5 ms·

Umm, not sure you understand. Yes AES256 is good, if you have a great password. However if you take 1M users, as them to set a 12 character password with A-Z,

by sliken 4y ago

Umm, not sure you understand. Yes AES256 is good, if you have a great password. However if you take 1M users, as them to set a 12 character password with A-Z, a-z, and at least one digit you'll find an astounding lack of entropy. I believe this is pretty close to LastPass's master password requirements. If you take the most popular 1M passwords and attack the master password you'll find that you've cracked them. With a 2 generation old GPU and the default iterations of 5000 (like several people mention on this post) you can try 300,000 passwords a second. So 3+ seconds per vault and you'd crack a decent fraction of them.

jart 4y ago
(26+10)**12 is 4738381338321616896 combinations. 300,000 attempts per second isn't going to have an easy time cracking that, so I don't see what the problem is with LastPass' requirements.
- mint2 4y ago
  “(26+10)*12” is irrelevant Please Refer back to “If you take the most popular 1M passwords and attack the master password…”
  - jart 4y ago
    It is relevant, because it's where LastPass' responsibility ends. It's not their job to prevent people from being stupid and choosing a password like `lovelovel0ve` but rather to define a requirement that allows for sufficient complexity.
    - rsj_hn 4y ago
      I think a reasonable feature for a password manager would be to do NIST recommended checks, such as comparing passwords to databases of known compromised passwords and alerting/recommending rotation or rejection of the password if a match is found (depending on password entry UI). Obviously you're not going to get a complete db of known hacks, but a db of most common X million passwords, updated every 6 months or so, is pretty good, and is what I would expect a good password manager to do. LastPass is in the bad situation of needing to provide excellent security in a product that people really aren't willing to pay a lot of money for. Some of the websites that ask for passwords are in a better position to do this, but then you don't get the benefits of a password manager. Same issue for the the other password managers out there.
- sliken 4y ago
  Yes, those with pure random passwords are safe. What percent of LastPass users do you think use a very hard to remember completely random 12+ character password? Personally I use either VaultWardens random password generator, or some variation of the XKCD like 4-6 words out of 100,000 which give me somewhere north of 64-96 bits of entropy. Cracking that @ 300k/sec takes a quite long time. I like the XKCD approach, because it's particularly voice/phone friendly. However much more common in the real world is to pick an easy to remember password with low entropy, something like PinkFloydRocks, which fail because of lack of a number and change it to P1nkFloydRocks. Or maybe PinkFloydRocks<2 digit birth year>. Quite a few plaintext passwords have been leaked, some even with helpful popularity tables. I'd place bets that a decent percent of LastPass's vaults would fall to a top 10,000 12 character or longer popular passwords. I suspect someone is testing this right now.
  - jart 4y ago
    I had a feeling you were speaking from experience with that 300k number. Does that include the cost of password stretching? As others have pointed out in this thread LastPass uses PBKDF2 with 100,000 rounds. Even if you have a supercharged PC with 6x ATI Radeon HD 5870 you're only going to be able to derive 25k AES keys per second tops to even try, since that doesn't include the cost of deciphering. So how do you do it?
    - sliken 4y ago
      No experience, just saw a post on someone attacking LastPass Vaults. It looked to include everything. Apparently they wrote a tool specifically attempting password recovery on LastPass vaults and with a RTX 2070 (2 generation old) managed 309,000 against the 5000 iteration flavor and 15,500 against the 100,100 flavor. More info at: https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant-unlock-of-the-password-vault/ https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant...
FatActor 4y ago
First, where do I find the most popular one million 12-character passwords that use A-Z/a-z/0-9? Second, the top 1M of 6/7/8 character passwords have a statistically higher probably of being the correct password than the top 1M of 62^12 because their distribution function as a percentage of possible instances is narrower. Put another way: the top 7 char password might be used 10 million times, and the 2nd most popular might be 9million, etc. With a 12 char password, the top 1 by nature appears much less frequency because the total possible space is larger and people have to think a little more. Entropy when that has nothing to do with inverse distributions. Put another way, look at the frequency of the top-1 password as a sum of all instances of all 1M passwords. It is much larger % for smaller passwords than larger. It is much less likely that the top 1M 12-char passwords are as likely to be successful as the top 1M 6/7/8-char passwords. I just did this for the top 1000 6/7/8 chhar passwords, the top 6 digit password "123456" represents 1.3% of all 1000 6-chars, where as "password" is 0.9% of all 1000 8-char.
- Eisenstein 4y ago
  > First, where do I find the most popular one million 12-character passwords that use A-Z/a-z/0-9? I'm sure it may not be easy to find this database, but it is probably not that difficult if you hang out in the type of circles that the people who cracked that site hang out in. > Math... This strikes me as nitpicking when one can access such powerful computing devices as to make the difference practically irrelevant. So make it 10million and wait a few more minutes, who cares?
  - slenk 4y ago
    Github: https://github.com/danielmiessler/SecLists/tree/master/Passwords https://github.com/danielmiessler/SecLists/tree/master/Passw...
  - FatActor 4y ago
    How is it nitpicking? The distribution tail effectively goes to a frequency of zero. Increasing to 10M doesn't solve the problem because the space is so vast, by the time you get to a fraction that has the similar area under the curve as 1M for 6/7/8 chars, you've lost any compute advantage. We're not talking an order of magnitude, we're talking multiple. As much as I know y'all want to hate on any password manager that isn't your favorite, math doesn't care about what strikes you as nitpicking.
deleted 4y ago
[deleted]

by sliken 4y ago

jart 4y ago

(26+10)**12 is 4738381338321616896 combinations. 300,000 attempts per second isn't going to have an easy time cracking that, so I don't see what the problem is with LastPass' requirements.

