The poster states: >"If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key i

The poster states: >"If you had a legacy 5000 rounds or 10000 rounds, the # of rounds can't just be increased server side. Changing that would mean a new key is derived. So older users likely still have a pretty low number of pbkdf2 rounds which makes them more vulnerable to brute forcing" Can someone say about how long would it take for an attacker to brute force a pbkdf2 master key with 5000 or 10000 rounds? Looking at their blog post from a few days ago they state: >"The threat actor may attempt to use brute force to guess your master password and decrypt the copies of vault data they took. Because of the hashing and encryption methods we use to protect our customers, it would be extremely difficult to attempt to brute force guess master passwords for those customers who follow our password best practices. We routinely test the latest password cracking technologies against our algorithms to keep pace with and improve upon our cryptographic controls."[1] Can someone say did they notify customers who had legacy accounts that used 5000 or 10000 iteration pbkdf2 master keys? They sure don't seem to mention anything remotely like that in their incident report.[1] In the above paragraph "best practices" is a link to the URL that fails to mention anything about selecting or periodically increasing the number of pbkdf2 iterations.[2]. If this weren't bad enough you are interrupted from reading their important incident report by a pop up asking you to sign up for their mailing list. Is an incident report really an appropriate place to use for marketing purposes? Are they really this shit of a company? [1] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... [2] https://support.lastpass.com/help/what-is-the-lastpass-master-password-lp070014 https://support.lastpass.com/help/what-is-the-lastpass-maste...