3 ms·
A strong password will help a lot, but the password iteration value may reduce protection for some people. One of the most unfortunate things with the LastPass
by daveoc64 3y ago
A strong password will help a lot, but the password iteration value may reduce protection for some people.
One of the most unfortunate things with the LastPass breach last year was that lots of accounts had the number of PBKDF2 iterations set to a low value (typically 1000). A low number of iterations makes brute forcing the master password easier.
This value would have been set when the user's account was created, and for older accounts it wouldn't have been increased unless users changed the setting manually.
LastPass is now setting it a lot higher by default, but that doesn't help the vaults leaked in the breach.
https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass%2Fabout-password-iterations.html&_LANG=enus https://support.lastpass.com/s/document-item?language=en_US&...