3 ms·

There's limited concern if you had a good master password right? I've changed everything important long ago but still plenty of small stuff I wouldn't love leak

by mptest 3y ago

There's limited concern if you had a good master password right? I've changed everything important long ago but still plenty of small stuff I wouldn't love leaking.

pacifika 3y ago
The length of the salt was zero at some point early on if I remember correctly. If you’re concerned Steve Gibson did a good rundown on the security now podcast
- e40 3y ago
  Which one? There are like 7 or so episodes that discuss LP!?
daveoc64 3y ago
A strong password will help a lot, but the password iteration value may reduce protection for some people. One of the most unfortunate things with the LastPass breach last year was that lots of accounts had the number of PBKDF2 iterations set to a low value (typically 1000). A low number of iterations makes brute forcing the master password easier. This value would have been set when the user's account was created, and for older accounts it wouldn't have been increased unless users changed the setting manually. LastPass is now setting it a lot higher by default, but that doesn't help the vaults leaked in the breach. https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass%2Fabout-password-iterations.html&_LANG=enus https://support.lastpass.com/s/document-item?language=en_US&...
aaron695 3y ago
[dead]
scott00 3y ago
Depends on your definition of a good password. The experience of one victim mentioned suggests it's economical to crack at least 50 bit entropy passwords for at most a $3.5 mil payout. 50 bits isn't great, but it's not terrible either.
- mptest 3y ago
  My password was made with the best practices, but I see people mention the amount of iterations done. Does that basically mean just Iterations * each attempt to brute force? ie 2 rotations to figure out a 1 digit pin = (1/10)2= 20 max guesses? Thanks a lot for reference though re 50 bits and 3.5. Helpful numbers to keep in mind. (Edit: looked more in to how to calc password entropy. Luckily I'm good. Thanks a lot for this info tho.)
cyrnel 3y ago
The whole company's ability to fix current and future issues has been called into question as well: https://soatok.blog/2023/01/21/how-you-respond-to-security-researchers-says-everything-about-you/ https://soatok.blog/2023/01/21/how-you-respond-to-security-r...
- mptest 3y ago
  Agreed, I certainly don't still use them, But also I haven't changed ALL account info... I reseted on my master password being secure but I suppose as quantum computers ramp up I'm going to need to change everything as those vaults won't disappear... What a colossal fuck up by LP.

by mptest 3y ago

There's limited concern if you had a good master password right? I've changed everything important long ago but still plenty of small stuff I wouldn't love leaking.

pacifika 3y ago

The length of the salt was zero at some point early on if I remember correctly. If you’re concerned Steve Gibson did a good rundown on the security now podcast

e40 3y ago
Which one? There are like 7 or so episodes that discuss LP!?

daveoc64 3y ago

A strong password will help a lot, but the password iteration value may reduce protection for some people. One of the most unfortunate things with the LastPass breach last year was that lots of accounts had the number of PBKDF2 iterations set to a low value (typically 1000). A low number of iterations makes brute forcing the master password easier. This value would have been set when the user's account was created, and for older accounts it wouldn't have been increased unless users changed the setting manually. LastPass is now setting it a lot higher by default, but that doesn't help the vaults leaked in the breach. https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass%2Fabout-password-iterations.html&_LANG=enus https://support.lastpass.com/s/document-item?language=en_US&...

aaron695 3y ago

[dead]

scott00 3y ago

Depends on your definition of a good password. The experience of one victim mentioned suggests it's economical to crack at least 50 bit entropy passwords for at most a $3.5 mil payout. 50 bits isn't great, but it's not terrible either.

mptest 3y ago
My password was made with the best practices, but I see people mention the amount of iterations done. Does that basically mean just Iterations * each attempt to brute force? ie 2 rotations to figure out a 1 digit pin = (1/10)2= 20 max guesses? Thanks a lot for reference though re 50 bits and 3.5. Helpful numbers to keep in mind. (Edit: looked more in to how to calc password entropy. Luckily I'm good. Thanks a lot for this info tho.)

cyrnel 3y ago

The whole company's ability to fix current and future issues has been called into question as well: https://soatok.blog/2023/01/21/how-you-respond-to-security-researchers-says-everything-about-you/ https://soatok.blog/2023/01/21/how-you-respond-to-security-r...

mptest 3y ago
Agreed, I certainly don't still use them, But also I haven't changed ALL account info... I reseted on my master password being secure but I suppose as quantum computers ramp up I'm going to need to change everything as those vaults won't disappear... What a colossal fuck up by LP.