4 ms·
I assumed that the hackers have the encrypted vaults. Is it known that that they have unencrypted password data?
by drdec 4y ago
I assumed that the hackers have the encrypted vaults. Is it known that that they have unencrypted password data?
- dhdgrygev 4y agoNo, but apparently the urls were not encrypted, so that could be quite a gold mine for blackmail.
- thot_experiment 4y agoI believe they are only the encrypted vaults, but with the cost of compute plummeting and the inclusion of unencrypted data alongside the encrypted data I think you have reason to worry if you believe there are people who would perform a dedicated attack on you, or you are in a class likely to be identified as high value.
- drdec 4y agoOh, absolutely, you need to test that information as exposed and react accordingly. Fortunately for me, I don't use LastPass.
- TillE 4y ago> the cost of compute plummeting You should do some actual math to roughly estimate what it would take to crack a good password. Use a strong password, use a resource-intensive key derivation function, and you should feel extremely comfortable that your encrypted data will not be cracked within your lifetime.
- JoshuaEN 4y agoNot passwords, but the hackers have some unencrypted data because LastPass did not encrypt all vault data client-side: "The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs" - https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... The "such as..." without enumerating everything is very ominous as well.