5 ms·
This claim looks strange. A 16 characters password from all character types can’t be broken. How could hackers break the vault, with end to end encryption and
by aborsy 4y ago
This claim looks strange.
A 16 characters password from all character types can’t be broken.
How could hackers break the vault, with end to end encryption and such password?
- paulpauper 4y agofaulty implementation of encryption , such as using a weak RNG
- wlonkly 4y agoA _random_ 16-character password from all character types can't be brute-forced. A password made from common dictionary words, with numbers substituted in with l33tsp3ak, and an exclamation mark on the end, is a different story. Passwords like that would be sitting in precomputed hash lists already.
- snowwrestler 4y agoThe hash would only be sitting in precomputed lists if LastPass did not salt the passwords first. It's my understanding that they did.
- wlonkly 4y agoAh, we both went on a tangent. The password in question is to the twitterer's LastPass vault, and so a precomputed hash list would be of no use, and since it's an encryption key and not a hash, there is nothing to salt. I suppose the point was more that faced with many users' LastPass vaults there are more likely and less likely keys -- but they'll still have to try the keys.
- aborsy 4y agoRead the tweets, explaining how they generated their password.