Earlier quoted context omitted.
They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.
How do you make sure that file does not end up corrupt?
Redundant encrypted backups, error-correcting codes.
Feds Link Cyberheist to 2022 LastPass Hacks
11–20 of 266 posts
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#12The way LastPass had handled the incident back in 2022 is so disappointing. I don’t even how anyone could even recommend using them again.
Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…
I think in some cases the iteration count was like 5000.
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#131Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#14Earlier quoted context omitted.
They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.
How do you make sure that file does not end up corrupt?
So what if it does? Worst case you just go through the account recovery process at each institution. Password managers are a convenience. Data integrity isn’t critical but security is.
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#15The way LastPass had handled the incident back in 2022 is so disappointing. I don’t even how anyone could even recommend using them again.
Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…
Didn’t many accounts have 5000 iterations by default
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#16“Bitcoin has never been hacked” Don’t have to hack crypto to steal all the crypto.
Bitcoin has never been hacked.
The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin.
To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broken, which is really just a fundamental misunderstanding of cryptography 101.
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#17Earlier quoted context omitted.
Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…
I think in some cases the iteration count was like 5000.
Yeah you’re right— sounds like accounts made prior to Feb 2018 were lower than 100,100. Yikes! Updated my post.
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#18I'm a bit confused on how the LastPass hack enabled the loss of passwords. I assume it works the way that I understand 1Password to work which should mean this would still be very difficult to impossible to do. Can anyone explain what I'm wrong about in terms of how the password managers work or how LastPass works differently?
So the way that I understand 1Password to work is that the decryption key is split in two: the user's single password + a secret key. You need both to decrypt the vault. The secret key is, again according to my understanding, generated randomly and is like 128bits? Once 1Password generates it and sends it to you (maybe they don't even send it and it is generated locally, I don't know), they never see it again. Thus, even if your vault were stolen, the thieves would need to crack your password (very likely not that secure) but also the 128 bit secret key so you would have a minimum of 128bit security which seems fine?
What's different about LastPass? Were the secret keys stolen somehow too? Were the targets of the stolen vaults then hit with further attacks to extract the secret keys? Does LastPass not use a similar structure as 1Password? Or am I actually not as safe as I thought using 1Password?
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#19Earlier quoted context omitted.
They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.
How do you make sure that file does not end up corrupt?
copies and replication
I have used Keepass since before lastpass existed and sync with multiple machines/locations via syncthing (originally synced with rsync)
Re: Feds Link Cyberheist to 2022 LastPass Hacks
#20I'm a bit confused on how the LastPass hack enabled the loss of passwords. I assume it works the way that I understand 1Password to work which should mean this would still be very difficult to impossible to do. Can anyone explain what I'm wrong about in terms of how the password managers work or how LastPass works differently? So the way that I understand 1Password to work is that the decryption key is split in two:…
LastPass does not use the secret key concept that 1Password uses, it only uses a key derived from your password. After the breach they rushed to increase the hash iterations [1] and added features to let enterprise admins set minimum iterations [2] but of course it was too late at that point.
[1] https://palant.info/2022/12/28/lastpass-breach-the-significa... [2] https://support.lastpass.com/s/document-item?language=en_US&...