3 ms·
Depends on what you mean by "the data decryption values". If you mean the encryption keys for the vaults themselves, no. Those are derived from the individual
by secabeen 4y ago
Depends on what you mean by "the data decryption values". If you mean the encryption keys for the vaults themselves, no. Those are derived from the individual master passwords (in non-SSO setups, with SSO it's more complicated, and I don't fully understand the impact). So the attackers have a bunch of encrypted vaults from a backup. They can now brute-force the vaults, but if the original Master Passwords were secure (16+ characters, all 4 classes), those vaults should remain secure. Of course, many people use bad passwords, and those people are at risk.
- dvngnt_ 4y agothe exposed passwords isn't even the worst part. it's the fact that user vaults sites are unencrypted so now attackers know every website that you thought was important enough to save. they know what bank you use, which adult sites you visit, what medical conditions you might have
- secabeen 4y agoI understand that some people feel that that is sensitive data. It's not a big threat for me. My ISP and Google already has that data in many cases (IP destination data, DNS lookups, etc.) YMMV.
- j-bos 4y agoah, thanks for the clarification.