3 ms·
LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there". Let's assume one's master pa
by idatum 4y ago
LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there".
Let's assume one's master password is strong. And that LastPass knows how to encrypt data. We're really down to whether 256-bit AES can be brute forced, right? And I guess understanding phishing attacks.
I mean, yes, wouldn't it be great of LastPass took the measures with its development environment years ago? So put another way: Lack of operational excellence hopefully is made for in strong encryption. I hope.
- WhatsName 4y agocontains both unencrypted data, such as website URLs, No I think this is the worst that could have happened short of loosing the clear-text passwords. Noone is going to stop the attackers from looking for high-value login URLs and than spear-phish the password for the offline vault. Forcing a password reset onto customers is not going to help LastPass here.
- eastbound 4y ago> LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there". This is why a company’s bug bounty should be the sum of the assets protected by the data they have, for all their customers, minus $1. Sounds crazy? Don’t store all passwords at the same place.
- cogman10 4y agoUnfortunately, if you like me have been a LP customer for years you are hosed. Early on, they only did 500 rounds of AES which significantly weakens you even with a strong password. So, I've had to change my master password and now I'm in the process of updating all my passwords :( By not forcing a re-encryption when they uped the number of rounds, LP has hung all their old time customers out to dry with this leak. It's not ok.