- Connect YK-03.
- Open Windows Settings.
- Accounts → Sign-in Options.
- Security Key → Manage.
- Create or change the FIDO2 PIN.
Configure LastPass Authenticator
- Install LastPass Authenticator on iPhone.
- Open LastPass Account Settings.
- Multifactor Options.
- Configure LastPass Authenticator.
- Pair the iPhone.
- Confirm authentication notifications work.
Configure Passwordless
- Open Passwordless Options.
- Configure Windows Passwordless.
- Select USB Security Key.
- Register YK-03.
- Configure LastPass Authenticator as the backup authentication method.
- Activate.
Generate Recovery OTP
- Open Advanced Options.
- Manage One-Time Passwords.
- Generate Recovery One-Time Password.
- Store securely offline.
Validation
- Windows Passwordless works.
- LastPass Authenticator works.
- Microsoft Authenticator works.
- Face ID works.
- Master Password works.
- Recovery One-Time Password stored safely.
Review
- Decide whether SMS Account Recovery should remain enabled.
- Configure Emergency Access.
- Periodically test YK-03 and both authenticator applications.
- Replace the Recovery One-Time Password immediately if it is ever used.