mint2 4y ago
“(26+10)*12” is irrelevant Please Refer back to “If you take the most popular 1M passwords and attack the master password…”
- jart 4y ago
  It is relevant, because it's where LastPass' responsibility ends. It's not their job to prevent people from being stupid and choosing a password like `lovelovel0ve` but rather to define a requirement that allows for sufficient complexity.
  - rsj_hn 4y ago
    I think a reasonable feature for a password manager would be to do NIST recommended checks, such as comparing passwords to databases of known compromised passwords and alerting/recommending rotation or rejection of the password if a match is found (depending on password entry UI). Obviously you're not going to get a complete db of known hacks, but a db of most common X million passwords, updated every 6 months or so, is pretty good, and is what I would expect a good password manager to do. LastPass is in the bad situation of needing to provide excellent security in a product that people really aren't willing to pay a lot of money for. Some of the websites that ask for passwords are in a better position to do this, but then you don't get the benefits of a password manager. Same issue for the the other password managers out there.
sliken 4y ago
Yes, those with pure random passwords are safe. What percent of LastPass users do you think use a very hard to remember completely random 12+ character password? Personally I use either VaultWardens random password generator, or some variation of the XKCD like 4-6 words out of 100,000 which give me somewhere north of 64-96 bits of entropy. Cracking that @ 300k/sec takes a quite long time. I like the XKCD approach, because it's particularly voice/phone friendly. However much more common in the real world is to pick an easy to remember password with low entropy, something like PinkFloydRocks, which fail because of lack of a number and change it to P1nkFloydRocks. Or maybe PinkFloydRocks<2 digit birth year>. Quite a few plaintext passwords have been leaked, some even with helpful popularity tables. I'd place bets that a decent percent of LastPass's vaults would fall to a top 10,000 12 character or longer popular passwords. I suspect someone is testing this right now.
- jart 4y ago
  I had a feeling you were speaking from experience with that 300k number. Does that include the cost of password stretching? As others have pointed out in this thread LastPass uses PBKDF2 with 100,000 rounds. Even if you have a supercharged PC with 6x ATI Radeon HD 5870 you're only going to be able to derive 25k AES keys per second tops to even try, since that doesn't include the cost of deciphering. So how do you do it?
  - sliken 4y ago
    No experience, just saw a post on someone attacking LastPass Vaults. It looked to include everything. Apparently they wrote a tool specifically attempting password recovery on LastPass vaults and with a RTX 2070 (2 generation old) managed 309,000 against the 5000 iteration flavor and 15,500 against the 100,100 flavor. More info at: https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant-unlock-of-the-password-vault/ https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant...

FatActor 4y ago

First, where do I find the most popular one million 12-character passwords that use A-Z/a-z/0-9? Second, the top 1M of 6/7/8 character passwords have a statistically higher probably of being the correct password than the top 1M of 62^12 because their distribution function as a percentage of possible instances is narrower. Put another way: the top 7 char password might be used 10 million times, and the 2nd most popular might be 9million, etc. With a 12 char password, the top 1 by nature appears much less frequency because the total possible space is larger and people have to think a little more. Entropy when that has nothing to do with inverse distributions. Put another way, look at the frequency of the top-1 password as a sum of all instances of all 1M passwords. It is much larger % for smaller passwords than larger. It is much less likely that the top 1M 12-char passwords are as likely to be successful as the top 1M 6/7/8-char passwords. I just did this for the top 1000 6/7/8 chhar passwords, the top 6 digit password "123456" represents 1.3% of all 1000 6-chars, where as "password" is 0.9% of all 1000 8-char.

Eisenstein 4y ago
> First, where do I find the most popular one million 12-character passwords that use A-Z/a-z/0-9? I'm sure it may not be easy to find this database, but it is probably not that difficult if you hang out in the type of circles that the people who cracked that site hang out in. > Math... This strikes me as nitpicking when one can access such powerful computing devices as to make the difference practically irrelevant. So make it 10million and wait a few more minutes, who cares?
- slenk 4y ago
  Github: https://github.com/danielmiessler/SecLists/tree/master/Passwords https://github.com/danielmiessler/SecLists/tree/master/Passw...
- FatActor 4y ago
  How is it nitpicking? The distribution tail effectively goes to a frequency of zero. Increasing to 10M doesn't solve the problem because the space is so vast, by the time you get to a fraction that has the similar area under the curve as 1M for 6/7/8 chars, you've lost any compute advantage. We're not talking an order of magnitude, we're talking multiple. As much as I know y'all want to hate on any password manager that isn't your favorite, math doesn't care about what strikes you as nitpicking.

deleted 4y ago

[deleted]