3 ms·
LastPass teaches Sony how to handle a data breach
When LastPass, the popular and respected online password vault, saw an anomaly in its network traffic, it jumped. When it couldn't ascertain why there was slightly more output than input, it issued an alert for users to change their master passwords. It also installed better security measures like PBKDF2 and SHA-256.
The notification happened in less than a day and its fast tracking the crypto roll outs.
So Sony (and Epsilon), what's your defence now?
- lvh 15y agoWait. Why are they repeating SHA-256 10N times? What's the point? (I know about key derivation and why you want it to be slow. I'm wondering why they're doing that, when the article already mentions PBKDF2. Why it's PBKDF2 and not scrypt or bcrypt is probably about buzzword compliance.)
- derobert 15y agoRepeating a SHA-256 (or other hash) many times is essentially what PBKDF2 is. Though since 100 million SHA-256/sec is apparently doable on GPUs, even with 100,000 rounds, you currently need at least an 8-character random password to be secure from someone attacking without much budget.
- lvh 15y agoYes, I know -- the question stands: why would you have both of these concurrently in the same system? Either you want a KDF, or you don't want a KDF -- pick one, and don't start reinventing your own (potentially poorly), please :-(
- CodeMage 15y agoPlease don't editorialize in your submission title. What LastPass did is in no way related to Sony. The article's last paragraph only mentions Sony and Epsilon as examples of lax disclosure efforts.