3 ms·
If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker c
by Kwpolska 4y ago
If you’re using full-disk encryption (and you should be), this is less relevant, since the FDE is protecting you in case of theft. If you aren’t, the attacker can do anything, including copying the Bitwarden file and using a GPU farm to crack the master password.
- Semaphor 4y ago> including copying the Bitwarden file and using a GPU farm to crack the master password. That should still take essentially forever, or did I miss some advances in brute forcing?
- hn_throwaway_99 4y agoLots of people, perhaps the majority, still use master passwords that don't have a ton of entropy. For example, the bad guys that stole the LastPass vaults have definitely cracked a lot of the vaults that were protected with weaker master passwords. 1Password's approach is definitely the right one here, where the master key is basically a combination of the user's master password and a random 128 bit (I think it's 128) value, which does make cracking impossible. The user has to print out this value so that if they need to sign in on a new device that they can enter the value, so it adds a little friction, but 1P has the right idea that humans just can't be relied upon to generate and memorize high entropy strings, in general.
- Semaphor 4y agoI’d bet (though in all fairness, only a low amount ;)) the intersection between a user that has both a weak master password and attackers willing to spend a ton to rent a GPU farm is pretty low, though.
- bastawhiz 4y agoYet, people stole LastPass vaults. Why bother stealing them if you don't plan to actually crack them? At least someone saw the potential for some ROI.
- Semaphor 4y agoLP had an issue with weak encryption for old accounts.
- organsnyder 4y agoEh... plenty of people with weak security hygiene also have high-value credentials.
- yunwal 4y agoMy guess is that most people who have high value passwords also have weak passwords. CEOs and CFOs can probably authorize huge financial transactions with little oversight and tend to be security illiterate.
- deleted 4y ago[deleted]
- macrolime 4y agoFDE does not protect against malware
- Kwpolska 4y agoI never said it does. If you’ve got malware, you should consider all your credentials fully compromised.