Last Pass password manager gets two new security options

I have used LastPass for quite some time before I made the switch to the KeePass password manager. While I have not regretted that move, I know of several users who are using LastPass for all their password management needs.

LastPass supports a wide variety of features that make it more than a replacement for the built-in password manager of the web browser. This includes a secure password generator, note taking, access from web browsers and the LastPass website, browser synchronization and automatic form filling.

The premium version adds mobile client support and multifactor authentication to the client usingYubikeys or USB thumb drives.

Two new security features have been added to LastPass accounts yesterday that improve the security further.  Both features are available in the account settings dialog which you can open from the LastPass vault.

The first security feature restricts the LastPass login to countries that you select in the settings dialog.  Once you have made your selection here, and most LastPass users without doubt will only select their home country, log ins are only permitted if the IP address resolves to a location in that country.

If someone else steals the login and tries to log in from another country that log in will not be permitted even if the login credentials are correct. While there are options to bypass that limitation, for instance with the help of a VPN service, it may block a percentage of attackers from investigating the error message or trying to get into the account. You do however need to make sure to change the country selection before you travel to another country if you want to use LastPass there. This can be a temporary addition for a business trip, or a permanent one if you move to that country.

The second feature disables log ins from the Tor network. It is obviously not a good idea to block logins from the Tor network if you use it yourself. If you never use it however, you can block it to prevent hackers from using it when they try to access your account.