Perhaps using a pepper should be a key principle for such use cases? - https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords https://dropbox

Perhaps using a pepper should be a key principle for such use cases? - https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords https://dropbox.tech/security/how-dropbox-securely-stores-yo... - https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography) Their payouts for reported bugs under bug bounty program have been very low, for a service used at the scale of Lastpass I believe this is just not ideal. > Points – $5,000 per vulnerability - https://bugcrowd.com/lastpass https://bugcrowd.com/lastpass