Richard
Security issues
After setting up two-factor authentication, I found that RoboForm asked me to authenticate when I logged in to the web site but allowed me to log into the browser extension and access my passwords without authenticating. Although I reported this security issue, RoboForm did not address the problem in their response. In addition, the company didn't update me on their progress in addressing other problems that I reported and apparently are still "investigating" one of the problems nearly one year on.
Response from RoboFormApr 4, 2019
Hello Richard, thank you for reaching out. As far as 2FA, once you enable Google Authenticator, it will not prompt you for the OTP on any device that is currently authorized. Any device/client/browser that is *not* already authorized will prompt the OTP however. Without knowing more specifics, this would explain the behavior you describe. RoboForm will not de-authorize a device without explicit user direction or a time-out policy. At https://online.roboform.com/login under My Settings you can de-authorize any/all of your existing sessions if this is a concern. As far as your other issues (and if there are additional account specific aspects of your 2FA concern), I would love to be of more assistance. Alas, the only info we have to go on is your first name. Please feel free to email me at [email protected] with your account email so we can take a closer look.




