Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 77 posts

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#11

Post by Scaevolus »

jrockway wrote: post #2

Choosing a good key derivation function has always been critical to making passwords work. I guess lastpass didn't do that. I have not benchmarked these recently, but I fear that they had to compromise # of iterations to give "2012 low-end Android device" some chance of ever being able to unlock their vault. As a result, everyone else is vulnerable. Adding icing on the cake is leaking everyone's encrypted vault. Whoo…

KDFs only add 10-20 bits of security in terms of attack costs, there's only so much you can do to make 8 character passwords safe.

If you control the parameters you can improve that boundary-- say, FDE with a KDF that uses 8GB of RAM and 10 seconds to compute-- but consumer products are limited.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#12

Post by Tao3300 »

lifeisstillgood wrote: post #4

>>> KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password — which was just eight characters. Nor was he ever forced to improve his master password. This does fascinate me. How many p…

If you sold that much of it, the price would tank and people would try to find you and kill you.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#14

Post by autoexec »

handsclean wrote: post #5

The first paragraph very nearly lost me – irrational, rage bait, directly contradicts later stated facts – but there’s some good content later. The chief complaint seems to be that LastPass is not forcing this upgrade, they are just blast emailing unaffected people that they “forced” it while not actually doing so. And they’ve pulled similar stunts in the past, and in current communication seem to clearly be blaming…

> Everybody with a clue knows LastPass is a lost cause,

Yeah at this point, I have to wonder how there are still lastpass users to worry about whatever the latest lastpass scandal is.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#15

Post by Aurornis »

lifeisstillgood wrote: post #4

>>> KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password — which was just eight characters. Nor was he ever forced to improve his master password. This does fascinate me. How many p…

I’m fascinated by crypto lottery winners, too. The only person I know personally who did very well and exited on top did so for environmental guilt reasons: He became too opposed to the environmental effects of BitCoin’s energy consumption to feel okay about hanging on to it. Cashing out at the top was just a coincidence.

The other crypto lottery winners I know (those who have admitted it, anyway) gave up a lot of their winnings either by doubling down in BitCoin at the highs or by gambling on altcoins in the hopes of a repeat. They started as believers and their early winnings only galvanized their confidence. After that, they were dumping their cash into crypto at every opportunity because they thought it was going to make them supremely wealthy.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#16

Post by reverius42 »

Tao3300 wrote: post #12
lifeisstillgood wrote: post #4

>>> KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password — which was just eight characters. Nor was he ever forced to improve his master password. This does fascinate me. How many p…

If you sold that much of it, the price would tank and people would try to find you and kill you.

Isn’t the market cap of, say, Bitcoin high enough that selling a few mil USD worth shouldn’t really impact it? But maybe the trading volume is too low.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#17

Post by [deleted] »

Tao3300 wrote: post #12
lifeisstillgood wrote: post #4

>>> KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password — which was just eight characters. Nor was he ever forced to improve his master password. This does fascinate me. How many p…

If you sold that much of it, the price would tank and people would try to find you and kill you.

[deleted]

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#18

Post by kalverra »

Tao3300 wrote: post #12
lifeisstillgood wrote: post #4

>>> KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password — which was just eight characters. Nor was he ever forced to improve his master password. This does fascinate me. How many p…

If you sold that much of it, the price would tank and people would try to find you and kill you.

Unless it's some shitcoin with 0 trading volume, no chance. Bitcoin, Ethereum, and plenty of other currencies handle that volume daily with no issue.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#19

Post by DennisP »

reverius42 wrote: post #16
Tao3300 wrote: post #12

Earlier quoted context omitted.

If you sold that much of it, the price would tank and people would try to find you and kill you.

Isn’t the market cap of, say, Bitcoin high enough that selling a few mil USD worth shouldn’t really impact it? But maybe the trading volume is too low.

Nope, daily Bitcoin volume on Coinbase alone is over $200 million. Nobody cares if you sell 1% of that, at worst the price dips momentarily.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#20

Post by [deleted] »

reverius42 wrote: post #16
Tao3300 wrote: post #12

Earlier quoted context omitted.

If you sold that much of it, the price would tank and people would try to find you and kill you.

Isn’t the market cap of, say, Bitcoin high enough that selling a few mil USD worth shouldn’t really impact it? But maybe the trading volume is too low.

[deleted]
Post reply on HN