3 ms·

The way LastPass had handled the incident back in 2022 is so disappointing. I don’t even how anyone could even recommend using them again.

some_furry 2y ago
After my experience with LastPass (and trying to report cryptographic weaknesses), my answer to people considering switching is "RUN DON'T WALK" https://soatok.blog/2023/01/21/how-you-respond-to-security-researchers-says-everything-about-you/ https://soatok.blog/2023/01/21/how-you-respond-to-security-r...
gwern 2y ago
And still is disappointing: > Reached for comment, LastPass said it has seen no definitive proof — from federal investigators or others — that the cyberheists in question were linked to the LastPass breaches. “Since we initially disclosed this incident back in 2022, LastPass has worked in close cooperation with multiple representatives from law enforcement,” LastPass said in a written statement. “To date, our law enforcement partners have not made us aware of any conclusive evidence that connects any crypto thefts to our incident. In the meantime, we have been investing heavily in enhancing our security measures and will continue to do so.” So, there's slightly less than conclusive evidence, and how much evidence should you need anyway, given the alternative hypotheses?
- j16sdiz 2y ago
  What else could you expect? It is their sole product. Accept the responsibility and declare bankruptcy? No, if they care s little bit, they would have done that 10+years ago
czk 2y ago
Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…
- commandersaki 2y ago
  I think in some cases the iteration count was like 5000.
  - czk 2y ago
    Yeah you’re right— sounds like accounts made prior to Feb 2018 were lower than 100,100. Yikes! Updated my post.
  - Springtime 2y ago
    There were accounts with as few as 1 (yes, 1) PBKDF2 iterations[1]. Others changed theirs to over 300k but it still ended up only being 5000 in reality[2]. So despite the messaging from LastPass about improving iteration count for existing users it wasn't always accurate. [1] https://news.ycombinator.com/item?id=34152779 https://news.ycombinator.com/item?id=34152779 [2] https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_encrypted_lastpass_vaults_demonstration/j1m3kcr/ https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_e...
  - bberrry 2y ago
    Mine had iteration count 1. I was livid when I found out. Fucking amateurs taking on the responsibility to safeguard everyone's passwords
- blackeyeblitzar 2y ago
  Didn’t many accounts have 5000 iterations by default

some_furry 2y ago

After my experience with LastPass (and trying to report cryptographic weaknesses), my answer to people considering switching is "RUN DON'T WALK" https://soatok.blog/2023/01/21/how-you-respond-to-security-researchers-says-everything-about-you/ https://soatok.blog/2023/01/21/how-you-respond-to-security-r...

gwern 2y ago

And still is disappointing: > Reached for comment, LastPass said it has seen no definitive proof — from federal investigators or others — that the cyberheists in question were linked to the LastPass breaches. “Since we initially disclosed this incident back in 2022, LastPass has worked in close cooperation with multiple representatives from law enforcement,” LastPass said in a written statement. “To date, our law enforcement partners have not made us aware of any conclusive evidence that connects any crypto thefts to our incident. In the meantime, we have been investing heavily in enhancing our security measures and will continue to do so.” So, there's slightly less than conclusive evidence, and how much evidence should you need anyway, given the alternative hypotheses?

j16sdiz 2y ago
What else could you expect? It is their sole product. Accept the responsibility and declare bankruptcy? No, if they care s little bit, they would have done that 10+years ago

czk 2y ago

Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…

commandersaki 2y ago
I think in some cases the iteration count was like 5000.
- czk 2y ago
  Yeah you’re right— sounds like accounts made prior to Feb 2018 were lower than 100,100. Yikes! Updated my post.
- Springtime 2y ago
  There were accounts with as few as 1 (yes, 1) PBKDF2 iterations[1]. Others changed theirs to over 300k but it still ended up only being 5000 in reality[2]. So despite the messaging from LastPass about improving iteration count for existing users it wasn't always accurate. [1] https://news.ycombinator.com/item?id=34152779 https://news.ycombinator.com/item?id=34152779 [2] https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_encrypted_lastpass_vaults_demonstration/j1m3kcr/ https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_e...
- bberrry 2y ago
  Mine had iteration count 1. I was livid when I found out. Fucking amateurs taking on the responsibility to safeguard everyone's passwords
blackeyeblitzar 2y ago
Didn’t many accounts have 5000 iterations by default