4 ms·
In principle, your passwords might be stored as a JSON blob encrypted using a key derived from your master password. In which case that metadata could still be
by ShredKazoo 4y ago
In principle, your passwords might be stored as a JSON blob encrypted using a key derived from your master password. In which case that metadata could still be secure. I doubt it though.
- lolinder 4y agoLastPass already admitted that the metadata was all leaked. Usernames and passwords were encrypted, but all else seems to have been in the clear.
- ThunderSizzle 4y agoBased on what happened to my wife, if the password was encrypted, breaking it was trivial
- lolinder 4y agoShe probably had an account that had a very low number of iterations. LastPass never updated those unless someone knew to do it manually, so if it was an old account she likely had 5,000 iterations out of the recommended minimum of 100,000.
- william_T 4y agojust checked, mine is 5,000
- lolinder 4y agoYep. And the sucky thing is that the only recourse at this point is to reset all your passwords, because what was leaked was the low-iteration vault. Changing it now only saves you for future leaks.
- trogdor 4y agoI believe that my vault was similarly-low iteration, however my master password was an approximately 30 character string that contained no dictionary words. Based on your understanding, does my master password length sufficiently mitigate the low-iterations, or is decryption a realistic possibility?
- lolinder 4y agoI don't know enough to know. I'd change your passwords just to be safe.
- kadoban 4y agoIf your master password has enough entropy, you're safe with 1 iteration. It's not a great idea, and what "enough" is can be ambiguous. But if your master password is provably 70 bits of entropy or so, you should be fine. But it's probably easier to just change your passwords anyway. At this point I wouldn't be suprised if the story gets even worse somehow.
- ThunderSizzle 4y agoIt wasn't an old account. It was made within a year of the breach.