3 ms·
Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterati
by czk 2y ago
Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…
- commandersaki 2y agoI think in some cases the iteration count was like 5000.
- czk 2y agoYeah you’re right— sounds like accounts made prior to Feb 2018 were lower than 100,100. Yikes! Updated my post.
- Springtime 2y agoThere were accounts with as few as 1 (yes, 1) PBKDF2 iterations[1]. Others changed theirs to over 300k but it still ended up only being 5000 in reality[2]. So despite the messaging from LastPass about improving iteration count for existing users it wasn't always accurate. [1] https://news.ycombinator.com/item?id=34152779 https://news.ycombinator.com/item?id=34152779 [2] https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_encrypted_lastpass_vaults_demonstration/j1m3kcr/ https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_e...
- bberrry 2y agoMine had iteration count 1. I was livid when I found out. Fucking amateurs taking on the responsibility to safeguard everyone's passwords
- blackeyeblitzar 2y agoDidn’t many accounts have 5000 iterations by default