9 ms·

I had a feeling you were speaking from experience with that 300k number. Does that include the cost of password stretching? As others have pointed out in this t

by jart 4y ago

I had a feeling you were speaking from experience with that 300k number. Does that include the cost of password stretching? As others have pointed out in this thread LastPass uses PBKDF2 with 100,000 rounds. Even if you have a supercharged PC with 6x ATI Radeon HD 5870 you're only going to be able to derive 25k AES keys per second tops to even try, since that doesn't include the cost of deciphering. So how do you do it?

sliken 4y ago
No experience, just saw a post on someone attacking LastPass Vaults. It looked to include everything. Apparently they wrote a tool specifically attempting password recovery on LastPass vaults and with a RTX 2070 (2 generation old) managed 309,000 against the 5000 iteration flavor and 15,500 against the 100,100 flavor. More info at: https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant-unlock-of-the-password-vault/ https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant...